I am have recently created a website, where users can supply their email to receive mock programming briefs, once a day, for 32 days.

I would like to know what I need to include within a privacy policy in order to comply with the current DPA and the future GDPA regulations (I am situated in the UK).

Here's some more information on the service:

  • I store the users email address and a record indicating which brief they are scheduled to next receive.

  • The server holding this information, and sending the emails, is hosted by Heroku. I have selected to use European servers to host the project, but I do not know if there is the potential for American servers to be used instead.

  • The information is stored volatile, meaning that in the event of a server shut down all currently stored records are lost.

  • At the end of the 32 days, the email address is removed from the database. However, I have also made a mechanism for removing a users address available, which would immediately remove a supplied address from the list.

  • At no point do I make any gain (financial or otherwise) from the service, nor advertise or send any other email to the user other than those 32 briefs.

Finally, similar websites, such as ThirtyLogos.com, do not seem to contain any such privacy policy, but do allow the user to unsubscribe from the mailing list.

Any advice would be much appreciated. The service is not currently live, but I would like to make it publicly available, once I have determined whether I need a privacy policy and if so what to include within it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.