Module 7 · 7.1

English ▾

Nederlands English

The GDPR: privacy statement and forms

Module 7: Privacy and rules · Reading time: 11 minutes

Learning objective: After this lesson you can name the personal data your AI Builder site processes and on which legal basis, have a statement drafted with the Create privacy statement button and complete it with a critical eye, limit your contact form to what is needed, and explain which parties are involved: your host, email services and the AI model used during building.

Key concepts: personal data, processing, controller, processor, legal basis, duty to inform, privacy statement, data minimisation, retention period, data processing agreement

This lesson explains the rules as they apply on 10 November 2026. It is not legal advice. If you are unsure about your situation, ask a lawyer or your trade association.

Which personal data your site processes

Personal data is any information about an identifiable person: a name, an email address, but also an IP address. Anything you do with it is called processing. Go through the parts of your own site:

Contact form: name, email address, message and every field you added. The builder also stores messages on the server, with the sender's IP address and browser, to prevent abuse.
Newsletter: an email address that goes onto your list at a service such as Mailchimp, Laposta, Brevo or MailerLite.
Integrations such as Google Analytics, Google Ads or the Meta-pixel: these collect data about the visit, usually with cookies (lesson 7.2).
Widgets and videos from another party: that party sees at least your visitor's IP address.
Spam protection with Cloudflare Turnstile or hCaptcha: the visitor loads a script from that service.

Schildersbedrijf Example has a form, a Google Maps map and Google Analytics: three processing activities with three parties.

The GDPR in brief

The GDPR (General Data Protection Regulation) applies throughout the EU. As the owner of the site, you are the controller: you decide why and how data is processed, even if someone else does it technically. Three rules matter most for your site.

One legal basis per purpose (Article 6). There are six legal bases. For a website you usually use three: consent (the newsletter, tracking code that follows visitors), performance of a contract or the steps leading up to it (someone requests a quote) and legitimate interest (answering a general question, stopping spam). Choose one legal basis per purpose and write it down.
No more than necessary (Article 5): only ask for the data you need for the purpose (data minimisation) and do not keep it longer than necessary (retention period).
Tell people (Article 13, the duty to inform). You say who you are and how to reach you, what you use data for and on which legal basis, who you share it with, whether it leaves the EU, how long you keep it, which rights the visitor has and that they can complain to the supervisory authority. On a website you do this with a privacy statement.

In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises this; every EU country has its own supervisory authority.

The Create privacy statement button

As soon as your site has a form, newsletter, integration or service from another party, the builder tells you that you need a privacy statement. You see this message under Settings > Cookies and consent and also in the Go live window. That is where you find the Create privacy statement button.

Settings, Cookies and consent, with the banner and the button for the privacy statement — In Cookies and consent you set up the banner and create your privacy statement.

The button works without AI and costs no edits. The builder creates a new Privacy statement page from what is already on your site:

Who we are: name, address, company registration number, email address and phone number if available. Address and email come from your business details for Google (lesson 6.3) or your contact page; it finds a company registration number if it is on your site, for example "KVK 12345678" in the footer.
Contact form: which fields your form asks for, including your own fields, and what you use them for; plus the spam protection if you chose it.
Newsletter: that you use the address to send the newsletter, through which service, and how to unsubscribe.
How long we keep your data: messages and sign-ups stay on the website builder's server for at most 12 months; IP address and browser are deleted after 30 days.
Cookies and services of other parties: every service running on your site at that moment, with its type (for example Statistics or Functional) and its cookies.
Your rights, complaining to the Dutch Data Protection Authority, and contact.

What the builder does not know, it does not make up. In that spot you will see bold text between square brackets, such as [Fill in your company registration number here] or [Fill in your address here]. The builder tells you how many spots there are; you change them by double-clicking the text. The page immediately becomes your privacy page: the cookie banner links to it with More about privacy, the footer gets a link under Information and a reference appears below your form. If there is no room in the footer, the builder tells you and you ask for it in the chat.

What you still check and add yourself

The statement is a good start; you remain responsible. Check:

Square brackets: search for [ and fill everything in. Do not count on Go live stopping you; with an open spot the statement is not compliant.
Legal bases: the text gives the purpose for each processing activity, but not the legal basis. Add a sentence, for example: "We answer your question on the basis of our legitimate interest; if you request a quote, on the basis of the steps towards a contract."
Recipients and transfers: name your host and, if you use one, your email service. If you use American services such as Google Analytics or the Meta-pixel, say that data may leave the EU.
Your own mailbox: the 12 months apply to the builder's server. Also choose a period for the messages in your mailbox, for example "we delete quote requests that did not lead to a job after one year".
Added later: the statement is a snapshot. If you later add a widget or integration to your site, it appears in the cookie banner automatically, but not in the text of your privacy statement. Then update the text yourself, or set Privacy page to No privacy page yet, create a new one with the button and delete the old page in the Pages panel.

