A privacy notice is useful only when it describes what your store actually does. Start with forms, payments, delivery, email and measurement tools. Record which information goes where and why. Using a platform does not automatically transfer your responsibility for your own purposes and settings.
Create a data inventory
Use the same worksheet for each flow: data category, purpose, legal basis, recipient, role, retention and access. Start with delivery details, accounting payment references and marketing preferences. Include spreadsheet exports, support tools and external providers, which are easily overlooked.
| Flow | Purpose and legal basis | Recipient and role | Retention and access |
|---|---|---|---|
| Order | Enter the fields delivery requires | Enter your actual services and their roles | Record retention and authorised staff |
| Marketing | Record consent route or assessed exception | Record sending tool and any transfers | Record opt-out, evidence and deletion date |
Write from the inventory
Explain clearly who is responsible, what is processed, for which purposes, on which basis and for how long. Cover recipients, rights, contact details and international transfers where applicable. Do not copy hosting-location or security claims without contractual evidence. Make information accessible when collecting data.
Request only necessary data
Review each field in your order and contact forms. For date of birth or phone number, identify the actual process needing it and whether that process can work without it. Record the decision rather than making fields mandatory by habit. Handle a voluntary newsletter choice separately from ordering.
Newsletters and the customer exception
Commercial email generally requires prior consent. A limited exception can apply to your own similar products for existing customers, with opt-out at collection and a simple free unsubscribe in every message. An unfinished checkout address does not automatically create a customer relationship. Record the route and evidence.
Assess cookies by their operation
Necessary functional cookies do not require cookie consent. Limited analytics cookies with no or little privacy impact may also qualify for an exception. This does not automatically cover every statistics tool. Tracking and advertising cookies generally require prior consent. Assess configuration, sharing and legal basis rather than the analytics label.
Access and suppliers
Restrict access by role, use suitable authentication and remove old accounts. Determine whether each provider is a processor or independent controller and which arrangements are needed. Check subprocessors and transfers. Prepare an incident process; breaches need assessment against notification and communication duties. Check roles and supplier arrangements.
Implement rights and retention
Make sure you can actually handle access, correction, deletion and objection requests. A deletion request does not always require erasing legally required records. Separate data subject to retention obligations from marketing profiles and delete unnecessary data according to justified periods.
Prevent common errors
In a fresh browser profile, test refusal, acceptance and later withdrawal. Record which analytics or advertising tools actually start and which preference is remembered. Check a newsletter unsubscribe in the sending tool too. If behaviour differs from the choice or notice, fix the discrepancy before further use.
Frequently asked questions
Does all analytics require consent? No; assess actual privacy effects. May I email every customer? Only under an applicable consent route or customer exception. Does a privacy notice make everything lawful? No; actual processing and configuration must comply too.
Trace one real order
Follow a trial order through every system and compare its route with your inventory. Then test refusal, unsubscribe and a rights request. Resolve differences before activating more tools. Also read the basket-email guide.
Sources and checks
Primary sources checked on 26 October 2026: Dutch DPA: right to information · Dutch DPA: cookie categories · ACM: preventing spam
