What a privacy policy and cookies must contain (GDPR)
A good privacy policy is not legal filler, it is a clear answer to one question the visitor and the regulator both ask: what happens to my data on this site? Under the GDPR every business website that collects any personal data (even just a name and email from a contact form) needs one. A generic copy-paste from another site is risky, because it usually describes data processing that does not match what your site actually does. The generator above assembles the text from what you tick, so it fits your case.
Whatever tool you use, a complete privacy policy should cover:
- Who the data controller is and how to reach them (company name, address, contact email for data matters).
- What data you collect and why, tied to the real purpose: a contact form, newsletter, statistics, orders in a shop.
- The legal basis for each purpose (consent, performance of a contract, or a legitimate interest).
- How long you keep the data and when it is deleted.
- Who else processes the data, your hosting provider, mail system, analytics or payment operator (the processors).
- The rights of the person: access, rectification, erasure, objection, and the right to complain to the supervisory authority.
Cookies are a separate obligation. The policy should say which cookies the site uses and split them into essential (needed for the site to work) and optional ones (analytics, marketing/remarketing pixels). The key rule people miss: optional cookies need real consent before they load. A banner that only informs, or that drops tracking scripts before the visitor clicks anything, does not meet the requirement. The user must be able to refuse the non-essential ones just as easily as accept them.
Not sure whether your current setup is compliant? Run the free GDPR and cookies test to see what your site loads before consent, then use the generator above to produce the policy and banner text.