Welcome

This questionnaire helps us understand how your business collects, uses, shares, and protects personal information. Your answers will be used to draft a privacy policy, terms of use, cookie notice, and related documents that accurately reflect your practices and comply with applicable law.

Estimated time: 45 to 90 minutes. Your progress is saved automatically in your browser — you can close the page and return later from the same device. If a section does not apply to your business, mark it "N/A" rather than skipping it.

Several sections ask about specific technologies (tracking pixels, consent platforms, analytics tools, etc.). If you do not know the answer, please consult with your marketing team, web developer, or IT lead. Accurate answers in these sections are essential.

Important. Submission of this questionnaire does not create an attorney-client relationship between you and Lubin Law Firm. Please do not include any information you consider confidential or privileged until you have signed an engagement letter with the Firm. Information you submit through this form is handled in accordance with the Firm's Privacy Policy.

Module A — Company and Entity Information

Identifying the legal entities involved and the industries they operate in determines which laws apply and how the documents must be drafted.

A1. Legal name of the entity that owns the website(s) and will be named in the privacy policy.

A2. Corporate form (LLC, Inc., Ltd., LP, etc.).

A3. State of incorporation or formation.

A4. Principal place of business (street address).

A5. Parent companies, affiliates, subsidiaries, or related entities whose practices should be reflected in the policy.

A6. States or U.S. territories where the business operates, has employees, or markets services.

A7. Does the business market to or collect data from consumers outside the United States? If yes, identify the countries or regions.

A8. Approximate annual gross revenue (range is acceptable).

A9. Approximate number of unique individuals whose personal information you process per year.

A10. Of that total, approximately how many are residents of each of the following: California, Florida, Texas, and other comprehensive-privacy-law states combined

A11. Industry-specific regulations applicable to your business (select all that apply).

HIPAA GLBA (financial institution) FCRA (consumer reporting / credit) COPPA (services to children under 13) FERPA (education records) CAN-SPAM / TCPA / FTSA (email or SMS marketing) State professional licensing None of the above

A12. Other industry-specific regulations or licensing regimes that affect your business.

Module B — Websites, Apps, and Digital Properties

We need to identify every consumer-facing digital property that the privacy policy will govern.

B1. Primary website URL.

B2. Additional websites, microsites, landing pages, or campaign sites.

B3. Mobile applications (iOS, Android).

B4. Content management system or website platform.

B5. Who manages the website day-to-day?

In-house developer or marketing team Outside agency or contractor Both

B6. Hosting provider.

B7. Languages in which content is offered.

B8. Does the website use geographic targeting (e.g., showing different content or compliance flows to users from different states or countries)?

Yes No

Module C — Audience and Visitors

Knowing who visits your site affects which laws apply and what disclosures the policy must include.

C1. Primary audience for the website.

Consumers (B2C) Businesses (B2B) Both

C2. Describe the primary audience (industry, role, geography).

C3. Does the website knowingly collect information from, or is it directed to, children under 13?

Yes — COPPA likely applies No Possibly — uncertain

C4. If yes or uncertain to C3, describe the relevant interactions and any age verification or parental consent mechanisms in place.

C5. Does the website collect information from minors aged 13–17?

Yes No Possibly — uncertain

C6. Are there any age restrictions on use of the website or any specific feature?

Module D — What Personal Information You Collect

Check every category of personal information the business collects from website visitors, customers, leads, registrants, or any other source.

D1. Standard identifiers (select all that apply).

D2. Government identifiers (select all that apply).

Social Security Number Driver's license or state ID Passport number Other government-issued ID None

D3. Financial information (select all that apply).

Credit or debit card Bank account information Income or salary information Credit score or history Mortgage or loan information Transaction history None

D4. Sensitive categories (select all that apply).

D5. Commercial / behavioral information (select all that apply).

Purchase history and preferences Browsing or search history on your site Browsing or search history across other sites Interaction history (clicks, scrolls, time on page) Form-fill or abandoned-cart information Survey or poll responses User-generated content

D6. Professional or employment information (select all that apply).

D7. Do you derive inferences from the personal information you collect?

Yes No

D9. Other categories of personal information not listed above.

Module E — How You Collect Personal Information

Identifying every collection mechanism is essential because each is a potential exposure point.

E1. Methods of collection (select all that apply).

E2. If you purchase, rent, or receive data from third-party data providers, identify them.

