Website Privacy Policy

Almost every business website has a contact form, an advertising pixel or a traffic analytics tool. Each of these collects information about visitors, so a privacy policy is part of running a website properly. Many businesses copy a generic text from another site, and usually it does not match what the site actually does. This article explains what a privacy policy should include and how it should be built properly.

Why a privacy policy is needed

Israel's Privacy Protection Law requires, among other things, informing a person who is asked for personal information of the purpose of collection, whether providing it is mandatory, and to whom it may be transferred. A website privacy policy is the common way to give this information transparently. Following Amendment 13, privacy has become more important for organizations, so it is worth reviewing the privacy policy again, updating it, and not relying on an old text.

The information here is general. The exact fit depends on the type of business, the type of data and the tools the site uses.

First: map what the site actually does

Before writing, answer a few factual questions:

• What personal data is collected: name, phone, email, inquiry content, IP address, browsing data.
• Through which channels: forms, chat, newsletter sign-up, cookies, advertising pixels.
• Why: answering inquiries, marketing, improving the site, statistics.
• Who receives the data: hosting providers, email systems, analytics tools, advertising platforms, advisers.
• Where the data is stored and for how long.

A policy written after mapping reflects reality. A policy written without it may promise things the site does not do, or omit things it does.

What the privacy policy should include

1. Who we are. The business or site owner and a way to contact them on privacy matters.
2. What data is collected and from which sources, in plain language.
3. Purposes of use. Each purpose separately, rather than a general phrase like "any business purpose".
4. Whether providing data is mandatory and the consequences of not providing it, for example being unable to answer an inquiry.
5. Who receives the data. Categories of recipients, including service providers. If data leaves Israel, say so.
6. Cookies and tracking tools. Which cookies operate, why, and how to control them. If the site uses marketing cookies, clear treatment is needed, and sometimes a consent mechanism.
7. Information security. A general description of protections, without absolute promises such as "no risk".
8. Visitor rights. The right to review data, to request correction or deletion where appropriate, and how to submit a request.
9. Retention. How long data is kept or by what criteria.
10. Updates. The date of the last update and what happens when the policy changes.

Cookies and marketing consent

A common mistake is adding an advertising pixel or analytics tool without reflecting it in the policy. If the site runs such tools, mention them and check whether a consent banner is required. Marketing messages to people who contact you are also governed by the law on advertising messages, which should be checked separately.

The contact form: the forgotten point

A form where a visitor leaves a name, phone number and description of a personal problem collects personal data, sometimes sensitive. Place a link to the privacy policy next to the form, make sure the data goes through a secure channel, and do not keep it longer than needed. If the form uses a third-party service, that service is also a provider receiving data.

Common mistakes

• Copying text from another site, including the business name and details unrelated to your site.
• Wording so general that it does not mention tools the site actually uses.
• Absolute promises about security.
• No clear way to contact someone on privacy matters.
• Not updating the policy when a new tool is added to the site.

And the link to a privacy protection officer

Some organizations are required to appoint a privacy protection officer (DPO), and others do so voluntarily. If you are checking whether this is relevant for you, see Who Must Appoint a DPO and The DPO's Role. More on the field is on the Privacy Protection and DPO page.

In summary

A good privacy policy is a short, clear document that reflects what the site actually does and is updated when the site changes. If you would like us to review your current policy or adapt it to your business, you are welcome to contact us.

The information in this article is general and is not legal advice.