Privacy Policy

Intake Questionnaire

Please answer each question below as completely as possible. Your answers will directly determine the legal obligations, disclosures, and consumer-rights mechanisms that must appear in your privacy policy — there is no generic policy that fits every business, and incomplete answers create legal risk rather than saving time. Where a question does not apply to your business, please write “N/A” rather than leaving it blank, so we know it was considered rather than overlooked. Please attach any existing privacy policy, notice at collection, data inventory, or vendor list you already have.

I. COMPANY AND BUSINESS OVERVIEW

1. Full legal name of the entity (or each entity) this privacy policy will cover, including any “doing business as” names.

2. State or country of incorporation and principal place of business.

3. All jurisdictions — states, provinces, and countries — in which you have employees, customers, or users.

4. A brief description of your business and the products or services you offer.

5. All websites, mobile apps, and other digital properties this policy will cover (please list URLs and app names).

6. Approximate annual gross revenue for the most recently completed calendar year.

7. Approximate number of consumers whose personal information you annually buy, sell, share, or otherwise process (an estimate is fine — this determines whether certain state privacy law thresholds apply to your business).

8. Do you have a parent company, subsidiaries, or affiliates that will share personal information governed by this policy? If so, please identify them.

9. Do you currently have a privacy policy, notice at collection, or other data-practices documentation? Please provide copies.

9.1. Upload copy

Click to upload

PDF, DOC/DOCX, XLS/CSV, JPG/JPEG, PNG, GIF

9.2. Upload copy

Click to upload

PDF, DOC/DOCX, XLS/CSV, JPG/JPEG, PNG, GIF

10. Are you aware of any privacy law investigation, enforcement action, consent decree, or regulatory inquiry currently or previously affecting the business? Please describe.

II. INDIVIDUALS WHOSE DATA YOU PROCESS

11. Who are the individuals about whom you collect personal information (for example: customers, website visitors, app users, employees or job applicants, business contacts, patients, or students)?

12. Do you knowingly collect personal information from, or direct services to, children under thirteen or minors under sixteen or eighteen? Do you have an age-screening or age- verification process?

13. Do you offer products or services to, or otherwise process the personal information of, residents of the European Union, the European Economic Area, or the United Kingdom?

14. Do you process the personal information of California residents, or residents of other states with comprehensive privacy laws (roughly twenty states now have such laws in effect, including Colorado, Connecticut, Virginia, Utah, Texas, and Oregon)?

15. Do you process employee, applicant, or contractor personal information that will require a separate employee or workforce privacy notice, rather than (or in addition to) the consumer-facing policy?

III. CATEGORIES OF PERSONAL INFORMATION COLLECTED

16. Please identify every category of personal information you collect — for example: identifiers (name, email address, mailing address, IP address, device ID); commercial information (purchase or transaction history); financial information (payment card or bank account data); precise geolocation; internet or network activity (browsing or search history); audio, visual, or biometric data; professional or employment information; education information; and inferences or profiles drawn from other data.

17. Do you collect any legally “sensitive” personal information, such as Social Security number, driver’s license or other government ID number, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic or biometric data used for identification, health information, sexual orientation or sex life, financial account log-in credentials, or the content of mail, email, or text messages?

18. Do you collect information about, or targeted at, minors that would trigger heightened obligations under children’s privacy laws?

IV. SOURCES AND METHODS OF COLLECTION

19. From what sources do you collect personal information — directly from the individual, automatically through cookies or other tracking technologies, from third parties (partners, data brokers, social media platforms), or from publicly available sources?

20. Do you use cookies, web beacons, tracking pixels, software development kits, or similar technologies on your sites or apps? Are they used for analytics, advertising, or both?

21. Do you use third-party analytics or advertising platforms (for example, Google Analytics, Meta Pixel, or ad networks)? Please list the ones you are aware of.

V. PURPOSES AND LEGAL BASES FOR USE

22. For what purposes do you use personal information — for example, providing the product or service, marketing, analytics, fraud prevention, personalization, research, or training artificial intelligence or machine learning models?

23. If the General Data Protection Regulation or UK GDPR applies to your processing, what is the legal basis for each purpose (consent, contract necessity, legitimate interests, legal obligation, vital interests, or public task)?

24. Do you use personal information to train, fine-tune, or otherwise improve artificial intelligence or machine learning models? If so, please describe, including whether individuals can opt out.

25. Do you engage in automated decision-making or profiling that produces a legal or similarly significant effect on an individual — for example, decisions about credit, employment, housing, insurance, or healthcare eligibility? California’s automated- decision-making-technology regulations and GDPR Article 22 impose specific pre-use notice, opt-out, access, and risk-assessment obligations on this kind of processing, so please describe any such use in detail.

VI. SHARING AND DISCLOSURE

26. Do you disclose personal information to third parties? If so, to whom, and for what purpose — service providers or processors, business partners, affiliates, advertisers, or government or law enforcement requests?

27. Do you “sell” personal information as broadly defined under state privacy law (any exchange for monetary or other valuable consideration), or “share” it for cross-context behavioral advertising?

28. Please list, or describe by category, all vendors, processors, or subprocessors who receive personal information — for example, cloud hosting, payment processing, customer relationship management, email marketing, analytics, or advertising providers.

29. Do you have data processing agreements in place with the vendors who receive personal information from you?

VII. INTERNATIONAL DATA TRANSFERS

30. Where is personal information stored and processed — please list all countries or regions, including the regions used by your cloud hosting providers?

31. If personal information is transferred out of the European Economic Area, the United Kingdom, or other regulated regions, what transfer mechanism is used — Standard Contractual Clauses, an adequacy decision, Data Privacy Framework certification, or another mechanism?

VIII. RETENTION AND SECURITY

32. How long do you retain each category of personal information, and what determines that retention period — business need, contractual requirement, or legal obligation?

33. What administrative, technical, and physical safeguards do you maintain to protect personal information — for example, encryption, access controls, employee training, or a written incident response plan?

34. Do you conduct periodic risk assessments or cybersecurity audits of your data processing activities? Amended CCPA regulations now require these for qualifying businesses on a phased schedule.

35. Do you have a data breach incident response plan and defined notification procedures, including internal points of contact?

IX. INDIVIDUAL RIGHTS AND REQUESTS

36. Please describe your current process, if any, for receiving and responding to requests from consumers or data subjects to access, delete, correct, or port their personal information.

37. Do you have a mechanism for consumers to opt out of the sale or sharing of their personal information, or of targeted advertising? Do you currently honor Global Privacy Control or similar opt-out preference signals?

38. Do you offer an opt-out or consent mechanism specifically for the processing of sensitive personal information?

39. Do you have a designated privacy officer, data protection officer, or other point of contact for privacy inquiries? If so, please provide the name, title, and contact details you would like to appear in the policy.

X. MARKETING COMMUNICATIONS

40. Do you send marketing emails or text messages to consumers? What consent, opt-in, or opt-out mechanisms are currently in place?

XI. SECTOR-SPECIFIC CONSIDERATIONS

41. Is your business subject to any sector-specific privacy law, such as HIPAA (health information), the Gramm-Leach-Bliley Act (financial institutions), FERPA (education), or a similar regime? If so, please describe your role — for example, covered entity, business associate, or financial institution — and any existing compliance measures.

XII. POLICY ADMINISTRATION

42. How should the privacy policy be made available to individuals — website footer link, in-app disclosure, or both?

43. Who within your organization should review and approve the final policy before it is published?

44. Should the policy include a version history or “last updated” date, and what process do you want for notifying users of material changes?

45. Is there a specific effective date you would like for the policy?