01Start with what you collect
Personal data is anything that tells who a person is: a name, an email address, a phone number, an IP address. Your site collects it in more places than you might think.
Before you write a policy or turn on a banner, make a list. Go through your site page by page and write down what each part collects:
Forms: a contact form, a quote request, a newsletter sign-up.
Bookings and orders: a name, contact details, the time and what was bought.
Analytics: tools that count visits, such as Google Analytics (GA4) or PostHog.
Ad tracking: tools that measure ads, such as Meta Pixel.
Embedded content: maps, and videos from YouTube or Vimeo.
Next to each line, write why you need it and how long you keep it. A hair salon needs a phone number to call about a change of time. It does not need a birth date. Data you never collect is data you never have to protect.
This guide is general advice for the usual small business website in the EU. It is not legal advice. If you handle health data, data about children or anything else out of the ordinary, ask a lawyer who knows data protection.
02What the cookie rules ask
A cookie is a small file a site saves in the visitor's browser. Other ways of storing data in the browser count the same. The rules sort them by what they are for, not by how they work.
| Kind | Example | Consent first? |
|---|---|---|
| Necessary | Keeps a booking or a login working, remembers the visitor's cookie choice | No |
| Analytics | Counts visits and shows which pages people read | Yes |
| Marketing | Measures ads and shows ads to past visitors | Yes |
Ask before the cookie is set, not after.
Saying no must be as easy as saying yes: a no button next to the yes button.
No boxes ticked in advance. Scrolling on is not a yes.
Say in plain words what each kind is for.
Taking consent back must be as easy as giving it.
03Turn on the Husly cookie banner
The banner is off on a new site. Turn it on before you add analytics or ad tracking.
In the admin, open Settings -> Privacy.
Under Cookie consent (GDPR), turn on Show the cookie banner.
Choose where the banner sits on the page.
Under Privacy policy link, pick your privacy policy page. On a site with several languages, the link leads to that page in the visitor's language.
Turn on only the kinds your site really uses: Analytics, Marketing, Preferences.
Save. Then open your site in a private browser window and check that the banner shows.
With the banner on, a visitor can accept all cookies or keep only the necessary ones. Husly waits for the answer:
Google Analytics (GA4) and PostHog load only after a yes to Analytics.
Meta Pixel loads only after a yes to Marketing.
Husly's own A/B tests set their cookie only after a yes to Analytics.
You add these trackers in Tools -> Integrations. If the banner is off when you turn a tracker on, Husly turns the banner on as well.
Google Tag Manager loads at once. Husly starts it with consent set to denied (Google's Consent Mode), so every tag inside it must respect that setting. Check your tags in Tag Manager.
Embedded maps and YouTube or Vimeo videos load without asking, and those services see the visitor's IP address. Name them in your privacy policy, or leave out the ones you do not need.
Once a visitor has chosen, the site has no button that opens the banner again. Write in your privacy policy how a visitor can reach you to take consent back.
04Write a privacy policy people can read
A privacy policy tells visitors what you do with their data. Write it for your customers, not for lawyers: short sentences, your own business, your own tools. It usually covers these points:
Who you are and how to reach you about data.
What you collect and why, for example a phone number to confirm a booking.
The legal basis for each use: consent, a contract, a legal duty or a legitimate interest.
How long you keep each kind of data.
Who else handles it: your email service, your payment provider, your analytics, your website platform.
Which cookies and embedded services the site uses.
The person's rights: to see, correct and delete their data, to object, and to complain to the data protection authority (in Estonia, the Data Protection Inspectorate).
Husly does not write your privacy policy, because only you know what your business does with data. Husly gives it a place: make a page and use the document blocks made for long legal texts, with numbered sections and a list of contents. Then pick that page under Privacy policy link in the banner settings, and link to it from your footer or menu too.
For the shape of such a page, look at Husly's own privacy policy. Do not copy its text: Husly's business and data are not yours.
05Ask for consent in your forms
Not every form needs a tick box. If someone asks for a quote, you may use their details to answer them. The box matters when you want to do more, such as sending them news later.
Ask only for what the form needs. A bike rental needs a name, a phone number and the dates. It does not need a home address for a one-day rental.
In Husly, a consent tick box can work in two ways:
A required tick box stops the form from being sent until the visitor ticks it. Use it only for what the form cannot work without, for example agreeing to your booking terms.
An optional tick box can decide what goes further. When a form sends its answers to another service, such as a newsletter tool, pick that box under Consent box on the form's Integrations tab. Then only the answers with the box ticked are sent.
A yes to a newsletter must be freely given. If the form cannot be sent without ticking the news box, that yes is not free. Keep the news box optional, with its own words.
06Know who else handles the data
Every service that stores or handles personal data for you is a processor: your website platform, your email service, your payment provider, your analytics. The law asks you to have a data processing agreement with each one. Most services offer one on their website.
Keep a simple list: the service, the data it gets and where its agreement is. It takes half an hour and answers most questions before anyone asks them.
- Data processing agreement
- Husly tells you about a data breach within 48 hours. Estonian law applies.
- Where sites are kept
- Sites and their database are in Estonia.
Some parts of the service work worldwide, for example the network that delivers your pages quickly and the storage for files. The sub-processors page names each service Husly uses.
If personal data leaks, the law usually gives you 72 hours to tell the data protection authority. Write down now who in your business does that, so nobody has to work it out on the day.
07A checklist before you go live
You have a list of what the site collects and why.
The cookie banner is on, with only the kinds you use.
Your privacy policy page is published and picked as the banner's link.
Every form asks only for what it needs.
The newsletter tick box is optional and set as the form's consent box.
You know which maps and videos the site embeds, and your policy names them.
You have a list of your processors and their agreements.
Go through the list again when you add a new tool to the site. A new form or tracker is where things slip. How forms work in Husly is in the help center: Forms.