A privacy center, not a privacy platform
A privacy center is the page a visitor or reviewer goes to when they ask about their personal data. Notice Labs gathers your DPA, subprocessor list, privacy policy and request form there, with a named privacy contact. It sits on your trust center, at your own domain.
From £39 a month. No sales call.
A privacy policy on its own isn't a privacy center
Most companies publish a privacy policy and stop there. A visitor who wants to exercise a right under GDPR or a state privacy law has to find an email address buried in the policy, or guess at support@ and hope it reaches someone who knows what a data subject request is.
A customer's procurement or legal team asks the same questions in a security review: where do you list subprocessors, where's the DPA, who is the privacy contact. Answering by email attachment each time is slower than pointing at a page.
Put your privacy center together
- 01
Set your privacy contact
Choose the address that receives privacy requests, separate from your security and document-request contacts.
- 02
Publish your privacy policy and DPA
Add them as documents on your trust center, as a file or a link, each with an effective date.
- 03
List your subprocessors
Add each vendor with its purpose and location. The subprocessor library fills in the name, website and logo.
- 04
Turn on the privacy request form
Visitors choose access, deletion, correction, export or another request, and your privacy contact gets it by email.
A request form beside your privacy documents
A visitor who wants to exercise a right finds the form on the same page as your policy and DPA. Each submission is recorded and sent to your privacy contact by email.
Requests as a list, not a scattered inbox
Each request sits in the admin with its type and the requester's message, so nothing gets missed while it's handled outside Notice Labs.
Subprocessors in one place
The Subprocessors tab lists each vendor with what it's used for, next to the request form and your policies.
What's in your privacy center
Three pieces of a trust center, brought together for a visitor asking about their data rather than your security posture.
- Privacy request intakeThe form that turns access, deletion, correction and export requests into records your privacy contact can act on.
- Subprocessor listEvery vendor that processes personal data on your behalf, with its purpose and location.
- Your DPA, publishedHost your data processing agreement as a document, so a customer can read it without emailing to ask. Or draft a template from your trust center's details with Create, for your lawyer to review.
What it doesn't do
Notice Labs isn't a consent-management platform: it doesn't run a cookie banner, record consent choices, or manage preferences across your marketing site. It isn't a data-mapping tool either; it doesn't scan your systems to find where personal data lives or generate a record of processing activities.
It gives you a public place to publish what a visitor or a reviewer looks for, and a form that turns a request into a record. What the law requires you to do with that request, and by when, is still yours to work out; check your own obligations under the frameworks that apply to you.
Questions
Straight answers to what people ask before they set this up.
What's the difference between a privacy center and a trust center?
On Notice Labs they're one page. A trust center covers security, compliance and documents as well as privacy. The privacy center is the part a visitor asking about their personal data needs: the request form, subprocessors, your privacy policy and DPA, and a named contact.
What request types can visitors submit?
Access, deletion, correction, export (portability) or another request they describe in the details field. Each one is recorded and sent to your privacy contact.
Does Notice Labs handle the request for us?
No. The form records the request and emails your privacy contact; your team decides how to respond and does the work outside Notice Labs.
Can we publish our DPA on the same page?
Yes. Add it as a document, public or available on request, next to your privacy policy and subprocessor list.
Can visitors link straight to the privacy request form?
Yes. The form opens from a link of its own, such as trust.yourcompany.com/#privacy-request, so you can put it in your privacy policy, your cookie notice or an email footer.
Will people hear about changes to our subprocessors or policies?
If they choose Notify me and confirm their email, they're sent a daily update when you change a document, a subprocessor, a security control or a compliance status. You choose which kinds of change are included.
Related reading
Give visitors a privacy center, not a buried email address.
From £39 a month. No sales call.