Privacy Policy for Subscription Plans

Businesses that offer a subscription plan benefit from recurring passive income while also providing a service that can help cultivate customer loyalty. However, companies that offer subscription plans typically need to collect personal information from customers, which makes having a Privacy Policy essential.

This article explains what a Privacy Policy is, why you need one, and how to write and display a Privacy Policy for subscription plans.

What is a Privacy Policy?

A Privacy Policy is a legal document that describes how you treat consumers' personal information and how users can exercise their privacy rights. It explains important points such as what personal information you collect, how and why you collect it, how it is used, and what rights your users have.

The table of contents for Spotify's Privacy Policy includes clauses about customers' personal data rights and how it collects and uses personal data:

What is Personal Information?

Personal information is any data that can be used on its own or in combination with other data to identify an individual.

Personal information can include:

• Names
• Email addresses
• Shipping information
• Financial information (such as credit or debit card numbers or bank account information)
• Health data
• Driver's license and Social Security numbers

Why Do You Need a Privacy Policy?

Many state and global privacy laws such as the European Union's General Data Privacy Regulation (GDPR) and the California Consumer Privacy Act (CCPA) require businesses that collect or process (use) personal information to maintain a Privacy Policy on their apps and websites.

Besides helping you comply with applicable privacy laws, a Privacy Policy can:

• Help you develop a more transparent relationship with your audience
• Provide information to users about how they can exercise their rights
• Give you a competitive advantage over industry peers who don't prioritize privacy rights

How Do You Write a Privacy Policy for Subscription Plans?

Businesses that use a subscription business model offer services to customers in exchange for payments made on a regularly scheduled basis.

Customers often provide personal information when they sign up for or use a subscription plan, including their contact info, shipping details, and financial information.

A Privacy Policy for subscription plans should contain clauses about why you collect and process customers' personal data, how you keep it secure, and how customers can exercise their privacy rights, among others.

It's important to write a Privacy Policy that is relevant to your unique business, and that reflects the laws that apply to you and your customers.

Many data protection laws require your Privacy Policy for a subscription plan to contain the following clauses:

• The types of personal information you collect and process
• Your reasons for collecting and processing personal information
• The categories of third parties you disclose personal data to
• What kinds of personal information you share with third parties
• How you keep the personal information you process safe
• How long you keep personal data and what you do with it when you're done with it
• How consumers can exercise their rights
• Your contact information

Let's take a look at each of these clauses and some examples of how to write them for a subscription plan.

What Personal Data is Collected or Processed

This clause should explain what kinds of personal data you collect or process when customers sign up for or use your subscription plan, such as their shipping and financial data.

Netflix's Privacy Statement lists the types of personal information it may collect from subscribers, including contact info, passwords, mailing addresses, birthdays, payment information, and information about how subscribers interact with the service and its ads:

Why Personal Data is Processed

This clause is where you explain your reasons for collecting and processing customers' personal data for your subscription plan, such as to take payments or provide customized services.

Netflix's Privacy Statement explains that it uses the personal information it collects from subscribers to provide and improve services and for advertising and communication purposes:

Georgetown Law's Office of Journal Administration's Subscription Privacy Policy explains that it uses customers' personal information to administer their subscription accounts and for communication purposes:

Third Parties Personal Data is Shared With

This clause lists any third parties you share subscribers' personal data with, such as service providers or payment processors.

ZS' Privacy Policy explains that it may rent, sell, or share personal data with its group of companies and includes a link to the sub processors and affiliates it shares consumers' personal information with. It also lists the circumstances in which it may share personal information with other types of third parties:

When users click on the ZS group of companies link they are taken to ZS' Subprocessors and Affiliates page, which links the third parties it shares personal data with, the reasons why it shares personal data, and the location of the sub processors and affiliates:

The Types of Personal Information Shared With Third Parties

Your Privacy Policy should let subscribers know which categories of their personal information you share with third parties, such as banking information provided to payment processors.

