Your website’s privacy policy should say who you are, what personal information you collect, why, who you share it with, where it’s stored, how long you keep it, and how people can see or correct it. Use the template below and change every part in brackets to match what your business actually does.
This template is general information, not legal advice. It suits a small business website with an enquiry form. If you collect health, financial or children’s information, or sell online, get it checked by a lawyer.
Before you start
- List every place your website collects personal information: forms, bookings, newsletters, online orders.
- List the providers that handle that information: your email, website host, booking system, payment provider.
- Decide how long you need to keep enquiries and customer records.
- Choose who your privacy officer is. In a small business, it’s usually the owner.
The template
Who we are. [Business name] is [a sole trader / a company] based in [town]. You can contact us about privacy at [email address] or [postal address]. [Name] is our privacy officer.
What we collect. When you use the form on our website, we collect your name, email address, phone number and your message. [Add anything else you collect.]
Why we collect it. We use your information to reply to your enquiry and, if you become a customer, to provide our services and send invoices. We don’t use it for anything else without asking you.
Who we share it with. We don’t sell or share your information. Our providers, such as [email provider], [website host] and [booking or payment system], handle it on our behalf.
Where it’s stored. Your information is stored [in New Zealand / by providers who store it overseas, in (country)]. [If overseas: We use providers that protect it to standards comparable to New Zealand’s.]
How long we keep it. We keep enquiries for [12 months] and customer records for seven years, as required for tax.
Cookies. [Our website only uses the cookies it needs to work. / We use (analytics tool) to understand how people use our website.]
Your rights. You can ask to see or correct the personal information we hold about you by emailing [email]. If you’re not happy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Last updated: [date].
Section by section: what each part is for
| Section | Why it’s there |
|---|---|
| Who we are | Principle 3 of the Privacy Act: people must know who is collecting their information |
| What and why | Principles 1 and 3: collect only what you need, and say why |
| Who we share it with | Principles 3 and 11: people must know who will receive their information |
| Where it’s stored | Principle 12: rules for sending information overseas |
| How long we keep it | Principle 9: don’t keep information longer than you need it |
| Your rights | Principles 6 and 7: the right to access and correct information |
Mistakes to avoid
- Copying an Australian, UK or US policy. They mention laws that don’t apply in New Zealand and miss ones that do.
- Promising things you don’t do, like deleting data after 30 days when you don’t.
- Hiding the policy. Link it from your form and your footer.
- Forgetting it exists. Update it whenever you add a new tool or form.
A free tool from the Privacy Commissioner
The Office of the Privacy Commissioner has a free generator, Priv-o-matic, that asks you questions and builds a privacy statement for you. It’s a good way to check you haven’t missed anything.
Every website we build includes a privacy policy written for the information its forms actually collect. Read more about what the Privacy Act means for your website.
Compare our three websites side by side, prices and all.
Frequently asked questions
Is a privacy policy a legal requirement in NZ?
The Privacy Act doesn’t require a document called a privacy policy, but it does require you to tell people how you use their information when you collect it. A privacy policy linked from your form is the easiest way to do that.
Do I need a cookie banner?
New Zealand has no specific cookie consent law. If you use analytics or advertising cookies, mention them in your privacy policy.
Where should I put my privacy policy?
On its own page, linked from your website footer and next to every form that collects personal information.
