Privacy Notice Types — Profiles & Guidance

Privacy Notice Types — Profiles & Guidance

Table of Contents

1. Type Selection
2. Website / App
3. Applicant / Recruiting
4. Employee
5. Business Partner (B2B)
6. B2C Customer
7. Combined Notices

Type Selection

Ask the user as the very first question after jurisdiction:

"What type of privacy notice do you need?"

If the user needs multiple types → see Combined Notices.

Each type profile below defines:

• Section map: Which of the 13 standard sections to include, skip, or adapt
• Likely data categories: Pre-populated suggestions to accelerate intake
• Likely legal bases: Default assumptions to confirm with user
• Type-specific intake questions: Additional questions beyond standard Groups A–F
• Type-specific legal considerations: Jurisdiction-dependent rules
• Retention defaults: Common retention periods for this type

Website / App

Section Map

Sub-Types & Data Profiles

Brochure / Corporate Site (minimal data):

• Identity: name, email (contact form only)
• Technical: IP, browser/OS, access logs
• Cookies: analytics, possibly social embeds
• Legal bases: Legitimate interest (analytics, security), consent (marketing cookies)

E-Commerce:

• All brochure data PLUS: account data, shipping address, payment (via provider), order history, returns, wishlist
• Legal bases: Contract (orders, account), legal obligation (invoices), consent (newsletter, marketing), legitimate interest (fraud prevention)

SaaS / Web App:

• All brochure data PLUS: account, usage/feature logs, API usage, collaboration data, uploaded content, settings
• Legal bases: Contract (service provision), legitimate interest (product improvement, security)

Mobile App:

• All web app data PLUS: device ID, push tokens, device permissions (camera, location, microphone, contacts), app usage metrics, crash logs
• Must disclose each permission and its purpose

Marketplace / Platform:

• Dual data subjects (buyers + sellers), ratings/reviews, messaging, payment escrow, seller verification documents
• Consider separate sub-sections for each user role

Type-Specific Intake Questions

1. What forms exist on the site? (contact, registration, checkout, newsletter)
2. Is there user account creation? What data is required vs. optional?
3. What analytics tools are used? (GA4, Matomo, Plausible, Mixpanel)
4. Any third-party embeds? (YouTube, Google Maps, social buttons, chat widgets)
5. Any A/B testing or personalization tools?
6. Does the site use a CDN? (Cloudflare, Fastly — may involve data transfer)
7. Is there a blog with comments?
8. Any user-generated content?

Retention Defaults

Sample Clause Patterns

Analytics consent row (purposes table):

| Web analytics | Understanding how visitors use our website to improve user experience | Art. 6(1)(a) GDPR — your consent via our cookie banner | Anonymized: unlimited; pseudonymized: [13 months / 26 months] |

Third-party embed disclosure:

Our website embeds content from third-party services ([YouTube / Google Maps / social media plugins]). When you access pages containing such content, a connection is established to the provider's servers, which may set cookies and collect your IP address. Legal basis: Art. 6(1)(a) GDPR — your consent. You can manage your preferences via our consent tool at any time.

Soft opt-in clause (existing customers):

If you have previously purchased [goods/services] from us, we may send you information about similar [goods/services] by email. This is based on [§ 7(3) UWG (DE) / Art. L.34-5 CPCE (FR) / Regulation 22 PECR (UK)]. You can unsubscribe at any time using the link in each email or by contacting us.

Newsletter consent:

| Newsletter & marketing emails | Sending you information about [products/services/offers] | Art. 6(1)(a) GDPR — your consent | Until you withdraw your consent |

Contact form:

| Responding to your inquiry | Processing and responding to your contact form submission | Art. 6(1)(f) GDPR — our legitimate interest in responding to inquiries / Art. 6(1)(b) GDPR if related to a contract | 6 months after resolution of your inquiry |

Applicant / Recruiting

Section Map

Likely Data Categories

• Identity: full name, date of birth, nationality, photo (if submitted), gender
• Contact: address, email, phone
• Professional: CV/resume, cover letter, work history, education, certifications, references
• Assessment: interview notes, assessment results, test scores
• Sensitive (Art. 9): disability status (for accommodation / Schwerbehinderung), health (pre-employment medical), sometimes religion (church tax in DE)
• Technical: IP/logs if online application portal
• AI-derived: matching scores, automated screening results (if applicable)

