An offer sets relevant proposal and interaction terms; a privacy policy explains personal data handling. Write them around actual website operations. A legal-text page does not fix a mismatched form or undisclosed transfer to an external service.
Describe the service and customer journey first
Record the offering, order process, pricing and confirmation. Consultation requests and paid purchases may need different terms. Counsel assesses contents, parties, rights and procedures for the activity.
For example, a site may accept only project-estimation requests. Buttons should not suggest immediate purchase at an unagreed price. Documents and interface should explain the same next step.
Map personal data processing
Inventory form fields, files, logs, analytics and connected services. Define purpose, recipients, access and retention for each flow. Policies should reflect actual tools, including messengers or CRM receiving enquiries.
Remove unnecessary fields by agreement and use suitable channels for sensitive material. Provide user information in context. One generic statement does not automatically explain different processing purposes.
Assess GDPR applicability and lawful bases specifically
GDPR has a defined scope. Specialists assess activities, establishment, offerings and processing against the Regulation’s criteria. Do not decide solely from website language or a broad international-business statement.
Define lawful bases, duties and provider relationships for relevant processing. Consent is not a universal replacement for other requirements. Where required, technical mechanisms should implement agreed conditions, including changed user choices.
Reconcile documents with implementation
Check forms, messages, third-party requests and transfers. Assess consent management through behaviour rather than a banner’s existence. Provide access controls, protection and relevant user-request procedures.
Assign legal and technical responsibilities and changes requiring review. New SDKs, payments or CRM can change data flows. Maintain conformity alongside the product rather than promise it permanently from publishing text.
Sources and further reading