Module F — Website Tracking Technologies

This is the most important module given recent litigation under the Florida Security of Communications Act. Accuracy here determines the strength of your defense against pen register / trap and trace claims. If you don't know an answer, ask your web developer or marketing operations lead before guessing.

F1. Analytics tools currently active on the website (select all that apply).

Google Analytics 4 Google Universal Analytics (legacy) Adobe Analytics Matomo / Piwik Plausible, Fathom, Simple Analytics (privacy-focused)

F2. Advertising and conversion-tracking platforms (select all that apply).

F3. Call tracking, chat, and lead-routing tools (select all that apply).

F4. Session replay, heatmap, or behavioral analytics tools (a particular litigation magnet).

F5. Fingerprinting or device identification tools.

FingerprintJS Cloudflare Bot Management Not aware of any

F6. Tag Management System used.

F7. Is server-side tracking in use (e.g., Meta Conversions API, Google Enhanced Conversions, server-side GTM)?

Yes No Unsure

F9. Consent Management Platform (CMP) currently in use.

F10. If a CMP is in use, please answer the following.

Banner appears on first visit "Reject All" with equal prominence to "Accept All" Tracking scripts blocked before consent Consent state persists across sessions Geographic targeting (different flows by state/country) Honors Global Privacy Control signal Google Consent Mode v2 configured Meta consent API configured

F11. Have you ever obtained a court order authorizing the use of any tracking or recording technology on the website?

No Yes (please describe below)

F12. Other tracking, analytics, advertising, or recording technologies in use.

Module G — Data Sharing and Third Parties

Privacy laws distinguish processors (vendors who act on your behalf) from third parties (recipients who use the data for their own purposes).

G1. Categories of third-party recipients of personal information (select all that apply).

G2. Do you share PI with advertising or marketing platforms for behavioral advertising, retargeting, or audience building?

Yes (this is treated as "sale" or "sharing" under CCPA/CPRA) No Unsure

G3. Do you sell personal information to any third party for any consideration?

Yes No Unsure

G4. Identify any business partners or co-marketing arrangements where data is shared.

G5. Do you have written Data Processing Agreements with all vendors that receive personal information?

Yes, with all material vendors Yes, with some — others outstanding No Unsure

G6. Are personal data of U.S. consumers ever transferred outside the United States?

Yes No Unsure

Module H — Purposes for Using Personal Information

Privacy laws require disclosure of the business purposes for which data is collected and used.

H1. Purposes for which you use personal information (select all that apply).

H2. If automated decision-making is used, describe the system, the decisions made, and any human-review safeguards.

H3. If personal information is used to train AI/ML models, describe what data is used and what models are trained.

Module I — Data Retention

Privacy law expects retention periods defined per data category and tied to the purpose of collection.

I1. Approximate retention period for each data category.

I2. Is there a documented written data retention policy or schedule?

Yes (please provide a copy) No

I3. What triggers data deletion? (select all that apply)

Time-based (after a fixed retention period) Account closure or termination Customer request Business purpose achieved

Module J — Consumer Rights and Request Handling

Privacy laws require providing specific rights to consumers and describing those rights in the privacy policy.

J1. Which request types do you currently honor? (select all that apply)

Right to know / access Right to deletion Right to correction Right to opt out of sale or sharing for behavioral advertising Right to opt out of automated decision-making Right to limit use of sensitive PI Right to data portability Right to non-discrimination

J2. How can consumers submit privacy requests?

J3. Do you accept requests from authorized agents acting on behalf of a consumer?

Yes No Unsure

J4. Typical response time for privacy requests.

J5. How do you verify the identity of a consumer making a privacy request?

J6. Does the website honor Global Privacy Control (GPC) browser signals?

Yes No Unsure

Module K — Security and Breach Response

The privacy policy should describe security measures in general terms.

K1. Security measures in place (select all that apply).

K2. Has the business experienced a data security incident or breach affecting personal information in the past five years?

Yes No

K3. If yes, briefly describe the incident, what was affected, and any notifications made.

K4. Designated privacy or security contact (name, title, email).

Module L — Children's Privacy

Skip this section if you confirmed in Module C that no users under 18 are involved.

L1. If users under 13 are involved, describe the COPPA-compliant parental consent mechanism in place.

L2. If users 13–17 are involved, describe any heightened protections (advertising opt-outs, restricted features).

Module M — Terms of Use Inputs

The Terms of Use is a separate document addressing the legal rules governing use of the website itself.

