The external-facing privacy notice must contain organizational information, data you collect, how is the data collected, how you use personal data, how personal data is shared, data security, data retention, Customer legal rights, for more information visit GDPR page