Likely Legal Bases

Type-Specific Intake Questions

1. Is there an applicant tracking system (ATS)? Which one? (Personio, Workday, Greenhouse, SAP SF, BambooHR)
2. Do you use AI for CV screening or candidate matching?
3. Do you keep applications in a talent pool for future positions? For how long? With consent?
4. Are background checks or reference checks conducted?
5. Is there a works council (Betriebsrat) involved in the hiring process?
6. Do you collect disability status (Schwerbehinderung)?
7. Are external recruiters or headhunters involved (joint/separate controllership)?
8. Is the career page on the main website or a separate platform?
9. Do you process applicant data within a group of companies?

Retention Defaults

Type-Specific Legal Considerations

• Germany: § 26 BDSG is the primary legal basis, NOT Art. 6(1)(b). Art. 88 DSGVO + § 26 BDSG is the specific regime. Works council agreements (Betriebsvereinbarung) may serve as legal basis.
• France: CNIL "Guide recrutement" (2023) applies. Photo on CV: cannot be required. Criminal record check: limited to specific roles.
• AI screening: Art. 22 DSGVO applies if solely automated decisions with significant effect on the applicant. Must disclose logic, significance, consequences. Human review requirement.

Sample Clause Patterns

Talent pool consent:

With your separate consent, we store your application documents in our talent pool to consider you for future suitable positions. Legal basis: Art. 6(1)(a) GDPR — your consent [DE: § 26 Abs. 2 BDSG]. Your data will be retained for [12/24] months. You may withdraw your consent at any time by contacting [contact].

Rejection retention:

If your application is unsuccessful, we retain your application data for [6 months (DE) / up to 2 years (FR)] after notification of the rejection. This serves to protect our legitimate interests in the event of potential legal proceedings (e.g., under the AGG / Code du travail). Legal basis: Art. 6(1)(f) GDPR [DE: § 26 Abs. 1 BDSG]. After this period, your data will be deleted unless you have consented to inclusion in our talent pool.

AI screening disclosure:

We use [system name] to support our candidate selection process. This system [analyses CVs for keyword matching / ranks candidates based on qualifications]. The results are used as one factor among others and are always reviewed by our recruitment team before any decision is made. Legal basis: Art. 6(1)(b) GDPR [DE: § 26 Abs. 1 BDSG]. You have the right to obtain human intervention, express your point of view, and contest the decision.

External recruiter / Art. 14 source:

If your data was provided to us by a recruitment agency or headhunter, the source of your data is [agency name / category: "external recruitment agencies"]. We received the following categories of data: [name, contact details, CV, professional qualifications]. We will inform you of this processing at the latest at the time of first contact.

Employee

Section Map

Additional Sections (Employee-Specific)

• IT Monitoring / BYOD: Internet usage, email monitoring, device management policies
• Video Surveillance: § 4 BDSG, works council co-determination
• GPS / Vehicle Tracking: If company vehicles are tracked
• Whistleblowing: HinSchG (DE) / Loi Sapin II (FR) data processing
• Works Council Access: What data is shared with the Betriebsrat

Likely Data Categories

• Master data: name, address, date of birth, tax ID, social insurance number, bank details
• Contract: employment contract, position, salary, working hours, start/end dates
• Payroll: salary, bonuses, tax class, deductions, benefits
• Time & attendance: working hours, overtime, vacation, sick leave
• Performance: reviews, goals, training, certifications
• Health: sick certificates (AU-Bescheinigungen), occupational health, BEM records
• IT: login data, email (if monitored), internet usage logs, access badges
• Sensitive: disability (SB status), religion (church tax), trade union membership (if payroll-relevant)

Retention Defaults (DE)

Type-Specific Intake Questions

1. What HR/payroll system is used? (Personio, SAP HCM, DATEV, Workday)
2. Is there IT monitoring? (Email, internet, screen monitoring)
3. Is there video surveillance on premises?
4. Are company vehicles tracked (GPS)?
5. BYOD policy? Mobile device management?
6. Works council in place? Relevant Betriebsvereinbarungen?
7. Is the company part of a group? Intra-group data sharing?
8. Whistleblowing channel in place?
9. Occupational health management (BEM)?
10. Any AI in HR processes? (People analytics, performance scoring)

