By country

Refund Policy Generator EU

EU GDPR, the ePrivacy Directive as implemented locally, and the one-stop-shop - with the right lead authority named.

Generate your refund policy Read the refund policy guide

The EU withdrawal right is fourteen days from delivery for goods and from conclusion for services, and it exists whether or not you write it down. What your policy adds is clarity on the mechanics: who pays return shipping, how quickly you refund, and which of the permitted exclusions you rely on.

EU compliance is not one regime but one regulation applied by twenty-seven authorities, plus national laws that fill the gaps GDPR deliberately left. The cookie rules in particular are national: the ePrivacy Directive is implemented by the TDDDG in Germany, by the Loi Informatique et Libertés and CNIL guidelines in France, by Article 22.2 LSSI in Spain and by the Telecommunicatiewet in the Netherlands.

If you are established in more than one member state, the one-stop-shop mechanism gives you a lead supervisory authority based on your main establishment. That authority is the one to name. If you are established nowhere in the EU but target EU users, there is no lead authority - every national regulator can act, and Article 27 requires you to appoint an EU representative.

The regulatory surface has widened well beyond GDPR. The Digital Services Act imposes notice-and-action and transparency duties on anyone hosting user content, the AI Act layers transparency obligations onto systems that interact with people, and the Data Act adds switching and access rights for connected products and cloud services.

What a refund policy in the EU has to cover

The 14-day withdrawal right and the model withdrawal form
When the period starts for goods, services, digital content and subscriptions
The consumer pays return shipping unless you agreed otherwise or the goods are faulty
Refund within 14 days of withdrawal notice, though you may wait for the goods or proof of return
Digital content: the express-consent-plus-acknowledgement waiver, captured at checkout

How the EU actually moves personal data

Cross-border customer data inside the EEA

Intra-EEA movement is not a "transfer" and needs no Chapter V mechanism, but it does need the recipient categories disclosed and, where a group company is involved, a controller-to-controller or Article 26 joint-controller arrangement.

Transfers to the United States

Certified importers can be covered by the EU-US Data Privacy Framework; everyone else needs the 2021 SCCs plus a transfer impact assessment that engages with US surveillance law rather than asserting adequacy.

Consent signals under the TCF

If you sell programmatic advertising you are likely inside the IAB Transparency and Consent Framework, which brings its own vendor list, purpose taxonomy and string format that the policy has to reflect.

Special category data by accident

Health-adjacent apps, dietary preferences, trade union membership in payroll and political affiliation in CRM records all trigger Article 9 and need a condition from Article 9(2), not just a basis from Article 6.

Employee monitoring and works councils

In Germany, Austria and the Netherlands, monitoring tools frequently require works council agreement before deployment, independently of the GDPR basis.

Third parties the draft will ask you about

Stripe · Adyen · Mollie · Klarna · Google Analytics 4 · Matomo · Brevo · AWS eu-central-1 · OVHcloud · Hetzner

The rules that apply

GDPR (Regulation 2016/679)

Articles 13 and 14 for the notice, Article 6 for the basis, Article 30 for the internal record, and Chapter V for transfers out of the EEA.

ePrivacy Directive, as implemented nationally

Consent for storing or accessing information on a device. The rule is European, the implementation and the enforcement thresholds are national.

One-stop-shop and Article 27

A lead authority if you have an EU establishment; an appointed EU representative and exposure to every authority if you do not.

Consumer Rights Directive and the Omnibus Directive

Fourteen-day withdrawal on distance sales, plus disclosure duties on ranking, reviews and personalised pricing.

Digital Services Act

Published terms, a notice-and-action mechanism, statement-of-reasons for moderation decisions and an internal complaints route for anyone hosting third-party content.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

Getting an EU-facing policy right

Establish whether you have a main establishment
It determines whether you get a lead authority or face all twenty-seven. Where central decisions about processing are actually taken is the test, not where the company is registered.
Appoint an Article 27 representative if you are outside the EU
Required for most non-EU businesses targeting EU users. The representative’s name and address go in the privacy policy.
Set the age of digital consent per market
It ranges from 13 to 16 across member states. If you serve minors, the age gate has to be country-aware.
Document transfer impact assessments
One per destination country and vendor, referencing the actual legal environment, kept on file for the regulator rather than summarised in the notice.
Map DSA duties if you host user content
Notice-and-action, statements of reasons and an internal complaint system are separate obligations from anything in GDPR.

Where this usually goes wrong

Naming "the EU supervisory authority" instead of a real one

There is no such body. Users must be told they can complain to their own national authority, and if you have a lead authority you should name it.

Assuming the Data Privacy Framework covers every US vendor

It covers only organisations that have actively self-certified and remain on the list. Most smaller US SaaS vendors have not, which leaves you on SCCs plus a transfer impact assessment.

A cookie banner that pre-ticks or infers consent

The Planet49 ruling settled this: pre-ticked boxes are not consent, and continued scrolling is not consent. Several national regulators treat it as an automatic finding.

Ignoring national add-ons

Germany requires an Impressum, France requires mentions légales, and several member states set their own age of digital consent between 13 and 16. A pure GDPR document misses all of it.

Legitimate interests for advertising without an assessment

The EDPB and the courts have narrowed this repeatedly. Behavioural advertising on legitimate interests, with no documented balancing test, is the pattern that produced the largest recent fines.

Frequently asked questions

Does GDPR apply to my business if I am not in the EU?

Yes, if you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) turns on where the person is. Accepting euros, shipping to EU addresses or running EU-targeted ads are the facts regulators look at.

Which supervisory authority do I name?

If you have an EU main establishment, your lead authority. If not, tell users they may complain to the authority in their own member state, and name your Article 27 representative.

Is one policy enough for all 27 member states?

For GDPR, generally yes. For cookies, marketing, minors and consumer terms it needs national variations, because those are governed by national implementations rather than the regulation itself.

Do I need an EU representative?

If you are established outside the EU and Article 3(2) catches you, yes - unless your processing is occasional, low-risk and excludes special category data. Most e-commerce and SaaS businesses do not fit that exemption.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.