privacy-policy-malik-taiar

What this skill does

# Privacy Policy Guide - GDPR

## Overview

The privacy policy is the main document for informing data subjects under Articles 13 and 14 of the GDPR. It must be clear, accessible, and comprehensive.

### Policy Objectives

| Objective | GDPR Requirement |
|-----------|------------------|
| **Transparency** | Clearly inform about data processing (Art. 12) |
| **Information** | Provide all mandatory disclosures (Art. 13-14) |
| **Rights** | Enable exercise of data subject rights (Art. 15-22) |
| **Trust** | Reassure users about data protection |

---

## Reference Resources

### Templates

| Template | Description |
|----------|-------------|
| `assets/sample_template_politique_confidentialite.docx` | Default template to use if no private template is provided |
| Internal template provided by lawyer | Use if the lawyer has a more suitable private template |

> **IMPORTANT**: The default template `sample_template_politique_confidentialite` is designed for a **brochure website without user accounts**. If the request concerns an **application or platform with users**, additional data categories will need to be added, such as:
> - User account management (creation, authentication, profile)
> - Login data and activity history
> - Data generated by application usage
> - User-to-user communications (messages, comments, etc.)
> - User preferences and settings
>
> Adapt the template according to the platform type (brochure site, e-commerce, SaaS, mobile app, marketplace, etc.).

### CNIL Documentation

| Document | Content |
|----------|---------|
| **[CNIL_droits_personnes.pdf](./assets/CNIL_droits_personnes.pdf)** | Guide on data subject rights (access, rectification, erasure, etc.) |
| **[CNIL_durees_conservation.pdf](./assets/CNIL_durees_conservation.pdf)** | Retention period recommendations by data type |
| **[CNIL_finalites.pdf](./assets/CNIL_finalites.pdf)** | How to properly define processing purposes |
| **[CNIL_transparence.pdf](./assets/CNIL_transparence.pdf)** | Guide on information and transparency towards data subjects |
| **[CNIL_principes_rgpd.pdf](./assets/CNIL_principes_rgpd.pdf)** | Fundamental GDPR principles |
| **[RGPD_texte_officiel.pdf](./assets/RGPD_texte_officiel.pdf)** | Full text of EU Regulation 2016/679 |

### Knowledge Base

| Document | Content |
|----------|---------|
| **[BASES_LEGALES.md](./references/BASES_LEGALES.md)** | The 6 legal bases for processing (Art. 6 GDPR) with examples and wording |
| **[DROITS_PERSONNES.md](./references/DROITS_PERSONNES.md)** | The 8 data subject rights (Art. 15-22 GDPR) with exercise procedures |
| **[COOKIES.md](./references/COOKIES.md)** | CNIL 2020 recommendations on cookies, categories, banners, sanctions |
| **[DUREES_CONSERVATION.md](./references/DUREES_CONSERVATION.md)** | Retention period tables by data type with legal justifications |

---

## Information to Collect from Client

> **IMPORTANT**: Before drafting the policy, collect ALL the information below from the client.

### 1. Data Controller Information

- [ ] Full company name
- [ ] Legal form (SAS, SARL, Ltd, etc.)
- [ ] Company registration number (SIREN/SIRET)
- [ ] Registered office address
- [ ] Legal representative (name and title)
- [ ] General contact email
- [ ] DPO appointed? If yes, contact details

### 2. Nature of the Site/Application

- [ ] Existing website URL (for analysis)
- [ ] Platform type:
  - Brochure website
  - E-commerce
  - SaaS / Web application
  - Mobile application
  - Marketplace
  - Other: ___________
- [ ] Business sector
- [ ] Target audience (B2B, B2C, both)
- [ ] Target countries (France only, EU, international)

### 3. Data Collected

For each category, specify if applicable:

- IDENTIFICATION DATA
  - [ ] First name, last name
  - [ ] Email
  - [ ] Phone
  - [ ] Postal address
  - [ ] Date of birth
  - [ ] Photo / Avatar

- CONNECTION DATA
  - [ ] IP address
  - [ ] Connection logs
  - [ ] Device ID
  - [ ] Account identifiers

