Foundation · 2 min
What you need to know
Does an ecommerce store need a privacy policy?
Many stores need privacy information under applicable law and good transparency practice. Requirements vary, so identify the jurisdictions and data practices involved.
What should an ecommerce privacy policy explain?
Explain who handles data, what is collected, purposes, sources, sharing, international transfers, retention, choices, rights, security contact and complaint route as applicable.
Where should the privacy policy be displayed?
Make the policy easy to find before or when data is collected, including registration, checkout, marketing forms and site footer. Use layered notices for context-specific facts.
How often should privacy policies be reviewed?
Review it on a schedule and before new data, purposes, providers, markets or technologies launch. A policy must remain aligned with actual practice.
What happens when data practices change?
Assess the new purpose and applicable rules, update inventory, contracts, controls and notices, obtain fresh consent where required and record the effective date.
Should privacy policies explain third-party services?
Yes. Explain relevant categories or named providers, their purposes and where customers can learn more, according to applicable transparency requirements.
A quick store check
Compare the published privacy policy with actual forms, trackers, apps, purposes, sharing, retention and request channels.
Foundation · 2 min
Frequently asked questions
Can a privacy policy promise absolute security?
No. Describe reasonable practices accurately without making guarantees the store cannot keep.
Should every policy change require customer consent?
No. Some changes need notice or another action; fresh consent is required only when the applicable rule and processing change demand it.