Privacy Policy vs. Terms and Conditions
Two different documents with different legal jobs — what belongs in each, why you should not merge them, and which you need first.
A privacy policy is a disclosure. It is required by law, it is addressed to the individual whose data you hold, and its job is to be accurate rather than favourable to you. Terms and conditions are a contract. Nobody obliges you to have them, they are addressed to the user of your service, and their job is to allocate risk between you.
That difference explains most of the confusion. You cannot 'agree' to a privacy policy in any meaningful sense — consent under GDPR is per-purpose, not a blanket acceptance — while terms only bind someone if they were presented and accepted.
What belongs in the privacy policy
Identity and contact details of the controller; the categories of data you collect and why; your lawful basis for each purpose; recipients and processors by name; international transfers and safeguards; retention periods; the rights available and how to exercise them; cookie and tracking disclosures; and how to complain to a regulator.
What belongs in the terms
Who may use the service and any age limit; acceptable use and grounds for suspension; pricing, billing, renewal and cancellation; refund rules; who owns the content you host and the licence you get to it; disclaimers and limits of liability; governing law and dispute resolution; and how you notify changes.
Refund and cancellation terms are also where consumer law bites hardest. A UK or EU consumer's statutory 14-day withdrawal right for distance sales cannot be written away, and a clause that tries to is unenforceable rather than merely aggressive.
Why not combine them
Some sites publish one 'Terms and Privacy' page. It is legal, but it creates two practical problems. Regulators and app-store reviewers look for a standalone privacy URL and a merged page can be rejected. And a document that mixes a mandatory disclosure with a contract you can amend at will invites the argument that your disclosure changed without notice. Keep them as separate pages, cross-linked, both reachable from your footer.
Which do you need first
Privacy policy, in nearly every case — it is the one the law and your payment processor demand. Add terms as soon as money, accounts or user-generated content are involved, which is when a dispute becomes possible.
General information rather than legal advice. If you sell subscriptions, host user content, or operate across several countries, have your terms reviewed by a lawyer in your main market.