Privacy policy for websites in Azerbaijan: what to include

Step 1: inventory

List every place where personal data enters or leaves your site:

• contact and enquiry forms, calculators;
• registrations and customer accounts;
• orders, delivery details and payments;
• newsletters and messenger subscriptions;
• live chat and chatbots;
• analytics (for example GA4), advertising pixels and tags;
• embedded content — maps, videos, social media widgets;
• CRM, email, hosting, backups and other services that store the data.

For each, note what data, why, where it is stored, who can access it and for how long.

Step 2: what to include

Who you are

Legal name, registration details, address and contact for data protection questions.

What data you collect

Grouped by source: data people give you (name, phone, email, address, messages), data collected automatically (IP address, device information, cookies, usage data) and data from third parties, if any.

Why you use it

Each purpose separately: responding to enquiries, fulfilling orders, providing accounts, customer support, analytics, advertising, legal obligations, security.

Consent and legal basis

When you rely on consent, how it is given and how it can be withdrawn. When processing is required for a contract or by law, say so. See personal data law in Azerbaijan.

Cookies and similar technologies

Which cookies and tags are used — essential, analytics, advertising — what they do, and how visitors can control them. If you use a consent banner, describe it accurately.

Who receives the data

Categories of recipients: hosting provider, payment provider, delivery services, CRM and email services, analytics and advertising platforms, chat or AI providers, professional advisers. Name key providers where practical.

Transfers abroad

Which data is processed outside Azerbaijan — many cloud services are — and on what basis.

Retention

How long each category is kept, or the criteria for deciding.

Security

In general terms, how data is protected: encryption, access control, backups.

People's rights

How someone can ask what data you hold, correct it, withdraw consent or request deletion, and how quickly you respond.

Children

Whether the site is intended for children and how their data is handled, if relevant.

Changes

How updates are announced and the date of the current version.

Step 3: connect the policy to the site

• Link the policy in the footer of every page and next to every form.
• Use an unticked consent checkbox where consent is the basis, with the purpose stated.
• Separate marketing consent from the consent needed to answer an enquiry.
• Make sure the consent banner, if any, actually controls the tags — tags that fire before consent contradict the policy. See GA4 setup.

Languages

Publish the policy in Azerbaijani and in every language your site uses. Legal wording should be reviewed by a lawyer; the language versions should say the same thing.

Common mistakes

• Copying a policy from another website or country that mentions tools you do not use and omits those you do.
• Mentioning only EU law (GDPR) and not Azerbaijani law, or the reverse when you serve EU customers.
• Forgetting chat widgets, AI assistants and messenger integrations.
• No date, no contact, no way to exercise rights.