The deal stalls on a questionnaire, not on your product.
EU customers, especially mid-market and enterprise, ask the same things before they sign: who are your sub-processors, where is the data hosted, do you have a DPA, can you show your records. A small team that can answer in minutes looks like a safe vendor.
Generic templates miss SaaS
A general privacy policy doesn't cover product telemetry, uploaded customer files, hosting and email sub-processors, or AI features. These clauses do, one block per topic.
You wear two hats
For your own accounts and billing you are the controller. For your customers' content you are usually their processor. The pack keeps the two apart so each document says the right thing.
A finished baseline, fast
Stop staring at a blank ROPA. Start from pre-filled SaaS activities, edit what differs, and follow a four-week plan to put it all in place.
Seven parts. One coherent compliance baseline.
Each part stands on its own and also points to the next: the clauses name the sub-processors, the checklist helps you chase their DPAs, and the trust page publishes the result.
SaaS-specific privacy policy clauses Ready to copy
Drop-in wording with fill-in placeholders, one block per topic.
- Customer account data
- Usage analytics and product telemetry
- Sub-processors (hosting, email, payments, support tools)
- International transfers (EU → US tools under SCCs)
- Customer content and uploaded files
- AI features If you use AI
- Retention and deletion rules for inactive accounts
Simple ROPA starter for a typical SaaS
A pre-filled Record of Processing Activities. Edit, don't invent.
- User registration and account management
- Product usage analytics
- Customer support tickets
- Billing and invoicing
- Marketing emails If any
- Sub-processor management
- Suggested legal bases, data categories, retention periods and recipient lists for each
Sub-processor & DPA checklist
Know your vendors, and prove it.
- The most common SaaS sub-processors, listed
- Questions to ask each vendor
- Simple DPA checklist: what must be in place under Article 28
- Template email to request a DPA from a vendor
Customer-facing trust page template
A short page to publish on your own website.
- Where data is hosted
- Main sub-processors
- How customers can request deletion or export
- Contact for privacy questions
- Link to your privacy policy
EU customer onboarding checklist
What to have ready when a European customer says yes.
- What to include in the terms or order form
- How to handle Data Processing Agreements with customers
- Consent and legitimate interest notes for product analytics
- Quick answers to common security questionnaires
High-risk AI checklist If you use AI
Short and practical. Skip it if your product has no AI features.
- Whether the AI feature might fall under the EU AI Act
- Transparency wording for users
- Data minimisation for training or fine-tuning
- Human oversight options
30-day action plan for a SaaS team
A short, prioritised list so the work actually gets done. See the plan below.
- Week by week, in the order that matters to buyers
- Each week ends with something you can show a customer
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own company.
Transfers outside the EEA
Some of the providers we use are based in, or can access data from, the United States. When personal data leaves the European Economic Area, we only transfer it on a recognised legal basis: the provider is certified under the EU–US Data Privacy Framework, or we have signed the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with it, supported by a transfer assessment where needed.
You can ask for a copy of the safeguards for any provider listed on our sub-processor page by writing to [privacy@yourcompany.eu].
The full pack adds guidance on which option to name for each vendor.
User registration and account management
| Purpose | Create and secure accounts, authenticate users, deliver the service |
|---|---|
| Legal basis | Art. 6(1)(b), performance of a contract |
| Data subjects | Customer admins and end users |
| Categories | Name, work email, role, password hash, login timestamps |
| Recipients | Hosting provider, transactional email provider |
| Retention | Life of the account plus [30] days |
Each of the six activities also lists transfers and security measures.
These are shortened starting points. Your own policy and records must reflect what your product actually does, and the pack shows you where to check.
From a blank page to something you can show a customer.
Prioritised for a small team with no dedicated compliance person.
Publish and list
- Publish the updated privacy policy
- List your sub-processors
Record and request
- Create or update your ROPA
- Request missing DPAs from vendors
Process and prove
- Add a simple DSAR process
- Publish the trust page
Review the risky bits
- Review analytics set-up
- Review AI features
Who it's for, and who it isn't.
A good fit if you
- Run a B2B or B2C SaaS product with EU customers or users
- Have no in-house privacy counsel
- Keep getting security or privacy questionnaires from prospects
- Use common tools: cloud hosting, Stripe, a support desk, transactional email
Not enough on its own if you
- Process special-category data at scale (health, biometrics)
- Operate a clearly high-risk AI system, where specialist advice is needed
- Need a signed, lawyer-reviewed contract; the pack is not legal advice
- Are not subject to EU or EEA data protection law at all
Seven parts. One payment.
Everything on this page, delivered together. Adapt it to your product, publish it, and answer the next questionnaire from the same documents.
- SaaS privacy policy clauses
- ROPA starter with six pre-filled activities
- Sub-processor & Article 28 DPA checklist
- Trust page template
- EU customer onboarding checklist
- High-risk AI checklist
- 30-day action plan
Before you ask —
Who is the SaaS Compliance Pack for?
European SaaS startups and small teams that process customer data and need to look credible to EU customers: founders, first compliance hires, and CTOs who keep getting security and privacy questionnaires from prospects.
What do I receive?
Seven parts: SaaS-specific privacy policy clauses, a pre-filled ROPA starter, a sub-processor and DPA checklist, a trust page template, an EU customer onboarding checklist, a high-risk AI checklist and a 30-day action plan. You get your download page straight after checkout, with no account to create.
Is this legal advice?
No. The pack is a practical starting point written for small SaaS teams. The clauses and records are drafts you adapt to what your product really does. If your processing is complex or high-risk, have a qualified lawyer review the result.
Do I need the AI section if my product has no AI features?
No. The AI clause and the high-risk AI checklist are marked as optional. Skip them and the rest of the pack stands on its own.
Does it replace a DPA with my customers?
No. The onboarding checklist explains how to handle customer DPAs and what to include in your terms or order form, but the pack is not a substitute for your own signed agreements. Our separate GDPR DPA Template Pack covers the document itself.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Answer the next questionnaire in minutes.
Get the clauses, records and checklists in one pack and be ready for the customer who asks.
Get the Pack — €39