- BROWSING DATA
  - [ ] Pages visited
  - [ ] Time spent
  - [ ] Clicks
  - [ ] Traffic source

- TRANSACTION DATA
  - [ ] Order history
  - [ ] Payment data (via provider)
  - [ ] Invoices

- SENSITIVE DATA (special attention)
  - [ ] Health data
  - [ ] Political/religious opinions
  - [ ] Ethnic origin
  - [ ] Biometric data

### 4. Legal Bases for Processing

> **KEY QUESTION**: For each processing activity, what is the legal basis?

| Legal Basis | When to Use | Example |
|-------------|-------------|---------|
| **Contract Performance** (Art. 6.1.b) | Processing necessary to provide the service | Order delivery, account creation |
| **Consent** (Art. 6.1.a) | Free choice by the person, withdrawable at any time | Newsletter, marketing cookies, sharing with partners |
| **Legitimate Interest** (Art. 6.1.f) | Company interest, balanced against data subject rights | Anonymized statistics, security, B2B prospecting |
| **Legal Obligation** (Art. 6.1.c) | Required by law | Invoice retention 10 years, tax obligations |


**TABLE TO COMPLETE WITH CLIENT:**

| Processing Purpose | Legal Basis | Data Concerned |
|--------------------|-------------|----------------|
| Order management   |             |                |
| Account creation   |             |                |
| Newsletter         |             |                |
| Statistics         |             |                |
| Customer service   |             |                |
| Commercial prospecting |         |                |
| ___________________  |           |                |

### 5. Recipients and Processors

- TECHNICAL PROCESSORS
  - [ ] Host: ___________
  - [ ] Email provider: ___________
  - [ ] Payment provider: ___________
  - [ ] Analytics: ___________
  - [ ] CRM: ___________
  - [ ] Support/Ticketing: ___________

- TRANSFERS OUTSIDE EU
  - [ ] Yes / No
  - [ ] If yes, to which countries? ___________
  - [ ] Safeguards in place:
    - [ ] Standard contractual clauses
    - [ ] Adequacy decision
    - [ ] Other: ___________

### 6. Cookies and Trackers

- COOKIES USED
  - [ ] Strictly necessary cookies (session, cart, authentication)
  - [ ] Analytics cookies (Google Analytics, Matomo, etc.)
  - [ ] Advertising cookies (Facebook Pixel, Google Ads, etc.)
  - [ ] Social media cookies (share buttons)
  - [ ] Other: ___________

- CONSENT MANAGEMENT PLATFORM
  - [ ] None
  - [ ] Axeptio
  - [ ] Didomi
  - [ ] Cookiebot
  - [ ] Other: ___________

### 7. Retention Periods

| Data Type | Proposed Duration | Justification |
|-----------|-------------------|---------------|
| Active customer account | Duration of relationship |  |
| Inactive customer account | 3 years after last activity | Prospecting |
| Prospects | 3 years without interaction | CNIL recommendation |
| Invoices | 10 years | Legal obligation |
| Connection logs | 1 year | LCEN |
| Cookies | 13 months max | CNIL recommendation |

---

## Drafting Workflow

### Step 1: Template Selection (MANDATORY)

> **NEVER DRAFT A POLICY FROM SCRATCH.**
> Always start from a given template for drafting, either:
> - the default template in `assets/sample_template_politique_confidentialite.docx`;
> - another internal template provided by the user.
>
> This template is your base reference. You must:
> - **Faithfully reproduce the template's structure and wording**
> - **Keep the exact template phrasing** (they are validated)
> - **Only replace placeholders** with client information
> - **Do NOT rewrite sentences** even if you think you can phrase them better
> - **Do NOT add sections** that are not in the template
>
> The collected information (T&Cs, site, etc.) is used to **fill in** the template, **not to rewrite it**.

**1. FIRST ACTION: Confirm the template to use BEFORE any drafting. Ask the user:**
```
"I will draft the privacy policy starting from the provided default template. Do you have an internal template that would be more suitable as a starting point?"
```

| Option | Action |
|--------|--------|
| Default template | Use `assets/sample_template_