Last updated: 23 October 2026 · By Maurice, freeehouse team · About 3 minutes to read
Who needs a privacy policy?
Anyone who processes personal data on their website. That is practically always the case: when a page is opened, the browser sends the IP address to the server, and many hosts store it in log files. Add a contact form, embedded maps, videos or statistics, and the policy gets longer.
What must go in under Art. 13 GDPR?
- Name and contact details of the controller
- Contact details of the data protection officer, if there is one
- Purposes of the processing and legal basis, for example Art. 6 para. 1 lit. b or f GDPR
- for legitimate interest: which interest
- Recipients, for example host or other services
- Transfers to countries outside the EU and on what basis
- Storage period
- Rights of access, rectification, erasure, restriction, portability and objection
- Right to withdraw consent
- Right to lodge a complaint with a supervisory authority
Which building blocks does a typical small website need?
| Building block | when needed |
|---|---|
| Hosting and server logs | always |
| Encryption | whenever the site runs over https |
| Contact by email and phone | whenever contact details are given |
| Contact form | if there is one |
| Cookies and consent | if non-essential cookies are set |
| Embedded services | maps, videos, booking tools, fonts from third-party servers |
| Statistics | if visits are analysed |
Do I need a data protection officer?
Under § 38 BDSG (German Federal Data Protection Act), as a rule only once at least 20 people are permanently engaged in automated processing of personal data, or for particularly sensitive processing. Most small businesses don't need one.
Can I use a generator or a template?
Yes, generators are a good start if you list every service you actually use. The policy has to fit your site. A policy copied from another website is risky: it names services you don't use and leaves out ones you do. And it is often protected by copyright.
How short can a privacy policy be?
The fewer third-party services a site embeds, the shorter the policy gets. A site with no tracking, fonts on its own server and maps as a link instead of an embed needs only a few building blocks and often no cookie banner. That is also nicer for visitors.
Where does the privacy policy have to be?
Easy to reach from every page, usually through a link in the footer, and linked next to the contact form. It must be understandable and written in clear language.
This article is a guide, not legal advice. For health data, shops or many embedded services, have your policy checked by a professional.
At freeehouse we build websites without tracking cookies, with fonts on our own server and as few third-party services as possible. We set up the privacy policy with you. We don't charge for the build. How freeehouse works
How often do I have to update the privacy policy?
Whenever something changes on the site that affects data: a new form, an embedded service, a new host, a newsletter. It is also worth a look once a year, because laws and terms change, as when the TTDSG became the TDDDG in 2024.
Frequently asked questions
Does every website need a privacy policy?
Practically every business website, because data such as the IP address is processed as soon as a page is opened.
May I copy the privacy policy from another site?
We advise against it. It usually doesn't fit your services and may be protected by copyright.
Is a link in the legal notice enough?
The privacy policy should be easy to reach from every page, and the usual way is its own link in the footer.
What happens with a faulty privacy policy?
Supervisory authorities can impose fines, with Art. 83 GDPR setting the framework. Warning letters are also possible.
Sources
- Art. 13 DSGVO Informationspflicht bei Erhebung, accessed 23 October 2026
- Art. 6 DSGVO Rechtmäßigkeit der Verarbeitung, accessed 23 October 2026
- § 38 BDSG Datenschutzbeauftragte nichtöffentlicher Stellen, accessed 23 October 2026
- Art. 83 DSGVO Geldbußen, accessed 23 October 2026
Providers' prices and terms change often. What counts is what's in your customer account and your contract. Not legal advice.
Read more
Ready for a new website?
We're currently testing freeehouse with a first round of businesses. Claim your spot on the waiting list.