In this blogpost we ask if website owners must inform about all 3rd parties on their websites in their Privacy Policy.
We will explain how Trackerdetect automatically detects and builds information about 3rd parties that are on your website to help you meet the information and transparency requirements in GDPR Article 13.
In the following it is assumed that
- you have 3rd parties on your site, and
- the personal data of your website visitors are disclosed to the 3rd parties on your site.
Privacy Policy
If you are a website owner, you can ask yourself
“Must I have a Privacy Policy on my website that informs my website visitors about why and how etc I process their personal data?”
The answer is yes.
This is the rule in GDPR Article 13.1.
Privacy Policy: information about all 3rd parties
If you also ask yourself
“Must I in my website Privacy Policy include information about 3rd parties on my website?”
The answer is yes.
Site owners must include in the Privacy Policy the recipients or categories of recipients of website visitors’ personal data.
This is the rule in GDPR Article 13.1(e).
Privacy Policy: naming actual recipients
If you additionally ask yourself
“Must I in my website Privacy Policy include the names of the actual 3rd parties on my website?”
The answer is yes.
Site owners must include in the Privacy Policy the name of the recipient of website visitors’ personal data.
The term “recipient” (GDPR Article 4.9) includes
- data controllers
- joint controllers
- processors to whom data is transferred or disclosed
- third party recipients
This is the rule in GDPR Article 13.1(e).
The WP29, says that “in accordance with the principle of fairness, the default position is that a data controller should provide information on the actual (named) recipients of the personal data.”
How can Trackerdetect help?
With Trackerdetect you can automatically detect all 3rd parties on your site
- at a given time by manual clicks
- at given intervals, e.g. each 6th hour
- from a given location
- and store the information about the 3rd parties in a record with Signatu
- and include such information in your Privacy Policy by a one-click
- including information about their
- legal entity
- contact details
- categorization of each 3rd party
- description of each 3rd party's service
- links to website privacy policy, service policy and cookie policy with date it went into effect or date of last version (if any)
- links to opt-out method(s) (if any)
Privacy Policy: naming categories of recipients
If you also ask yourself
“Can I in my website Privacy Policy include only the name of the categories of the actual 3rd parties on my website?”
The answer is yes.
Instead of naming the actual recipients, site owners can include in the Privacy Policy only the name of the categories of recipients of website visitors’ personal data.
This is the rule in GDPR Article 13.1(e).
WP29 says that where one opts only to provide the categories of recipients, the information on the categories of recipients should be as specific as possible by indicating the type of recipient, i.e. by reference to
- the activities it carries out
- the industry
- sector
- sub-sector
- the location of the recipients
How can Trackerdetect help?
With Trackerdetect
- you can find out what the detected 3rd parties typically do
- the detected 3rd parties are grouped together under categories made by signatu, such as website analytics, marketing etc.
Privacy Policy: use purposes
If you also ask yourself
“Must I in my website Privacy Policy include information about the purpose for which I use 3rd parties on my website?”
The answer is yes.
Site owners must include in the Privacy Policy “the purposes of the processing”.
This includes the purpose for which you use 3rd parties on your website, e.g. website analytics.
This is the rule in GDPR Article 13.1(c).
How can Trackerdetect help?
With Trackerdetect you can find out why you typically use a detected 3rd party.
Privacy Policy: transfers outside the EU
If you ask yourself,
“Must I in my website Privacy Policy include information about the transfer of my website visitors’ personal data to a country outside the EU where the 3rd parties on my website are?”
The answer is yes.
Site owners must include in the processing record “transfers of personal data to a third country or an international organisation”, including
- the identification of that third country or international organisation
- the existence or absence of an adequacy decision by the Commission, or safeguards etc.
This is the rule in GDPR Article 13.1(f).
How can Trackerdetect help?
With Trackerdetect you can find out the URL of the 3rd party and determine the physical location of the IP address of the URL domain name. From the transmission of website visitors' data (between the URL of the website and the URL of the 3rd party) it may be inferred that website visitors' data are transferred or not transferred between countries as well as from the EU to a third country.
We could go on and comment about other requirements to inform website visitors in your Privacy Policy (GDPR Article 13), however the main point in the above is to describe how Trackerdetect can assist you in making a Privacy Policy with information about 3rd parties on your site, as required by GDPR Article 13.
Other blogposts on Trackerdetect
In other blogposts about Trackerdetect on
- Oh heck, do I have a lot of 3rd parties on my website?
- Keep a record of all 3rd parties on websites?
- Inform about all 3rd parties on websites in Privacy Policy?
- Inform about 3rd parties on websites in Access Request response?
- Notify 3rd parties on websites of site visitors' request to exercise rights?
- Classify 3rd parties on websites as Controllers, Processors etc?
- Assess risk of having 3rd parties on websites?
- Internal policies for having 3rd parties on websites?
- Is having unauthorised 3rd parties on a website a personal data breach?
- Must I have a tool to identify and record 3rd parties on my website?
we have explained reasons why you should become aware of 3rd parties on your site and how Trackerdetect automatically detects and builds a record of 3rd parties that are on your website to
- help you meet the record keeping requirements in GDPR Article 30.1.
- help you meet the information and transparency requirements in GDPR Article 13.
- help you respond to your website visitor's Access Request in GDPR Article 15.
- equip you with their contact details so you can communicate to those 3rd parties that your website visitor requests to exercise his/her right.
- enable you to classify 3rd parties to determine whether or not you are required to enter into an agreement with the detected 3rd parties, as required in GDPR (data processing agreement (GDPR Article 28), joint controller agreement (GDPR Article 26), controller to controller agreement).
- help you identify all 3rd parties on your website so that you can assess whether your website-3rd parties' processing operations pose risks to the rights and freedoms of your website visitors and whether a DPIA is necessary, in accordance with GDPR.
- help you understand how 3rd parties appear on your website so that you can adopt internal data protection policies for having 3rd parties on your website, as required by GDPR Article 24.
- help you to identify whether unauthorised disclosure of your website visitors’ personal data have occurred and whether you need to notify the personal data breach to the supervisory authority and your website visitors.
- help you to be able to demonstrate that you have the technological measures to detect and record 3rd parties on websites, as required by the GDPR Articles 24.1, 30.1(d) and Recital 87.
Reach out to us
If you have an interest in Trackerdetect and/or Signatu Privacy Policy Generator, please send us an email to hello@signatu.com.