Privacy Policy

It is crucial that your site has a privacy policy. People want to be reassured that you will not sell or distribute any of their details and that you will not keep their payment details (e.g. their credit card number on record.) Essentially, a privacy policy adds to customer confidence which in turn leads to more sales. You can write your own privacy policy, but it is a lengthy process and it is very easy to miss out important pieces. The best way to get a decent privacy policy is to use software to create a template. Then go over manually and make any modifications that are needed. Another important point is to have a P3P compact privacy policy. A P3P compact privacy policy is a machine-readable privacy policy describing your company's privacy practices, including the type of information collected, how the information is used, and who has access to the information. Without a P3P privacy policy programs that use cookies will not work in Internet Explorer. So in other words if you want your tracking software to work accurately you must have a P3P compact privacy policy.

Step 1. Making your compact policy

The P3P specification for declaring the types of data collected at a site can become complicated, requiring much time to develop and test and leaving webmasters susceptible to errors. It is much easier to use the P3P Policy Editor from IBM AlphaWorks than making your own. This takes the complexity out of creating a machine-readable policy by including standard data types and categories that can be quickly dropped into the policy and by providing error-checking to help locate required elements that are missing from the policy. Using this will ensure that your P3P is working correctly and takes all the hassle out of its production. The P3P Policy Editor from AlphaWorks is free of charge. Your privacy policy should always include a section pertaining to cookies. Cookies are pieces of information about visitors to a website. This is often their username and password, or customized preferences of a web page. This information is provided by the user during a previous visit to a web site. The server records this information in a text file and stores this file on the visitor's hard drive. When the visitor accesses the same web site again the server looks for the cookie and configures itself based on the information provided. The information is often stored without the users permission or knowledge. In the privacy policy you must endeavor to keep information obtained from cookies private. Save your policy as 'policy.p3p'. You need to upload this to your server in a folder called w3c, so that it's 'YOURDOMAIN.com/w3c/policy.p3p'.

Install Notes:- The latest copy of the P3P policy editor is as a .JAR executable rather than a standard .exe, it also has no install program. Download the P3PExecutableJar.zip from IBM and follow these instructions:-

Unzip the contents to 'C:\Program Files\P3P Editor'
Create a short cut on your desktop or start menu by right clicking and selecting 'Create Shortcut'
Set the shortcut target to 'java -jar p3p.jar'
Set the shortcut start in folder to 'C:\Program Files\P3P Editor'
Save the shortcut.
The shortcut should now be working. If you are getting an error saying java.exe is an unrecognized program then download Sun Java virtual machine.

Step 2. Making your human readable policy

Another save option is 'Save HTML as', use this to create the template for your human readable privacy policy. This should be linked from your home page or preferably all pages of your site. Edit the created file and change it so that it matches in with the rest of your site. Read through and make any corrections that are needed, adding any extras that spring to mind.

Step 3. Deploying your policy

Now you have your machine and human readable policies ready you need to deploy them so that browsers know where they can be found. IBM's policy editor has a menu option called 'Create reference file' select this to run the wizard. Enter the URL to your policy.p3p file, this should be 'http://www.YOURDOMAIN.com/w3c/policy.p3p#YOURPOLICYNAME'. Make sure you put the correct name for your policy after the # mark. Finish the wizard and save the p3p.xml file. Upload it to your server to the w3c folder so that it's URL is 'http://www.YOURDOMAIN.com/w3c/p3p.xml'. It must be uploaded to this location for the file to be found properly by browsers and spiders. Check your policy is working correctly by viewing your site in Internet Explorer and clicking 'View->Privacy Report', select your main URL and click summary. If you get a message saying could not find this sites privacy policy, you haven't uploaded the p3p.xml file to the right place, or it's not pointing to the policy.p3p, or the right #policyname. If you policy is displayed well done! Click the link that says 'To read this web sites full policy click here' to check that it opens your human reading html privacy policy. If it doesn't then you need to edit that URL in the policy.p3p file using the P3P editor.