On this page
Quick answer: Yes, if your website collects any personal information, including through a contact form, analytics, bookings or orders. The policy explains what you collect, why, who you share it with, where it is stored, how long you keep it and how people can contact your Information Officer.
Why you need one
POPIA requires you to tell people what you collect about them and why when you collect it. A privacy policy linked from your forms and footer is the practical way to do that. Online stores also have to make their privacy and payment-security policies available under the Electronic Communications and Transactions Act.
What to include
- Who you are, and how to contact your Information Officer
- What information you collect: form details, orders, cookies, analytics
- Why you collect it and the lawful basis, such as a contract or consent
- Who you share it with: payment providers, hosting and email providers, analytics, spam protection
- Whether information leaves South Africa, and how it is protected
- How long you keep it
- How you protect it
- People's rights: access, correction, deletion and objection, and how to complain to the Information Regulator
- How you use cookies, and how visitors can change their choice
- The date it was last updated
Make it true
A copied template that lists tools you don't use, or misses ones you do, is worse than useless. List your actual service providers, for example your web host, your email provider, Paystack and Google Analytics, and update the policy when they change.
Where to put it
Link it in your website footer and next to every form that collects personal information. Keep it in plain language.
See our own privacy policy as an example.
Web Development from Digitalx, priced in writing before we start.