The problem with most privacy policy tools
Search for “privacy policy generator” and you’ll find dozens of tools. Most of them work the same way: you answer a long questionnaire, check some boxes, and get a generic document that vaguely describes your situation. The result reads like a legal template because that is exactly what it is.
These generators don’t know what actually happens on your website. They don’t know which cookies your site places, which third-party scripts are loaded, or what data your forms collect. You’re left guessing, and a privacy policy based on guesses is a liability, not a protection.
GDPRWise takes a fundamentally different approach. It starts by scanning your website to detect what you actually process, and then generates a privacy policy that matches reality.
How GDPRWise creates your privacy policy
The process follows the same three-layer model that powers your entire GDPRWise dossier.
Scan-based detection
When you enter your URL, GDPRWise’s AI-powered scanner examines your website. It detects:
- Cookies and local storage - every cookie placed on visitors’ browsers, categorised by type and purpose
- Third-party scripts - Google Analytics, Meta Pixel, HubSpot, Hotjar, and any other external services loading on your pages
- Forms and data collection - contact forms, newsletter sign-ups, booking forms, checkout pages
- Trackers and pixels - invisible tracking mechanisms that monitor visitor behaviour
Each finding becomes a concrete entry in your privacy policy. If Google Analytics is active, your policy states that you use Google Analytics, explains what data it collects, and references the correct legal basis. Not vague boilerplate - specific facts about your website.
Sector-specific context
Your industry determines many of the processing activities that happen outside your website. A physiotherapy practice processes health data. An e-commerce shop processes payment and shipping data. A recruitment agency processes candidate CVs.
GDPRWise pre-fills these sector-specific elements so your privacy policy covers your full range of processing activities, not just what happens online.
Your answers fill the gaps
Some details only you can provide. Do you share data with specific partners? How long do you retain customer records? Do you transfer data outside the EU? GDPRWise asks targeted questions and integrates your answers directly into the policy text.
Items marked “Detected” are backed by scan evidence. Items marked “Needs review” require your confirmation. You always know which parts of your policy are verified and which need a closer look.
Not just for customers: the staff privacy policy
Here is where GDPRWise differs from every other privacy policy tool on the market. Most generators only create a customer-facing website privacy policy. But the GDPR also requires you to inform your employees about how you process their personal data.
As an employer, you handle sensitive information: payroll details, personnel files, sick leave records, performance evaluations, and potentially CCTV footage or GPS tracking data. Your employees are data subjects, and they have the same right to transparency as your customers.
GDPRWise generates a dedicated staff privacy policy alongside your customer-facing one. Through the guided refinement process, you answer questions about your HR practices, and the platform produces a professional employee privacy policy that covers:
- Identification and payroll data
- HR administration and personnel files
- Sick leave and absence registration
- Access control and badge systems
- CCTV and camera surveillance
- GPS tracking of company vehicles
- IT monitoring and email policies
This staff privacy policy is ready to use as an appendix to your employment contracts. It is a document most SMEs don’t have but are legally required to provide.
The hosted privacy policy
Once your privacy policy is generated, you have two options for publishing it.
Export and self-host. Download the policy as a formatted document and place it on your own website. You have full control over the look and feel.
Use the hosted URL. GDPRWise provides a hosted version of your privacy policy at a permanent URL. You link to this URL from your website footer, contact forms, social media profiles, and email signatures. When your policy is updated, the hosted version reflects the changes automatically.
The hosted option is particularly useful for businesses that list their privacy policy in multiple places: website, Facebook page, Instagram profile, Google Business listing, newsletter footer. Instead of updating the text in five locations, you update it once in GDPRWise and the hosted URL serves the current version everywhere.
Always up to date, not just at launch
A privacy policy is not a “set it and forget it” document. When you add a new marketing tool, switch email providers, or install a chat widget, your policy needs to reflect those changes. Most businesses forget, and their privacy policy quietly becomes inaccurate.
With GDPRWise’s continuous monitoring (available through the Peace of Mind subscription), your website is rescanned periodically. When the scan detects a new third-party script, an additional cookie, or a changed form, you are notified. The platform shows you exactly what changed and suggests updates to your privacy policy.
You review the changes, approve them, and your policy is current again. The hosted version updates immediately. No manual comparison of old and new scan results, no digging through your website to figure out what changed.
What makes a good privacy policy?
Beyond the legal requirements, a good privacy policy is one that people can actually understand. GDPRWise generates policies in clear, readable language, not dense legal paragraphs.
Your policy includes:
- Who you are - your identity as the data controller, with contact details
- What data you collect - broken down by category, with specific examples
- Why you collect it - the purpose for each type of processing
- The legal basis - consent, contract, legitimate interest, or legal obligation, explained in plain terms
- Who receives the data - named third parties and processors
- How long you keep it - retention periods per data category
- Your visitors’ rights - access, rectification, erasure, portability, and how to exercise them
- Cookie information - aligned with your cookie report and consent settings
- How to file a complaint - with the supervisory authority
All of this is structured in a way that both humans and regulators can follow.
The bottom line
A privacy policy should describe what you actually do with personal data. Not what a template assumes you do. GDPRWise scans your website, detects your processing activities, and generates a policy that matches your real situation. It creates both a customer-facing and a staff privacy policy. And it keeps both current through continuous monitoring.
That is the difference between a compliance checkbox and a document you can stand behind.
Scan your website and let GDPRWise create a privacy policy based on what you actually process. Customer-facing and staff policy included, with a hosted URL that stays current.