This paper presents a hierarchy of privacy notions that covers multiple anonymity and unlinkability variants. The underlying definitions, which are based on the idea of indistinguishability between two worlds, provide new insights into the relation between, and the fundamental structure of, different privacy notions. We apply the definitions to a number of privacy-preserving systems, namely group signatures, voting systems, and anonymous communication systems, and show how they relate to existing definitions.