diff --git a/content/privacy-policy/index.md b/content/privacy-policy/index.md
new file mode 100644
index 0000000..cd075c2
--- /dev/null
+++ b/content/privacy-policy/index.md
@@ -0,0 +1,71 @@
++++
+title = "Privacy Policy"
+description = "Read NovaSpin's sample privacy policy: what data we collect, how it's used, sharing, retention, your rights and security. A template, not legal advice."
+heroImage = "images/hero-faq.svg"
+heroAlt = "Abstract illustration representing data privacy"
+author = "NovaSpin Editorial Team"
+lastmod = 2026-07-13
+toc = true
++++
+{{< notice type="warning" >}}
+This privacy policy is a sample template provided for demonstration purposes only. It is not legal advice and must not be relied upon as a compliant policy. Always consult a qualified data-protection professional before publishing your own privacy notice.
+{{< /notice >}}
+
+NovaSpin takes your privacy seriously. This page explains, in plain UK English, how we handle the personal information you share with us when you visit our site or open an account. Please read it alongside our [cookie policy](/cookie-policy/), which covers how we use cookies and similar technologies.
+
+## Who we are
+
+NovaSpin is a fictional online casino brand used to illustrate best-practice website copy. For the purposes of this sample, the data controller is "NovaSpin", operating under a sample Malta Gaming Authority licence (MGA/B2C/000/0000, a placeholder reference).
+
+If you have any questions about how your data is handled, you can reach us through our [contact page](/contact/). In a real deployment, this section would name the legal entity, registered address and the details of a Data Protection Officer where one is required.
+
+## What data we collect
+
+We only collect information that helps us run the service responsibly. Typical categories include:
+
+- **Account details** — name, date of birth, email address and password.
+- **Verification data** — identity documents used to confirm your age and identity.
+- **Financial data** — deposit and withdrawal records (we do not store full card numbers).
+- **Usage data** — pages viewed, games played and device or browser information.
+
+We collect this information directly from you when you register, and automatically as you use the site.
+
+## How we use data
+
+We process your data to create and manage your account, verify your age and identity, process transactions, and keep the platform secure. We also use it to meet our regulatory obligations, including anti-money-laundering checks and responsible-gambling monitoring.
+
+Where you have given consent, we may send you marketing messages about offers such as our sample welcome package. You can withdraw that consent at any time, and we will always respect your choices.
+
+### Lawful bases
+
+In a compliant policy, each processing activity would be tied to a lawful basis — for example, performance of a contract, legal obligation, or your consent. This sample lists them for illustration only.
+
+## Sharing and transfers
+
+We do not sell your personal data. We may share limited information with trusted service providers, such as payment processors, identity-verification partners and analytics suppliers, strictly to deliver the service.
+
+We may also disclose data to regulators, licensing bodies or law-enforcement agencies where we are legally required to do so. Where data is transferred outside your home country, appropriate safeguards would be put in place in a real policy.
+
+## Data retention
+
+We keep your personal data only for as long as necessary. Account and transaction records are typically retained for a period after your account closes to satisfy licensing and anti-money-laundering rules — a sample figure would be up to five years.
+
+Once data is no longer needed, it is securely deleted or anonymised. Exact retention periods in a live policy should reflect the operator's legal obligations.
+
+## Your rights
+
+Depending on where you live, you may have the right to access your data, correct inaccuracies, request erasure, restrict or object to processing, and ask for your data in a portable format. You may also lodge a complaint with your local data-protection authority.
+
+To exercise any of these rights, get in touch via our [contact page](/contact/) and we will respond within the timeframe required by law.
+
+## Security
+
+We use technical and organisational measures — such as encryption in transit, access controls and regular reviews — to protect your information. No system can be guaranteed completely secure, so we encourage you to use a strong, unique password and to keep your login details private.
+
+## Changes to this policy
+
+We may update this sample policy from time to time to reflect changes in the service or the law. Any updates will be posted on this page with a revised date, so please check back periodically.
+
+---
+
+Gambling should always be fun, never a way to make money. If it stops feeling that way, please take a break. Set deposit and time limits, and visit our [responsible gambling](/responsible-gambling/) page for tools and support. You must be 18+ to play. Please gamble responsibly.