M1. How do users currently accept your Terms of Use? (select all that apply)

Click-through / checkbox at account creation Footer link only (browsewrap) Scroll-through during checkout / registration Not currently posted

M2. Do you want an arbitration clause and class-action waiver included?

Yes (recommended) No Need to discuss

M3. Preferred governing law and venue (defaults to Florida if not specified).

M4. Do users post content on the website (reviews, comments, photos, testimonials)?

Yes No

M5. Describe user-generated content and any moderation policies.

M6. Have you designated a DMCA agent for copyright takedown notices?

Yes No

M7. Specific user conduct rules to include (no misuse, no scraping, etc.).

M8. Refund, cancellation, or return policy summary (if applicable).

Module N — Email and SMS Marketing

SMS marketing is governed by federal TCPA and, in Florida, the Florida Telephone Solicitation Act with heightened consent and private-right-of-action provisions.

N1. Email marketing platform in use (Mailchimp, HubSpot, Klaviyo, etc.).

N2. How do users consent to receive marketing emails? (select all that apply)

Explicit opt-in checkbox (not pre-checked) Pre-checked opt-in box Inferred from account creation Pop-up or modal

N3. Does the business send marketing SMS / MMS to U.S. consumers?

Yes No

N4. If yes, describe the SMS platform, the consent mechanism, and how opt-outs are handled.

Module O — Use of Artificial Intelligence

Several state privacy laws now require disclosure of AI and automated decision-making in consumer-facing operations.

O1. Does the business use AI or machine learning in any consumer-facing function?

Yes No Unsure

O2. Describe the AI/ML use cases (chatbots, lead scoring, personalization, generative AI, etc.).

O3. Do consumers interact with chatbots or AI assistants on the website? If yes, is there clear disclosure that they are interacting with AI?

Module P — Policy Housekeeping and Sign-Off

P1. Do you have an existing privacy policy, terms of use, or cookie notice we should review? Paste link below.

P2. Preferred email address for privacy-related inquiries (to be published in the policy).

P3. Preferred postal address for privacy-related inquiries.

P4. Preferred phone number for privacy-related inquiries (if any).

P5. Should we reserve the right to update the privacy policy and terms with email notification of material changes, or only by posting an updated version?

Email notification of material changes Posted updates only Both

P6. Any other information about the business's operations, data practices, vendor relationships, or planned changes that we should know.

Sign-Off

I confirm that the information provided in this questionnaire is accurate and complete to the best of my knowledge as of the date below. I understand that the documents drafted in reliance on this questionnaire will reflect the information provided and that material omissions or inaccuracies may result in documents that do not accurately describe the business's practices.

Name

Title

Company

Email

Date

Click "Submit Questionnaire" below to send your responses to Lubin Law Firm. You will receive a confirmation email after submission.

Privacy Compliance Intake Questionnaire

Welcome

Module A — Company and Entity Information

Module B — Websites, Apps, and Digital Properties

Module C — Audience and Visitors

Module D — What Personal Information You Collect

Module E — How You Collect Personal Information

Module F — Website Tracking Technologies

Module G — Data Sharing and Third Parties

Module H — Purposes for Using Personal Information

Module I — Data Retention

Module J — Consumer Rights and Request Handling

Module K — Security and Breach Response

Module L — Children's Privacy

Module M — Terms of Use Inputs

Module N — Email and SMS Marketing

Module O — Use of Artificial Intelligence

Module P — Policy Housekeeping and Sign-Off

Sign-Off

Licensed in Florida and U.S. Federal Courts for the Southern and Middle Districts of Florida.

Data Privacy Questionnaire

Privacy Compliance Intake Questionnaire

Welcome

Module A — Company and Entity Information

Module B — Websites, Apps, and Digital Properties

Module C — Audience and Visitors

Module D — What Personal Information You Collect

Module E — How You Collect Personal Information

Module F — Website Tracking Technologies

Module G — Data Sharing and Third Parties

Module H — Purposes for Using Personal Information

Module I — Data Retention

Module J — Consumer Rights and Request Handling

Module K — Security and Breach Response

Module L — Children's Privacy

Module M — Terms of Use Inputs

Module N — Email and SMS Marketing

Module O — Use of Artificial Intelligence

Module P — Policy Housekeeping and Sign-Off

Sign-Off

Licensed in Florida and U.S. Federal Courts for the Southern and Middle Districts of Florida.