Data privacy basics for website owners

Data Privacy; Where to Start?

When it comes to data privacy, most Iranian website owners either think this topic only applies to large foreign companies, or assume domestic laws aren't serious enough to require action. But the reality is that every website — from a small online store to a high-traffic blog — collects a significant amount of user data daily; from IP addresses and browser types to mobile numbers, emails, and even payment information.

The main problem isn't that you collect this data; the problem is that you usually don't know exactly what you're collecting, why you're collecting it, and how long you're going to keep it. This disorganization is dangerous both for users and for your business. In this article, we'll have a practical roadmap: what data to collect, how long to keep it, and how to be transparent.

Step One: Data Audit — Understand What You Have

Before any action, you need to know what data flows through your website. Start with a simple Data Audit. You don't need to buy complex tools; a spreadsheet is enough.

Main Sources of Data Collection on Your Website

• Registration and contact forms: Name, email, mobile number, message text
• Payment system: Card information (if you receive it directly) or payment gateway tracking code
• Server logs: IP address, User-Agent, visited pages, exact timestamps
• Cookies and analytics tools: Google Analytics, Yandex Metrica, or domestic tools
• Live chat and support tickets: Conversations, uploaded files

For each of these sources, ask three questions: Why am I collecting this data? Is it necessary to provide the service? What happens if it's removed? If you don't have an answer for "why," you probably shouldn't collect it.

Step Two: Data Minimization — Collect Less, Be Safer

The principle of Data Minimization means only collecting data that is necessary for a specific purpose. This principle is reflected in Europe's GDPR and, to some extent, in Iran's new data protection laws.

A Few Practical Examples

• For a newsletter, email is enough; don't ask for birth date or national ID.
• For placing an order, a full address is necessary, but not occupation or education.
• For identity verification, a mobile number is sufficient; no national ID is needed unless legally required.

Besides reducing risk, this also improves user experience. Iranian users strongly avoid long forms.

Step Three: Determining Data Retention Period — How Long to Keep?

One of the most important yet most neglected parts of data privacy is determining the retention period. Data should not be kept "forever." Each type of data has a useful lifespan.

Practical Recommendations for Retention Periods

1. Server logs: Maximum 30 days. After that, keep only statistical summaries.
2. Inactive user data: If a user has had no activity for 2 years, delete their unnecessary data.
3. Support conversations: 6 months to 1 year, unless there's an open legal case.
4. Payment information: Keep only the tracking code and amount; never store card information.
5. Invoices and financial documents: According to Iranian tax laws, retention of at least 5 years is mandatory.

Implementing Automatic Deletion

For server logs, you can use logrotate on Linux. Here's a simple example:

# /etc/logrotate.d/nginx
/var/log/nginx/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    create 640 www-data adm
}

This configuration rotates logs daily and keeps only 30 copies. For the database, write a simple Cron Job to delete old records:

# Delete users inactive for 2 years
DELETE FROM users 
WHERE last_login < NOW() - INTERVAL 2 YEAR 
AND role = 'subscriber';

Before running this query, make sure to back up the database and ensure you're also managing related data (such as orders).

Step Four: Transparency — Tell Users What You're Doing

Transparency isn't just a slogan; it's a practical commitment. Users should know what data is collected, why it's collected, and how they can delete it. This is done through two tools: a privacy policy page and clear notifications.

What Should a Privacy Policy Page Include?

• A complete list of the data you collect (in simple language, not legal jargon)
• The purpose of collecting each piece of data
• The retention period for each type of data
• Third parties that have access to the data (payment gateway, analytics tools, hosting)
• Contact methods for requesting data deletion
• Date of last update

Sample Simple Text for a Privacy Policy Page

What information do we collect?
- Your email and name for registration and newsletter delivery
- Your IP address for security and attack prevention (retained for 30 days)
- Payment information is processed only by the bank gateway, and we never see your card number.

How can you delete your data?
- Through the user panel, the "Delete Account" option
- Or by sending an email to privacy@example.com

Step Five: Data Security — Secure Storage and Transfer

Privacy is meaningless without security. If you collect data but don't keep it secure, you've effectively violated users' privacy. A few essential measures:

Encryption in Transit and at Rest

• Always use SSL/TLS. Today, Let's Encrypt is free, and there's no excuse for plain HTTP.
• Hash user passwords with password_hash() in PHP or bcrypt in Node.js; never store them as plain text.
• For databases containing sensitive information, enable disk-level encryption (LUKS) or at least encrypt sensitive columns.

Example of Password Hashing in PHP

<?php
// Registration
$hashed = password_hash($_POST['password'], PASSWORD_BCRYPT);
// Store $hashed in the database

// Login
if (password_verify($_POST['password'], $hashed_from_db)) {
    // Success
} else {
    // Failure
}
?>

Access Control

Only allow access to the admin panel and database from authorized IPs or via VPN. Use two-factor authentication (2FA) for admin accounts. This is simple but highly effective.

Step Six: User Rights — Right of Access and Deletion

Users should be able to access their data and request deletion. This right is explicitly stated in GDPR and is also referenced in Iran's new laws.

How to Implement This Right?

1. In the user panel, add a "My Data" section where users can see all their stored information.
2. Enable a "Delete Account" option that removes all user data except legally required items (such as invoices).
3. For deletion requests via email, allow a maximum of 30 days to respond.

Conclusion: Data Privacy Is a Process, Not a Project

Managing data privacy isn't a one-time task. Technology changes, laws are updated, and your website grows. I suggest setting up an annual calendar in which you:

• Re-perform the data audit
• Review retention periods
• Update the privacy policy page
• Purge old logs and unnecessary data

If your website's infrastructure needs a review in terms of security and privacy, you can use ServerNet's consulting and secure infrastructure services. But the most important step is to start. Do a simple audit today and see what data you have. This is the first step toward building a trustworthy website.