Privacy, Cookies and Compliance Basics for Website Owners

The obligations that apply to almost everyone

• Publish a privacy policy that names what you collect, why, how long you keep it and who you share it with.
• Obtain consent before setting non-essential cookies, including analytics and advertising pixels.
• Provide a way for people to request access to or deletion of their data.
• Collect only what you need, and delete it when the purpose ends.
• Secure what you hold — HTTPS, encrypted backups, access control.
• Have a plan for notifying affected people and regulators if data is exposed.

This is general guidance, not legal advice. Requirements vary by jurisdiction and by the markets you sell into.

Cookie consent done properly

A banner that only says 'we use cookies' is not consent. Non-essential scripts must not load until the visitor agrees, refusal must be as easy as acceptance, and the choice must be revocable. Implement a consent manager that gates tag loading, and keep a record of consent state.

Practically, that means analytics and pixel scripts load conditionally after a positive choice, and essential cookies — session, cart, security — are documented as strictly necessary.

Reduce your exposure

• Do not store card data; let the payment gateway handle it.
• Purge old form submissions and abandoned accounts on a schedule.
• Limit who in the team can export customer lists.
• Keep a short register of every third-party tool that receives customer data.
• Sign data processing terms with vendors who process data on your behalf.

Frequently asked questions

Do I need a cookie banner if I only use Google Analytics?

Yes. Analytics cookies are non-essential in most regimes and require prior consent.

Where is my data hosted?

You can choose the data centre region for your service, which helps when contracts or regulations require data to stay in a particular jurisdiction.