Sample Clause Patterns

IT monitoring disclosure:

We monitor the use of company IT systems (email, internet, applications) to ensure IT security, prevent data breaches, and comply with legal obligations. Monitoring is limited to metadata (sender/recipient, timestamps, data volumes) and does not include content surveillance. Legal basis: Art. 6(1)(f) GDPR [DE: § 26 Abs. 1 BDSG]. [If works council agreement exists: Processing is also based on the works council agreement dated [date] pursuant to § 26 Abs. 4 BDSG.]

Church tax clause (DE):

| Church tax processing | Calculating and remitting church tax as legally required | Art. 6(1)(c) GDPR + Art. 9(2)(b) GDPR, § 26 Abs. 3 BDSG, § 51a EStG | Duration of employment + 6 years (§ 257 HGB) |

Sick leave handling:

We process sick leave certificates (AU-Bescheinigungen / arrêts maladie) for the purpose of continued pay entitlement and absence management. We only receive information about the duration of incapacity, not the diagnosis. Legal basis: Art. 6(1)(c) GDPR + Art. 9(2)(b) GDPR [DE: § 26 Abs. 3 BDSG + § 5 EFZG]. Retention: [1 year after end of calendar year (DE) / duration + 5 years (FR)].

BYOD clause:

If you use personal devices for work purposes (BYOD), we process device identifiers and usage data through our mobile device management (MDM) solution [name] to protect company data and ensure IT security. We do not access personal content on your device. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in IT security [DE: § 26 Abs. 1 BDSG].

Business Partner (B2B)

Section Map

Key Distinction: Art. 13 vs. Art. 14

Business partner notices often involve Art. 14 (data not collected directly from the data subject):

• Contact persons at a business partner may not have provided their data directly
• Their details may come from the company itself, public registers, LinkedIn, trade fairs
• Art. 14 requires disclosing the source of data and categories of data
• Must be provided within 1 month of obtaining the data, or at first communication

Likely Data Categories

• Business contact: name, position/title, business email, business phone, company name
• Contract: signatory details, authorized representatives
• Financial: company bank details, credit information (for B2B credit checks)
• Communication: business correspondence, meeting notes
• Source: How the contact was obtained (direct, website, trade fair, public register, referral)

Likely Legal Bases

Type-Specific Intake Questions

1. How do you obtain business contact data? (Direct, trade fairs, LinkedIn, purchased lists, referrals)
2. Is there a B2B portal or customer login?
3. Do you conduct credit checks on business partners?
4. What CRM/ERP is used? (Salesforce, HubSpot, SAP, Microsoft Dynamics)
5. Do you share data within a corporate group?
6. Any compliance/KYC requirements? (Anti-money laundering, sanctions screening)
7. Are business contacts used for marketing? How (email, phone, events)?

Retention Defaults

Sample Clause Patterns

Art. 14 source disclosure:

We may obtain your business contact data from the following sources: your employer or the company you represent, publicly accessible business registers (e.g., Handelsregister, Registre du Commerce), professional networks (e.g., LinkedIn), trade fairs and industry events, or business referrals. Categories of data obtained: name, professional title, business email, business phone, company name.

B2B prospecting legitimate interest:

| Business development / B2B prospecting | Contacting potential business partners about our [products/services] relevant to their professional activity | Art. 6(1)(f) GDPR — our legitimate interest in developing business relationships | 3 years from last interaction |

CRM management:

We store your business contact data in our CRM system ([Salesforce / HubSpot / Microsoft Dynamics]) to manage our business relationship, coordinate communications, and ensure quality of service. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in efficient relationship management.

Credit check clause (B2B):

Before entering into a business relationship, we may obtain creditworthiness information about your company from [Creditreform / SCHUFA / Coface / Euler Hermes]. This includes scoring data and credit ratings. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in assessing credit risk [DE: § 31 BDSG]. You have the right to object to this processing.

