If you use company-level visitor identification, your privacy policy has to say so. Not in a footnote, not in a legalese fog, and not on a separate page nobody links to — in the same document your visitors already know to look at. This is a practical walkthrough of the paragraph you owe them, where it goes, and how to phrase it without making it worse than it needs to be.
Note
This is a marketing article, not legal advice. Use the snippet at the bottom as a starting point and have your DPO or counsel adapt it to your actual processing.
Where the paragraph goes
The right home is your existing privacy policy — usually the section titled something like "Website analytics", "Use of your data", or "Processing on this website". Add it as a new sub-section with a clear heading, near your analytics section but distinct from it. The goal is that a visitor with ten seconds and Ctrl+F can find it under "visitor identification" or "company data".
Do not hide it inside your cookie policy. Cookie policies are about storage on the device; company-level identification typically does not use cookies, and putting it there confuses everybody.
What the paragraph must cover
Six elements, in roughly this order. None of them needs to be long.
- What you do: identify the company (organisation) behind a website visit, not the individual person.
- Which data you process: the visitor's IP address for a brief technical window, plus pages visited and timestamps.
- How you process it: the IP is resolved to an organisation using an IP-to-company database; the raw IP is not retained beyond the resolution.
- Why: legitimate interest under Art. 6(1)(f) GDPR — direct marketing and account intelligence — with the balancing test on file.
- Retention: how long identified visits are kept in your systems.
- Rights and opt-out: a link to your opt-out page and a note that visitors can object at any time.
Wording do and don't
| Do | Don't |
|---|---|
| Say "we identify the visiting company (organisation)" | Say "we identify visitors" (ambiguous — sounds personal) |
| Name the lawful basis explicitly (Art. 6(1)(f)) | Refer to consent when the basis is legitimate interest |
| Describe the IP transformation (IP → company, not stored raw beyond resolution) | Omit the retention window — silence reads as forever |
| Link the opt-out page directly | Point people at "contact us to object" only |
| Name the processor if you use one, with a link to the DPA/sub-processors list | Leave third-party processing implied |
| Use plain-language equivalents alongside legal terms | Rely on Latin and article numbers only |
A ready-made snippet (adapt to your setup)
"Website visitor identification (company-level). When you visit our site, we process your IP address for a brief technical window in order to determine the organisation behind the visit — not the individual person. The IP is resolved to a company using an IP-to-organisation lookup and is not retained in raw form beyond that resolution. We combine the resolved company with the pages you viewed and the time of your visit, so that we can understand which organisations are interested in our services and reach out where appropriate. Legal basis: legitimate interest under Article 6(1)(f) GDPR (direct marketing and account intelligence), documented in an internal balancing test which is available on request. Retention: identified visits are stored for [12 months] and then deleted. You have the right to object at any time; you can opt out of this processing at [link to your /opt-out page]."
Replace [12 months] with your actual retention period. Replace the opt-out link with your own. If you use a processor, add: "We use [processor name] as a processor for this purpose. Our data processing agreement is available at [link]."
Two anchors worth linking
The paragraph is stronger when it links to two other pages: your DPA (for the processor relationship) and your list of sub-processors. Both signal "we thought about this end to end" to any prospect whose security team will read your policy — and they do.
What else moves when you add this paragraph
One paragraph is usually not the only edit. Two neighbouring pages typically move at the same time: the sub-processors list (add your identification processor), and the record of processing activities on your side. If you have a cookie banner, this paragraph is not one of the banner categories — company-level identification does not need consent through the banner, provided the balancing test is done. A short internal note explaining that to your CMP admin will save a confused ticket in six months.
Once the paragraph is live, take a screenshot of the section and file it alongside your balancing test. If a regulator ever asks how visitors were informed on 3 August of year X, you will be glad the timestamped screenshot exists.
This article is general information for B2B teams and not legal advice. Have your DPO or counsel confirm the wording for your specific processing.
Published by
lead.box Team
More articles
See lead.box on your own traffic
Start free — no card, no sales call required. Or book a 20-minute walk-through if you want the guided tour.