I have a Czech registered business with which I'm serving a web app mostly (but not exclusively) targeted to Italian customers. The server is in Amsterdam. The site will be multilingual (with 4 languages supported) but for now it's Italian only.
What language should the privacy policy and terms and conditions be? What law should they refer to?
Could I just offer these two docs in English? (Easier to write and to maintain)
You're subject to the laws of the Country where your business is legally based and/or bases the operations. Cross-country legal enforcement (privacy in particular) lives in a grey area and - for example - big companies like Facebook or Google do not always comply with EU privacy laws. For EU companies, servers' location only matters in case you move the data outside Europe, which forces you to notify it to your users by mentioning this activity on the privacy policy.
Note that, in case you need to generate the privacy policy for the website you mentioned and localize it in Italian and English, I founded a service that does exactly this (and supports these two languages): http://www.iubenda.com
You didn't mention if you gonna have English visitors too or not, but these legal information is meant to be accessible for your visitors, what is point of having it on your website if your users can't understand it?!
Your website should provide the necessary legal information for all targeted visitors.
Since all mentioned targets are EU members, your website should first meet the EU laws. see EU Data Protection Directive, perhaps you can contact them to find the answer to some of your legal questions.
Also you may need to include some regional laws, for where you business is registered and where your contents are hosted.
However, I'm not a lawyer, you should still discuss these with a lawyer who is familiar with EU laws.
As you probably know, many Europeans speak English as a common (foreign) language, so as a temporary measure, my gut feeling is that English would be OK but as the people before me noted, this is a pretty grey legal area.
The W3C Internationalization Working Group has quite a bit of general info, but as a starter I liked their Quick Tips.
The 7th Tip, "Use simple, concise text. Use care when composing sentences from multiple strings," seems pertinent, as long as you aren't planning on trying to write something that is intentionally opaque.
Personally, for user convenience, I like to include Google Translate (Javascript) with a visible box. Many users in my area speak English as a second language, so while their browser default language may be set to English (due to a lack of Spanish resources), it may not be their preference. I figure that gives them the option to read an imperfect automated translation and then reference the original if needed.
