SISO LABSWhat a shop site touches#
A static shop site is simpler than most people expect. It is a set of pages that a browser loads from a server, with no account system and no checkout. The amount of personal data it handles is small, but it is not zero. When a visitor opens a page, their browser sends an address and some technical details to the server that hosts the site. The owner should know that these details exist, even when the site itself never asks for a name or an email address.
The age gate is the other feature to understand. A visitor who confirms they are 20 or over is making a statement about themselves. The gate does not need to store who that visitor is. Knowing what each feature collects, and what it does not, is the first step to describing it honestly to the people who visit. A clear list of features in the owner's own notes makes the later writing much easier.
How visits are counted#
Many owners want to know how many people looked at their site, and which pages they read. This is a reasonable thing to measure. On DISPO sites, visits are counted with Cloudflare Web Analytics. That tool sets no cookies, so a visitor's browser does not receive a tracking file that follows them from page to page. The owner receives a short monthly note with the totals, which is enough to see whether the site is being read at all.
The privacy notice should say plainly that page views are counted and why. It should also say that the owner does not receive a list of named visitors, and that no cookies are set for this purpose. Describing the measurement in plain words is more useful to a reader than a long paragraph of legal language that says nothing specific about the site in front of them.
Writing a plain privacy notice#
A privacy notice should tell people what personal data is handled, why it is handled, and how to ask about it. It does not need to be frightening or full of jargon. A good notice names the things the site actually does. It can say that technical data is received when a page loads, that visits are counted without cookies, and that the owner can be contacted about any question concerning personal data. Every DISPO site includes a PDPA privacy notice, alongside legal pages and a credits page that acknowledges photos and map data.
Those pages should match what the site really does. If a feature changes, the notice should change with it. Thai rules limit how cannabis may be advertised, so check your plans with a lawyer. This article is an explanation and not legal advice, so an owner should confirm the final wording with a lawyer before relying on it.
Keeping it current#
A privacy notice is not a document to write once and forget. When the owner adds a new tool, moves hosting, or changes how the age gate works, the notice should be reviewed. A short check every few months is usually enough for a small site. The owner can read the monthly visit note, look at the features on the page, and ask whether the notice still describes them accurately.
The aim is to be exact about what is collected, to keep it no broader than needed, and to say so in terms a visitor can understand in one reading. A small shop that does this well has a site that is easier to trust, and easier for the owner to explain when someone asks. DISPO, from SISO Labs, is built with that aim in mind.