Precious Abacan, Marketing Director, Softlist

Always make sure to have an opt-out clause. This lets people withdraw their information from your company’s hands when they no longer want you using it. 

For example, someone might sign up for your emails or use your app. But maybe later, they change their mind and think, “I don’t want them to keep my information.” That’s where the opt-out part comes in. They can just stop the emails or tell the app, “Don’t use my data.” This opt-out feature is really about allowing people to retract their “yes”—it’s also called “consent withdrawal.” It’s all for keeping the user’s information safe and under their control, letting them decide what to share. 

And it’s not just a nice thing to do; it’s often a legal requirement. Take the CAN-SPAM Act in the U.S., from 2003. It stipulates that if you’re sending commercial emails, you must provide a way for people to say, “No more emails, please.”

Nina Pączka, Community Manager, Resume Now

The organization’s privacy policy cannot go without the data retention procedures that outline how long and what information about employees, clients, or partners the company will retain. This includes personal information such as names, email addresses, employees’ resumes, or clients’ IP addresses, and any other data that may be collected through cookies or other tracking technologies.

The data retention policy should specify how long user data will be kept and the reasons for retaining it, which can vary depending on the type of data and the purpose for collecting it. Remember that data protection regulations like the GDPR and CCPA often mandate that organizations disclose their data retention practices. You cannot disclose it if you don’t have one. Besides, data retention procedures help mitigate the risk of misuse or mishandling of the information gathered.

Additionally, drafting such a policy is crucial as it addresses the aspects of trust and transparency. Information on why and how long information will be stored contributes to a sense of control and understanding, whether it involves an employee, customer, or business partner.

Peter Bryla, Community Manager, ResumeLab

In any organization’s privacy policy, it’s vital to include a detailed explanation of the use and purpose of tracking technologies like cookies. This shows the company’s dedication to transparency and empowers users by giving them control over their data.

Understanding how their online activities are monitored and how their data is utilized on the website enables users to make well-informed decisions about whether to use the services.

Furthermore, obtaining user consent is a legal necessity. By clearly outlining the use of tracking tools, organizations can effortlessly comply with these legal requirements and secure explicit permission from the audience.

It’s also important to disclose if third parties can deploy cookies via the platform. This information helps users comprehend how this could potentially impact their privacy.

Lastly, including tracking technologies in a privacy policy is essential as it fosters transparency, empowers users, and ensures legal compliance.

Brian Devening, Founder, Snubbies

One of the most critical elements in an organization’s privacy policy is being transparent about how user data is collected, stored, and used. It’s something I noticed during my involvement in the growth of the pet insurance industry. 

Unbeknownst to many pet owners, certain information collected for pet insurance purposes could be used for market segmentation and targeted advertising. Thus, ensuring this is clearly stated in a privacy policy not only respects the user’s right to control their personal data but also builds trust between the organization and the user.

Moreover, I’ve seen in my experiences with Swiftype, a company that provides site search functionality, how having clear and transparent data handling practices in their privacy policy greatly enhanced user trust. Users felt more comfortable using the search engine knowing that their queries were not used irresponsibly.

I strongly believe more organizations need to understand that in the long run, respecting user privacy isn’t just a legal obligation but a trust-building exercise that can significantly contribute to customer loyalty.

Jon Morgan, CEO, Venture Smarter

In my book, one of the key ingredients for an organization’s privacy policy is a robust section on data-security measures. We’re living in an age where data breaches are, unfortunately, becoming more common, and users are rightfully concerned about the safety of their information.

So, when we lay out the details of how we’re safeguarding their data—whether it’s through encryption, access controls, or regular security audits—it’s not just a legal checkbox. It’s a promise we make to our users that their information is treated like Fort Knox. This level of transparency and commitment to data security not only meets regulatory expectations but also goes a long way in establishing trust. And let’s face it, trust is the currency of the digital age.