Some Office Live customers have asked about creating a privacy statement, so that sounds like a good topic for this post. Even if your Web site is not for a business and you operate a nonprofit or some other kind of site, visitors may be more comfortable and more likely to communicate with you if you put them at ease about your use of their personal information. This can be as simple as promising not to sell their e-mail address to spammers if a site visitor sends you email. For businesses, having a privacy statement in place can be an important part of establishing business relationships.

You don’t have to be a privacy expert to create a privacy statement. There are a number of free and cost-based privacy statement generators online. We’ll get to those in a minute.

What is privacy? Here’s a definition: Privacy is giving a person control over the collection, use, and distribution of their personal data, and respecting their right to be left alone. Sounds revolutionary and ‘right on’ at the same time, empowering from the customer’s POV.

And what’s the difference between a privacy policy and a privacy statement? A policy is a document created to guide your company; it says, in essence, this is what we believe regarding our customers’ privacy. The privacy statement explains that policy then to your customers.

Preparation

Before you can create your statement, you have to determine your practices for collecting, storing, and using the personal information of your visitors and/or customers. If you have a business, how do you typically gather information about your customers, and what do you do with it after you get it? Privacy isn’t just about personal information that is collected online; it may be collected through public records, regular mail, phone calls, and meetings. Your privacy statement should cover that information also. For more information about how to become aware of your company’s current privacy practices, take the Better Business Bureau’s online assessment.

Make sure your current and future practices line up with the law and fair information practices

Does your site collect personal information from children? If so you should be aware of the Children's Online Privacy Protection Act (COPPA). For more information, see The Children's Online Privacy Protection Act Web page on the Federal Trade Commission (FTC) Web site. For detailed information about other privacy laws that may apply to your business, see A Review of Federal and State Privacy Laws on the Better Business Bureau Web site.

In addition to privacy law, government studies have also identified fair information practices that help protect consumers’ privacy interests. These practices include notice, choice, access, and security. For more information, see Fair Information Practice Principles on the Federal Trade Commission (FTC) Web site.

Use a privacy statement generator

Here are two privacy policy generators that are recommended by the Better Business Bureau on their Create your own privacy policy Web page.

• The Direct Marketing Association (DMA) Privacy Policy Generator
• Organization for Economic Co-operation and Development (OECD) Privacy Policy Generator

You can also find a number of other free and fee-based generators by searching the Internet. Read the explanatory text and then follow the instructions of the generator you plan to use. You may need to edit the policy the generator creates to exactly tailor it to your business, and to include how Microsoft Office Live treats your customers’ data (see the next section).

Also, note that free policy generators will probably not assume legal responsibility for the policy that is created; cost-based generators may not either.

How Microsoft Office Live treats your customers’ data

Because Microsoft Office Live is involved in transmitting and storing personal information about your site visitors and customers, it is a good idea to also include text in your privacy statement about the data Microsoft collects about your customers. Office Live policy is as follows:

Microsoft does not collect personal information about your customers. The data that Office Live does collect is aggregated, which means that Office Live cannot identify nor define the activities of any individual.

Office Live does track—and provide to you in Site Reports—the following by using cookies or machine information.

• Your Web site traffic information, which includes unique users and page views.
• The kinds and versions of the Web browsers that your visitors use.
• The entry, most-requested, and exit pages on your site that visitors use.
• The referring domains that visitors use in coming to your site.
• The search engines that visitors use to come to your site by direct clicks.

The primary purpose of Office Live in gathering this information is to provide you with site statistics. Office Live may use this information to develop a cumulative view of traffic coming to sites in the Office Live service, which we will use to help improve services we provide you.

Communicate policy

Your first responsibility after creating a privacy statement is to adhere to it. To do that, you must communicate privacy policy internally to everyone in your company, and not only to those who directly deal with personal information.

Your commitment to your new privacy statement isn’t complete until your site visitors become aware of it. Note that once your privacy policy is publicly posted, you are legally obligated to honor it.

For more information

For more information about privacy as it relates to business, see the Better Business Bureau’s Privacy Made Simple Web page.

- Lyn Watts, Product Manager