A practical guide, not legal advice
This article summarises the main rules in a simple way. It does not replace a professional's opinion: for your business, with your data and your suppliers, have your choices checked by a privacy consultant or a lawyer.
Which data counts
Under the GDPR, «personal data» is any information that can identify a person, even indirectly.
- Name, email and phone number entered in a form.
- IP address, device identifiers and browsing data collected by analytics tools.
- Location, photos, contacts and anything else the app asks access to.
- Sign-in and purchase data of users' accounts.
Website: privacy notice, cookies and consent
- Privacy notice: always, if you collect data. It says who processes the data, why, for how long, who it is shared with and how to exercise rights.
- Technical cookies (needed for the site to work): no consent required, but they must be mentioned in the notice.
- Analytics and marketing: generally require consent before the cookie is set. Scrolling or carrying on browsing does not count as consent.
- The banner must offer a refusal as easy as acceptance, and consent must be requested again after a certain period (the Italian regulator's guidance mentions six months).
- Forms: explain what the data is used for and link the notice next to the button.
Apps: what the stores ask for
- A privacy policy reachable online, linked in the app listing.
- The data collection disclosure: «App Privacy» on the App Store and «Data safety» on Google Play. They must match what the app really does, including third-party libraries.
- Permissions requested at the right moment with a clear explanation.
- On iOS, if the app lets people create an account, also account deletion from within the app.
Who «processors» are and why they matter
Every supplier that processes data on your behalf (hosting, email sending, analytics, payments, chat) is a «processor»: it must be named in the notice and, as a rule, governed by an agreement. If data leaves the European Economic Area, specific safeguards are needed: check where the servers of the services you use are located.
What to do when something goes wrong
- User requests (access, correction, deletion): must be handled within a month.
- Data breach (unauthorised access, losses): if people are at risk it must be notified to the regulator within 72 hours of becoming aware of it.
- Keep a record of what you collect and why: a simple, up-to-date register saves a lot of time.
How we handle it on our own site
The cookie banner offers three equal choices (essential only, choose, accept all) and links consents to Google Consent Mode: until you choose, no analytics or marketing cookie is set. The choice expires after six months. Card data never goes through our site: payment takes place on the providers' pages. It is all explained in the privacy policy.
If you are preparing a project, the checklist before commissioning a project also covers what to prepare on data. Our service prices: websites from €1,350, iOS apps from €4,500, Android apps from €4,200.