1. Controller and contact details
The final notice must identify the legal controller, its contact details and any applicable representative or data protection officer.
Controller legal name, postal address and privacy contact require approval.
2. The information involved
The product context includes account information, owner supplied financial records, relevant documents and service activity. The exact categories and any external sources must follow the approved processing register.
Confirm the deployed processing inventory and collection notices.
3. Purposes and legal bases
Account administration, security, requested analytics and support need their own stated purposes and lawful bases. Acknowledging this notice is not blanket consent to every processing operation.
Insert the approved purpose and lawful basis mapping.
4. Recipients and international transfers
The published notice must describe relevant recipients, processors and any international transfer arrangements that apply to the actual service.
Verify hosting, email, payment and data service providers and applicable transfer safeguards.
5. Retention and account closure
Retention periods or criteria must come from the approved lifecycle policies. This design does not invent a fixed document retention period or promise immediate deletion of every record.
Insert approved retention criteria, legal hold treatment and deletion exceptions.
6. Your choices and rights
Explain applicable access, correction, erasure, restriction, objection and portability rights, withdrawal of consent where relevant, and the route to raise a complaint.
Approve the request channel, applicable supervisory authority information and identity checks.
7. Cookies and optional communications
Optional communications and technologies must have their own applicable choice mechanisms. The full notice should link to the Cookie Policy and explain how preferences can be changed.
Verify the live cookie inventory and any optional marketing flows.
8. Changes to this notice
Describe material updates using the approved effective date and notice process. Do not treat every update as a request for new consent.
Insert approved version, effective date and change summary.