GDPR Privacy Policy Generator and Website Legal Notice

Create compliant legal notices and GDPR data protection privacy policies for your SaaS apps, websites, and online stores.

Legal notice and GDPR privacy policy: what the generator produces

The generator builds two texts from your form: a legal notice under the French law on confidence in the digital economy (LCEN: publisher, publication director, host, intellectual property) and a GDPR privacy policy (data collected, retention periods, recipients, rights). It is a starting template to review and complete, not legal advice.

What you enter

Site URL, company name, SIRET, publication director, email, registered address, share capital, register city, VAT number, phone, a host from four presets (Vercel, OVH, AWS, Infomaniak) and three processing activities to tick: newsletter, online payment, audience measurement. Each box adds or removes a line in the policy.

What the tool produces

  • Legal notice: publisher (name, trade register with the SIREN, i.e. the first 9 digits of the SIRET, address, VAT, email, phone), publication director, host (name, address, website). The French, Spanish and German versions also state the share capital and an intellectual property clause.
  • Privacy policy: data and purposes, retention of 3 years after last contact for prospects and statutory accounting periods for billing data, recipients, rights of access, rectification, erasure, portability, and contact address.

The text can be copied as plain text or simple HTML (one paragraph per block). The English version is shorter than the French one.

Limits to fix before publishing

  • The fields are prefilled with sample values (Paris, FR 12 912345678, +33 1 23 45 67 89, €10,000) to replace with your own; there is no wording for a sole trader (EI).
  • The host is identified by its website, whereas French law requires its phone number.
  • The policy states no legal basis per processing, no transfers outside the EU (Vercel and AWS are US companies) and no cookie management.

The template follows French law (LCEN, CNIL guidance); it is not adapted to other countries.

Sources and dates: French Act no. 2004-575 of 21 June 2004 (LCEN), art. 1-1 and 19, and the list of mandatory website notices on Entreprendre Service Public (checked 13/10/2026); GDPR, Regulation (EU) 2016/679; CNIL guidance on managing commercial activities (3 years for prospects) (checked 14/10/2026).

Frequently Asked Questions

Which legal notices are mandatory on a French company website?

Company name, legal form, share capital, registered address, email and phone, trade register (RCS) or RNE number, VAT number if any, the publication director's name, and the host's name, address and phone number (LCEN, art. 1-1). The generator covers these headings except the host's phone number, which you add by hand; the legal form only appears if it is part of the company name.

How long can prospect data be kept under CNIL guidance?

Three years from collection or from the prospect's last contact, according to the CNIL guidance on commercial activities. Accounting records such as invoices follow a separate statutory period of 10 years in France.

What does a French business risk without a legal notice on its site?

Up to €375,000 for a company and €75,000 for a sole trader, according to Entreprendre Service Public. Incomplete GDPR information is punishable by a €1,500 fine.

Is the generated privacy policy enough for GDPR compliance?

No, it is a starting point. You need to add the legal basis of each processing, any transfers outside the EU (for example with a US host), cookie management and your actual retention periods. For a specific case, have the text reviewed by a legal professional.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.