Writing your policies

Your site will have a few pages that are not about your work but about how you work. Only you know that, so you write them. I make them into proper web pages, check they read well and put them where people expect to find them.

This page is where I would start. I am not a lawyer, and nothing here is legal advice. The links go to the people who set the rules, and their help is free.

Every site has these

A privacy notice. What personal information you collect, why, how long you keep it, and what people can ask you to do with it. The ICO, the UK's data protection regulator, has a free tool that writes one with you, called create your own privacy notice (opens in a new tab). Its guide how to write a privacy notice and what goes in it (opens in a new tab) explains each part.

An accessibility statement. I write this one with you, because it is about how your site was built and tested. It says what works, anything that does not yet, and how to ask for something in another format. GOV.UK's sample accessibility statement (opens in a new tab) shows what a good one looks like, and the W3C has its own guide (opens in a new tab).

No cookie policy. A Rosette sets no tracking cookies, so there is no cookie pop-up and nothing to explain. To show you which pages people visit, I use Plausible (opens in a new tab), privacy friendly analytics that uses no cookies and collects nothing personal. If you ever want to add something that does, I will tell you first. The ICO's cookies and privacy notices in detail (opens in a new tab) says when a site needs to ask.

If you keep details about people

Notes on the children and families you work with, reports, emails, a list of people who came to your training. If you keep any of these, the law expects you to look after them.

Check where you stand. The ICO's assessment for small business owners and sole traders (opens in a new tab) asks you plain questions and tells you what to do next. It is the best place to start a data protection policy.

Write down what you hold. What you keep, why, where it is and for how long. The ICO has templates for this (opens in a new tab).

The data protection fee. Most businesses, sole traders too, that use personal information pay the ICO a small yearly fee. Its data protection fee pages (opens in a new tab) tell you whether you need to.

When someone asks for what you hold about them. They have a right to it. The ICO has a template for replying (opens in a new tab).

If you work with children or adults at risk

Safeguarding. NSPCC Learning explains how to write a safeguarding policy statement (opens in a new tab), what it should cover and who should see it.

Working with schools. Schools will expect you to know Keeping children safe in education (opens in a new tab), the government's statutory guidance.

Before a policy goes on your site

Read every line of a bought template. Templates often keep gaps like [provider name], or the name of the school or company they were written for. I flag any I spot while I move your words across, but you know what should be there.

Pages, not PDFs. Your policies go on your site as web pages, so everyone can read them, on any phone, and a screen reader can jump from heading to heading. You can still print them.

Keep them up to date. Put a review date on each one. You can change a policy yourself, the same way as any other page.

The standard your site is built to

Your accessibility statement says your site meets WCAG 2.2 at level AA. WCAG is the international standard for accessible websites. The W3C's introduction to WCAG (opens in a new tab) explains it, and its quick reference (opens in a new tab) lists every requirement. You do not need to read them. I check your site against them, and our rosettes lists the rest.