Privacy policy accessible, dated, plain language, covers all GDPR-required disclosures

GDPR Arts. 12, 13, and 14 require a privacy policy that is accessible, written in plain language, and covers specific mandatory disclosures — controller identity, legal bases, retention periods, data subject rights (including the right to lodge a complaint with a supervisory authority), and subprocessor names. A policy that requires authentication to access violates the accessibility requirement immediately: prospective users and regulators must be able to read it. An undated policy cannot demonstrate whether it was in effect before or after a particular data collection event. Vague language like 'we share with trusted partners' without naming anyone fails the specificity requirements of Art. 13(1)(e) independently of other gaps.

Ensure your privacy policy at /privacy is publicly accessible, footer-linked from every page, has a visible 'Last updated' date, and covers each required Art. 13/14 disclosure.

## Required sections for a GDPR-compliant privacy policy:

1. Controller identity and contact (company name, address, privacy@example.com)
2. What data we collect (enumerate: email, name, usage events, payment info, cookies)
3. Why we collect it and legal basis per type:
   - Account data: contract (Art. 6(1)(b))
   - Analytics: legitimate interest (Art. 6(1)(f)) with balancing test
   - Marketing: consent (Art. 6(1)(a))
4. Retention periods per data type
5. Named subprocessors, location, and transfer mechanism
6. International transfer mechanism (SCCs or adequacy decision)
7. Your rights: access, erasure, portability, rectification, restriction, objection,
   consent withdrawal, and right to lodge a complaint with the supervisory authority
8. Privacy contact and response time commitment
9. Last updated: [date]

Link the policy from every page footer. Use robots: { index: true } so search engines can surface it. Verify it is accessible without authentication by opening it in an incognito window. Update it within 30 days of any material change to data handling.