Forms: only ask what you need

By default the form asks for name, email address and message; you add fields in the chat. For each field, ask yourself: do I need this to answer the question? For a quote, Schildersbedrijf Example wants to know where the job is and whether it is indoor or outdoor work. A home address, date of birth or mandatory phone number is more than necessary.

Uploading files is not possible in the form; give your email address for people who want to send photos of the job.

Two settings under Settings > Forms relate to privacy:

Send the visitor a copy: the visitor gets their own message back by email. That is also processing: mention it in your statement if you switch it on.
Newsletter: the sign-up tick box is in the form and starts empty; only people who tick it end up on the list. Always use double opt-in (the visitor confirms by email), so nobody can put someone else's address on your list. With Mailchimp and Brevo the builder arranges this itself; with Laposta you switch it on for the list and with MailerLite in your account.

On the free address the form sends nothing, but put the statement on your site before it goes live on your own domain.

Who else processes data?

A processor processes personal data on your behalf. With a processor you conclude a data processing agreement (Article 28 GDPR).

WebOké as your host stores your site, your form messages and your email. The data processing agreement is an annex to the general terms and conditions (knowledge base 219). Site and email are on servers in the Netherlands.
An email service for your form (Postmark, Brevo, Mailgun, SendGrid) or a newsletter service: you arrange the agreement yourself, with that service.
Google or Meta partly decide for themselves what they do with data when you advertise; read what they state and name them in your statement.

And the AI model? The texts on your site are written by an AI model from OpenAI (American). What you give the builder goes there: your description, your instructions, files you attach and, with Redesign an existing site, the texts of your current site and at most 12 photos. Messages from visitors through your form do not go there. So do not put other people's data in your instructions that does not belong on the site: a customer list, a quote with name and address or a password does not belong in the chat or in Memory.

In the builder: how to do it

Open Settings (at the bottom of the rail), Cookies and consent, and click Create privacy statement.
Open the new page and fill in every spot between square brackets.
Add legal bases, recipients and the period for your mailbox.
Check that the link is in the footer.
Click Go live or Publish changes.

Summary

Even a simple site processes personal data: form, newsletter, tracking code, widgets and spam protection.
The GDPR requires a legal basis per purpose, no more data than necessary, and a privacy statement with the information from Article 13.
Create privacy statement fills in what is already on your site and puts square brackets where something is missing; you complete it (square brackets, legal bases, recipients, your mailbox) and keep it up to date.
Only ask for what you need in your form; newsletter only with an empty tick box and double opt-in.
WebOké is your processor with a data processing agreement; the AI model only gets what you give the builder.

Quiz

1. Under the GDPR, what is your role for the data that comes in through your AI Builder site? Processor
Controller
Data subject
Supervisory authority

You decide why and how data is processed. The host is your processor.

2. Your privacy statement still contains "[Fill in your company registration number here]". What do you do? Leave it, visitors will understand
Delete the whole page
Wait for the builder to fill it in itself
Double-click the text and enter your own number

The builder does not make up details. You fill in whatever is between square brackets.

3. Three months after creating the statement, you add a Calendly widget to your site. What happens to your privacy statement? Nothing: the text does not update itself, so you update it
The widget is added to it automatically
The statement is deleted
The widget only works once the statement is updated

The cookie banner follows the services automatically; the text of the statement is a snapshot.

4. Schildersbedrijf Example wants a date of birth as a mandatory field in the quote form. Which GDPR principle stands in the way? The duty to inform
The right of access
Data minimisation
The data breach notification duty

Data minimisation means you ask no more than needed for the purpose. A date of birth is not needed for a quote for painting work.

5. What goes to the OpenAI AI model when you work with the AI Builder? Every form message from your visitors
What you give the builder: description, instructions, attached files and, when redesigning, the texts and at most 12 photos of your current site
Only your password
Nothing, the AI runs in your browser

Form messages from visitors do not go to the model; what you put into the builder does.

Exercise

Exercise A7.1: Your privacy statement. Use Create privacy statement to create the statement for your site, fill in all spots between square brackets, add the legal bases and your recipients and put your site online again. Then enter the web address of your AI Builder site (your free address on weboke.site or your own domain). The program visits your site like a visitor would: it opens the homepage and the pages in your menu and checks whether every page has a link to a privacy statement, whether that page can be reached, whether there is still text between square brackets and whether your contact details (name and email address or postal address) are in it. You see green, orange or red for each item.

Exercise A7.1: Your privacy statement

Your site's address (for example www.example.nl or yoursite-123.weboke.site)

What you enter and what we find isn't stored. Your browser remembers your answers and whether you've passed the exercise. If you're signed in, we only save that you got the exercise (almost) right in My courses; you can delete that there too.

Cookies at WebOké

Cookie settings

Necessary

Marketing