Privacy Policy (RGPD / GDPR)
A privacy policy is the document by which a data controller informs data subjects of how their personal data is collected, processed, and protected. Regulation (EU) 2016/679 (RGPD / GDPR), applicable since 25 May 2018, requires full transparency: individuals must know who processes their data, why, for how long, and what their rights are. Any organization that collects personal data (contact form, audience analytics, newsletter) is required to publish an accessible and readable privacy policy. This form is in English, but the document is generated in French, ready to sign and use in France.
Note: the questionnaire is in English; the generated document is in French.
Data controller
Fields marked with an asterisk are required. Your information is only used to generate your document.
Frequently asked questions
Who is required to publish a privacy policy?
Any natural or legal person who collects or processes personal data must inform the data subjects. This obligation applies to large companies as well as SMEs, associations, freelancers, and bloggers as soon as they collect data (contact form, statistics cookies, newsletter, etc.).
What is a legal basis under the RGPD (GDPR)?
The processing of personal data must rely on one of the six legal bases set out in article 6 of the RGPD (GDPR): the person's consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or the legitimate interest of the data controller. Each purpose must have its own legal basis.
Is it necessary to appoint a Data Protection Officer (DPO)?
Appointing a DPO is mandatory for public authorities, organizations whose core activity involves large-scale data processing, and those processing sensitive data on a large scale. For other organizations, appointing a DPO is optional but recommended.
What is the recommended data retention period?
The RGPD (GDPR) requires that data be kept only for as long as necessary for the purposes for which it was collected. The CNIL (French data protection authority) and the European Data Protection Board (EDPB) have published sector-specific recommendations: 3 years for prospects, contract duration plus 5 years for customer data, 1 month for connection logs, and so on.
Other templates
See all →Demarches-Simplifiees.co — Demarches-Simplifiees.co is an independent service. This template is provided for information only and does not constitute personalised legal advice. Documents are issued in French.