Loading content
Contract Knowledge Centre · Customer-facing
A notice telling people what personal data you collect, why, what you do with it, how long you keep it, and what rights they have.
It is the most public statement a business makes about its data practices - and the easiest one to contradict. A policy describing a business other than yours is worse than none, because it is evidence.
What each clause is for, and what to look at in the wording you have been given.
What data is collected
Tells people what you hold.
What to check: That it matches your actual data inventory, field for field.
Purpose and lawful basis
Explains why you process it.
What to check: A basis stated per purpose, not one basis asserted for everything.
Sharing and processors
Discloses who else touches the data.
What to check: That every tool and partner actually in use is covered.
Retention
States how long you keep it.
What to check: That a period is actually stated, and actually observed.
Rights and how to exercise them
Tells people how to reach you.
What to check: That the contact route works and someone is responsible for it.
International transfers
Discloses data leaving Nigeria.
What to check: That it reflects where your tooling actually stores data.
Any one of these can have an innocent explanation. Ask for it before you sign.
When to speak to a lawyer