Terms & Conditions and a Privacy Policy are not boilerplate to copy from a competitor's site — they are legally required documents that protect both you and your customers, and getting them wrong creates real regulatory and commercial risk.
Why generic templates are a false economy
It's tempting to copy a competitor's terms or use a free generic template, but UK consumer law requires your terms to reflect your actual business — your legal entity name, registered address, VAT number if applicable, specific delivery and returns processes, and any category-specific rules (such as age-restricted goods) that apply to what you sell. Terms that don't match your real practices are not just unenforceable in places, they can actively work against you in a dispute.
A well-drafted set of terms also reduces customer service load, because a clear, findable policy answers common questions (delivery times, returns process, warranty) before a customer needs to contact you at all.
Core elements every Terms & Conditions page needs
At minimum, your Terms & Conditions should clearly state your business's legal name, trading name (if different), registered office address and company number if you're a limited company, and full contact details including an email address and, ideally, a phone number. They should set out how a contract is formed (typically at the point of dispatch, not at the point of order, which affects when a customer can cancel an order that hasn't yet shipped), your delivery terms, your returns and refund process referencing your CCR obligations, and how you handle faulty goods under the Consumer Rights Act 2015.
- Business identity: legal name, trading name, registered address, company number, VAT number.
- How and when a binding contract is formed.
- Pricing, payment methods accepted, and currency.
- Delivery timescales, costs and what happens if goods are lost or damaged in transit.
- Cancellation, returns and refund rights under the CCRs and Consumer Rights Act.
- Limitation of liability, to the extent the law allows you to limit it.
- Governing law and jurisdiction (England and Wales, Scotland, or Northern Ireland as applicable).
What a compliant Privacy Policy must disclose
Under UK GDPR, your Privacy Policy must explain, in plain and accessible language, what personal data you collect, why you collect it (your 'lawful basis' — commonly contract performance for order processing, or consent for marketing), how long you retain it, who you share it with (payment processors, delivery couriers, marketing platforms), and what rights individuals have over their data, including access, correction, deletion and objection to marketing.
Cookie consent and PECR obligations
The Privacy and Electronic Communications Regulations (PECR) require clear, informed consent before non-essential cookies — analytics, advertising, and most third-party tracking — are set on a visitor's device, and this consent must be as easy to refuse as to accept. A cookie banner with only an 'Accept' button and no equally prominent way to decline or manage preferences does not meet this standard and is an increasingly common target of ICO enforcement action against UK websites.
Your Privacy Policy should cross-reference a separate, more detailed cookie policy explaining each category of cookie you use, its purpose, and its duration, updated whenever you add a new analytics or advertising tool to your site.
Keeping documents current as your business changes
Terms and privacy documents need to be updated whenever your business practices change — a new payment provider, a new international shipping destination with different consumer protection rules, a new marketing platform that introduces new data sharing, or a new product category with specific regulatory requirements (age-restricted goods, for example). Treat these documents as living operational content, not a one-time legal task, and note the 'last updated' date prominently so customers and regulators can see they're current.
Making the documents genuinely accessible
Legal compliance also has a practical dimension: your terms and privacy policy must actually be easy to find (typically linked in your site footer and referenced at checkout) and reasonably easy to read — dense legal language that technically covers every base but that no customer will ever read in full does little to build the trust that a clear, well-organised policy can create. Consider a short plain-English summary at the top of longer policies, with the full legal detail below it, so customers get clarity without you sacrificing legal completeness.
Taking This Further
It's rarely useful to treat writing legally compliant terms & conditions and privacy policies for a UK online store as a standalone decision — the strongest results tend to come from lining it up with the rest of your operation. Our companion guide, Web Accessibility and WCAG Compliance for UK Online Stores: What You're Legally and Practically Required to Do, goes into this in more depth.
For related reading: Our companion guide, Writing Job Descriptions and Interviewing for Your Early E-Commerce Hires, goes into this in more depth. Many of the same principles come up again in Measuring ROAS and Attribution in a Cookieless, Privacy-First World, which is worth bookmarking for later.