Digital agencies use personal data in forms, analytics, CRM tools, advertising, call tracking, and support. Record what each tool collects, why it is needed, where the data is stored, who can access it, and how long it is kept. A privacy notice should describe those actual practices.
SEO and performance campaigns may use cookies, tracking pixels, attribution tools, analytics, and third-party processors. Keep each use tied to a clear purpose and explain it to users.
Map the data the agency handles
List contact details, analytics identifiers, session and device data, campaign attribution, call-tracking logs, CRM exports, and access to client systems. For each item, note the tool, purpose, owner, storage location, and who can access it.
Compare the inventory with active tools, shared files, inboxes, and vendor accounts. Remove tools or access that no longer have a defined purpose.
Review cookies and tracking tools
For analytics, remarketing, heatmaps, and experiments, record what data is collected, why it is needed, who can access it, and how long it is retained. Remove tools without a current business reason, and explain the tools that remain.
A tool being common in the market does not explain why an agency uses it. Keep the stated purpose accurate when tools change.
Collect only what the work needs
- Collect only information needed for a stated service or communication purpose.
- Limit access to people who need the data for their work.
- Remove raw exports when the work no longer requires them.
- Review forms and lead flows to remove unnecessary fields.
Using fewer fields and shorter-lived exports reduces the information the agency needs to store and protect.
Set clear notices, retention, and access controls
Tell users what information is collected and why. Set retention periods for inquiries, campaign exports, and temporary files. Limit access, and protect credentials, exports, and backups.
Review notices, retention rules, and access when site tools or data flows change.
Privacy checklist for agency-operated sites
- List active third-party tracking and data-processing tools.
- Remove form fields that are not essential.
- Define who can access lead data, analytics, and CRM exports.
- Set retention rules for inquiry data, campaign exports, and temporary files.
- Update privacy and cookie notices when tools or data flows change.
Keep the data inventory with the team's operating notes and review it when the site, tools, or work change.