Privacy notice under Articles 13/14 of the RGPD (Règlement général sur la protection des données, the French-facing text for the EU GDPR), following the CNIL (Commission nationale de l'informatique et des libertés) model for small businesses — required for any processing of personal data, including bookings/reservations, loyalty programmes, marketing and CCTV/video-surveillance.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.
PRIVACY POLICY (POLITIQUE DE CONFIDENTIALITÉ)
Business name (responsable de traitement), Business address Effective date: Effective date
This notice explains how Business name (responsable de traitement) (the "Company", responsable de traitement / data controller) collects, uses and protects personal data, in accordance with Articles 13 and 14 of the Règlement général sur la protection des données (RGPD) and the guidance of the CNIL (Commission nationale de l'informatique et des libertés).
1. RESPONSIBLE PARTY 1.1. Business name (responsable de traitement) is the data controller (responsable de traitement) for the processing described in this notice. 1.2. Data Protection Officer (DPO), if appointed: Data Protection Officer (DPO), if any
2. WHAT DATA WE COLLECT AND WHY 2.1. What data is collected and why
3. PURPOSES AND LEGAL BASIS 3.1. Purposes and legal basis of processing
4. RECIPIENTS AND TRANSFERS OUTSIDE THE EU 4.1. Recipients and transfers outside the EU 4.2. Transfers of personal data outside the EU/EEA require either an adequacy decision or appropriate safeguards (e.g. EU standard contractual clauses).
5. RETENTION 5.1. Retention period
6. YOUR RIGHTS 6.1. Data subject rights 6.2. CNIL complaint note
7. COOKIES AND TRACKING 7.1. Cookies/tracking consent 7.2. A clear cookie-consent banner with a genuine "refuse" option, as easy to use as "accept", is required before setting any non-essential cookie or tracker.
8. CONTACT US 8.1. Questions about this notice, or requests to exercise your rights, may be sent to Privacy contact e-mail.
⚠️ If CCTV/video-surveillance, a loyalty programme, or online booking/reservation data is used, describe it explicitly in section 2 above and record it in the internal register of processing activities (registre des traitements) — this is typically the first document the CNIL asks for at inspection.
— — — ⚠️ This is a boilerplate template, not legal advice. French employment, consumer-protection and data-protection law (Code du travail, Convention collective HCR "CCN HCR", Code de la consommation, RGPD/CNIL, Regulation (EU) No 1169/2011 "INCO") is highly procedural, includes fixed statutory calendars (e.g. the entretien préalable and rupture conventionnelle timelines) and changes frequently — statutory figures (SMIC, grille HCR, sanction amounts) are re-indexed periodically. Have this document reviewed and adapted by a French employment/legal advisor (avocat en droit du travail / expert-comptable) and verified against the current rates before use. Under the loi Toubon (Law No. 94-665 of 4 August 1994), documents intended for use in France — employment contracts, consumer information, mandatory workplace notices — must be available in French; where a French-language version of this document is also used, that version prevails in case of conflict.
Fields that belong to a switched-off clause are dimmed — they are not asked for.
Not automatically mandatory for a small business, but recommended if processing is significant/regular
e.g. bookings/reservations, orders, CCTV, loyalty programme, marketing/newsletter opt-ins
Access, rectification, erasure, objection, portability, and the right to complain to the CNIL
Right to lodge a complaint with the CNIL (www.cnil.fr)
Prior, informed consent required before non-essential cookies/tracking are set
2 of 12 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.