Spotify's Privacy Policy contains a table that explains the types of third parties it may share personal data with, the categories of data it may share, and its reasons for disclosing subscribers' personal information. The types of personal information it may share with third parties include user data, street addresses, payment data, research information, and usage data:

How Personal Information is Protected

This clause explains the steps you take to keep subscribers' personal data safe, including implementing administrative, technological, and physical safety measures.

Georgetown Law's Office of Journal Administration's Subscription Privacy Policy explains that it uses encryption and secure transmission methods, only allows authorized personnel to access consumers' personal information, and destroys credit card information after payment confirmation:

How Long Personal Data is Retained

You should only keep personal data for as long as you need to fulfill your purposes. This clause lets subscribers know how long you retain their data and what you do with it once you are finished with it.

Spotify's Privacy Policy explains that it only keeps subscribers' personal data for as long as necessary to provide its services and to fulfill its business purposes, including maintaining service performance, making business decisions, and for legal compliance and dispute resolution purposes. It lets subscribers know that they have the right to request to have their data deleted and that some types of data automatically expire after a certain amount of time:

How Subscribers Can Exercise Their Rights

Consumers' privacy rights vary based on the privacy laws that apply to their location but often include the right to access, edit, or delete their data, and the right to opt out of certain data processing activities. This clause explains the rights customers have when using your subscription plan and how they can exercise those rights.

Spotify's Privacy Policy lists consumers' rights - including the right to know what personal data it processes, and the right to access, correct, or delete their personal data - and explains how customers can exercise those rights:

Contact Information

You should let subscribers know how they can contact you with privacy-related questions or concerns.

Spotify's Privacy Policy includes an email address and a mailing address where subscribers can reach out with inquiries about the Policy:

Where Do You Display a Privacy Policy for Subscription Plans?

Many privacy laws require businesses to maintain links to their Privacy Policies in a conspicuous location on their websites and apps. You should put a link to your Privacy Policy anywhere you collect consumers' personal information.

Common places to put links to Privacy Policies include:

• Within a website footer
• On an account creation or account log-in page
• On the checkout page for an ecommerce site
• Within a newsletter or email subscription sign-up area
• Within an in-app menu

Here's an example of a Privacy Policy link in a website's footer:

And here's an example of how you can include a link to a Privacy Policy on a subscription checkout and account creation page:

How Do You Get Subscribers to Agree to Your Privacy Policy for Subscription Plans?

Get users to agree to your Privacy Policy by having them check an "I Agree" type of checkbox at the time when they sign up for a subscription. This is a best practice method that is highly effective and very easy to implement.

Getting users to agree to your Privacy Policy ensures that they are consenting to have their personal information collected and used in the way your Policy sets out. This is an important step towards compliantly using personal information to operate your subscription service and other aspects of your business.

Here's an example:

Summary

A Privacy Policy is a legal document that outlines consumers' privacy rights and explains how you treat their personal data.

Many state and global privacy laws require businesses that collect or process consumers' personal information to maintain a clearly written and regularly updated Privacy Policy on their websites and apps.

Businesses often collect or process consumers' personal information when they sign up for or use a subscription plan.

Your Privacy Policy for a subscription plan should include the following clauses:

• What personal information you collect or process
• Why you collect or process personal information
• A list of third parties with whom you share personal data
• The categories of personal information you share with third parties
• How you keep the personal information you collect or process secure
• How long you retain personal data
• How subscribers can exercise their rights
• How subscribers can contact you

Once your Privacy Policy is written, it's important to display it where users can easily find it. Many laws require applicable businesses to maintain a link to their Privacy Policies wherever they collect or process personal information.

Common places to put a link to a Privacy Policy include:

• Website footer
• In-app menu
• Checkout page
• Account creation/sign-in page
• Email subscription area

Get users to give their consent to your privacy practices by having them check an "I Agree" type of box at the time they sign up for a subscription plan.