The policy template below is offered solely as a starting point. It is not complete and therefore is not yet legally compliant. You must consider each provision and make all changes necessary to accurately reflect the uses and disclosures of the data you collect. Please note that the changes must not be limited to the items in grey italics: any and all provisions in this template are subject to change to the extent necessary to accurately reflect your uses and disclosures. We recommend that you engage licensed legal counsel to help with your review and all related changes.
Collecting Personally Identifiable Information
We may collect, store, and use the following kinds of personal information:
- Information you provide to us when your register with our [site/service/app], including your [describe the personal information provided by the user upon registration that you collect, store, and use--examples might include first and last names, e-mail address, physical address, telephone number, social security number].
- Information you provide when completing a profile on our [site/service/app], including your [describe the personal information provided by the user upon registration that you collect, store, and use--examples might include first and last names, gender, age, date of birth, education status, employment status, relationship status, hobbies and other interests].
- Information you provide when you subscribe to a newsletter or other periodic report or notification that we provide, including [describe the personal information provided by the user when they subscribe that you collect, store, and use--such as first and last names and an email address].
- Information about your device or computer, including [examples might include IP address, geolocation, browser type, browser version, device type, operating system, referring [site/service/app]].
- Information about your visits to and use of the [site/service/app], including how you use the [site/service/app], such as [describe the type of information--examples might include the timing, length, frequency, and pattern of use, and the pages, screens, or other displays of information looked at by the user].
- Information relating to any purchases you make of our [goods/services] [site/service/app], including [describe the information--examples might include first and last names, e-mail address, physical address, telephone number, and payment card information].
- Information that you post to our [site/service/app] for publication on the Internet, including [describe the information--examples might include first and last names, user names, profile pictures, and the actual content of what a user posts].
- Information contained in or relating to any communication that you send to us or send through our [site/service/app], including [describe the information--examples might include the content of the communication and metadata associated with it].
- [Identify and describe any other any other personal information that is collected by the site, service, or application, including when or how the operator collects it.]
Disclosing Personally Identifiable Information to Third Parties
We may disclose personally identifiable information we collect from you to the following third parties, for the purposes specified:
- Agents. [Describe the types of agents to whom the operator may disclose the information, why the operator may disclose it to them, and whether those agents can retain, store, or use the information for any other purposes--examples might include an outside shipping company used to fulfill and deliver orders, or a credit card company that processes sales transactions].
- Service Providers. We use third parties to provide [describe the services provided] on our [site/service/app]. If [or When] you sign up for [specified services], we will share [describe the information that will be shared] to the extent necessary in order for the third party to provide that service. [State whether the service providers can retain, store, or use the information for any other purposes.]
- Affiliates. We may disclose your personal information to our affiliates, including [describe the types of affiliates, such as the operator’s employees, officers, and directors, the operator’s subsidiaries, the operator’s ultimate parent company, and any other subsidiary of the operator’s ultimate parent company, as appropriate], in order to [describe why the operator might disclose the information to affiliates, and whether the affiliates can retain, store, or use the information for any other purposes].
- Other Third Parties. We may disclose to [describe any other types of third parties to whom the operator may disclose a user’s personal information] your [describe what information is disclosed], in order to [describe why the operator may disclose the information to these other types of third parties, and whether these other third parties can retain, store, or use the information for any other purposes].
- Other Disclosures. We may also disclose personally identifiable information we collect from you when we are required to do so by law, or when we believe that disclosure is necessary to protect our rights or to comply with a judicial proceeding, court order, or legal process served on our [site/service/app].
Making Changes to Your Information
[Choose whichever of the following two paragraphs is most accurate, and then delete the other (along with this bracketed instruction)]
This [site/service/app] permits you to review and make changes to the personally identifiable information we collect from you. You can make changes by [describe process for a user to review and make changes--examples of such processes could include logging in to the site, service, or application and using available tools, contacting customer support, or by contacting the operator by specified telephone, postal mail, or email]. OR
This [site/service/app] does not maintain a process by which you can review and make changes to the personally identifiable information we collect from you.
Response to Do Not Track Signals
Certain web browsers may provide an option by which you may have the browser inform websites or internet services you visit that you do not wish to have personally identifiable information about your activities tracked by cookies or other persistent identifiers across time and across third-party Internet websites, online or cloud computing services, online applications, or mobile applications. These are commonly called “do not track” signals. Our [site/service/app] responds to such signals by [if the site, service, or application takes action in response to such signals, describe the action taken and explain the basis for it; if the site, service, or application is unable to take action, state so and explain why; if the site, service, or application is able to take action but does not take action, state so and explain why].
We [do not allow/may allow] allow third parties to collect personally identifiable information about a user’s online activities, over time and across different sites, services, and applications, when that user uses our site, service, or application. [If “may allow,” the operator must describe the kinds of third parties who may be permitted to engage in such collection, the purpose for permitting such collection, and what those third parties may do with the information collected--such as, for example, collection of a user’s personally identifiable information by an advertising service for the purpose of directing targeted advertising to the user while using the operator’s or a third-party’s site, service, or application.]