B2C Customer

Section Map

Context: Online vs. Offline B2C

This type covers customer relationships that may be purely offline (retail store), purely online (e-commerce — overlaps with Website type), or hybrid. For pure e-commerce, combine this profile with the Website/App profile.

Likely Data Categories

• Identity: name, email, phone, address, date of birth (age verification, birthday offers)
• Account: credentials, preferences, wishlist, saved addresses
• Purchase: order history, product preferences, returns, warranty claims
• Payment: payment method (via processor), billing address, installment data
• Marketing: newsletter consent, campaign interactions, promotion usage
• Loyalty: points, tier status, program participation
• Communication: support tickets, reviews, complaints, chat history
• Profiling: purchase patterns, segment assignment, churn prediction, lifetime value

Likely Legal Bases

Type-Specific Intake Questions

1. Is this for online, offline (retail), or omnichannel?
2. What payment methods / processors? (Stripe, PayPal, Klarna, Adyen)
3. Is there a loyalty program? What data is collected for it?
4. Do you do customer profiling or segmentation? How?
5. Email marketing: opt-in or soft opt-in for existing customers?
6. Do you use retargeting (Meta Pixel, Google Ads remarketing)?
7. Product reviews: own system or third-party (Trustpilot, Verified Reviews)?
8. Do you send postal marketing?
9. Customer support channels? (Email, phone, chat, WhatsApp)
10. Any credit check / BNPL (Buy Now Pay Later) integration?

Retention Defaults

Sample Clause Patterns

Loyalty program:

If you join our [loyalty program name], we process your purchase history, points balance, tier status, and preferences to administer the program and provide personalized offers. Legal basis: Art. 6(1)(b) GDPR — performance of the loyalty program terms. We may also analyse your purchase patterns to tailor offers to your interests; legal basis: Art. 6(1)(f) GDPR — our legitimate interest in personalized customer communication. You can leave the program at any time by contacting [contact].

BNPL / credit check (B2C):

If you choose to pay by installment ([Klarna / PayPal Pay Later / other BNPL provider]), your data (name, address, date of birth, order details) is transmitted to [provider], which conducts a creditworthiness assessment. [Provider] acts as an independent controller for the credit check. Legal basis for data transmission: Art. 6(1)(b) GDPR — contract performance. For details on [provider]'s processing, see their privacy notice at [URL].

Profiling disclosure:

We analyse your purchase history and browsing behaviour to create a customer profile used for personalised product recommendations and marketing. This profiling does not produce legal or similarly significant effects. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in relevant customer communication. You have the right to object to this profiling at any time (see Section [X] — Your Rights).

Soft opt-in for existing customers:

As an existing customer, we may send you marketing emails about products or services similar to those you have previously purchased. This is based on [§ 7(3) UWG (DE) / Art. L.34-5 CPCE (FR)]. You can opt out at any time by clicking the unsubscribe link in any email or by contacting us at [contact].

Product review clause:

If you submit a product review, we publish your [display name / first name] and review text on our website. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing product information to other customers [or Art. 6(1)(a) if consent-based]. Reviews are retained for the duration of the product listing + 3 years. You can request deletion of your review at any time.

Combined Notices

If a user needs a notice covering multiple types (e.g., a company website that also has an applicant portal and B2B partner section):

Option A: Single Comprehensive Notice (Recommended for Small/Medium)

• Merge all relevant section maps
• Use sub-headings within sections to separate audiences
• Example: Section 3 has sub-sections "3.1 Website visitors", "3.2 Applicants", "3.3 Business partners"
• Risk: document becomes long and hard to navigate

Option B: Separate Notices (Recommended for Large/Complex)

• One notice per audience / data subject category
• Linked from a central privacy hub page
• Easier to maintain and update
• Better for complex organizations with different processing activities per audience
• German best practice: separate "Datenschutzhinweise für Bewerber" is very common

Option C: Layered Approach

• One short general notice (1–2 pages) covering common elements (controller, rights, security, contact)
• Separate detailed annexes per type
• Good for organizations with many data subject categories

Recommendation: Ask the user which approach they prefer. For most SMEs, Option A with clear sub-headings works. For larger organizations or those with sensitive processing (e.g., employee + applicant), Option B is safer and more maintainable.