[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRkaFSu4LFUUiBT9JBGP_0ANq-MMcVxZ6Up0dT_UBkWQ":3},{"assets":4,"aiSystems":5,"attachments":6,"tags":7,"dataRetentionRules":17,"creatorUser":175,"creatorUserId":22,"updatedBy":176,"updatedById":22,"publishedBy":24,"publishedById":24,"areaOwnerId":24,"owners":177,"customFields":178,"area":179,"entity":183,"mergedFrom":24,"workflowStep":184,"accountables":190,"responsibles":191,"informedOwners":192,"securityMeasures":193,"personCategories":381,"id":32,"source":50,"label":33,"state":189,"versionDescription":24,"processingType":39,"parentId":24,"areaId":38,"mergeType":24,"readonly":25,"editable":188,"workflowStepId":185,"dateDeployment":24,"dateCreation":37,"dateArchived":24,"datePublication":24,"archived":25,"dateUpdate":36,"reviewDate":24,"nextReviewDate":24,"ref":24,"processingState":24,"description":34,"descriptionHtml":399,"subjectRightProcessDescription":24,"rightOfInformation":400,"rightOfAccess":401,"rightOfRectification":401,"rightOfErasure":401,"rightOfRestriction":401,"rightOfOpposition":400,"rightOfDataPortability":401,"advanceDirectives":401,"advanceDirectivesDescription":24,"rightOfInformationDescription":402,"rightOfAccessDescription":24,"rightOfRectificationDescription":24,"rightOfErasureDescription":24,"rightOfRestrictionDescription":24,"rightOfOppositionDescription":403,"rightOfDataPortabilityDescription":24,"stakeHolders":404,"assessmentScoring":25,"automaticDecision":25,"systematicMonitoring":25,"specialCategoryData":25,"largeScaleCollection":25,"crossReferencing":25,"vulnerablePeople":25,"isDPIARequired":25,"dpiaDate":24,"dpiaExemption":25,"dpiaExemptionJustification":24,"innovativeUse":25,"exclusionBenefitRightContract":25,"recipients":405,"dataControllers":455,"purposes":456,"progression":480,"quality":481,"sensitivity":482,"visible":188,"workspaceId":35,"nbReferences":27,"referenceId":24},[],[],[],[8,13],{"id":9,"label":10,"type":11,"color":12},"99e6f156-5bd7-4bc1-94c7-7f416665cf20","Organisme : Privé","DataProcessing","#64748B",{"id":14,"label":15,"type":11,"color":16},"039e8266-e129-47c9-9989-f1878cbf9cf7","Fonction : Commercial et marketing","#B45309",[18,96,139],{"customFields":19,"tags":20,"creator":21,"readonly":25,"purposes":28,"dataProcessings":30,"dataFields":40,"asset":24,"subjectCategories":85,"id":86,"ref":24,"externalId":24,"externalLastSyncDate":24,"externalSource":24,"label":87,"description":24,"dateCreation":88,"dateUpdate":89,"baseActiveOverride":25,"intermediateArchivingOverride":25,"destructionOverride":25,"baseActiveDescription":90,"baseActiveLegalBasis":91,"baseActiveRetentionDuration":24,"baseActiveMinMax":24,"intermediateArchivingLegalBasis":24,"intermediateArchivingDescription":92,"intermediateArchivingRetentionDuration":24,"intermediateArchivingMinMax":24,"destructionDescription":93,"destructionLegalBasis":24,"dataSetSource":94,"sourceDescription":95,"assetId":24,"source":50},{},[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},1602,"bc4946f8-1de1-4b70-bb67-62a0ce536160",null,false,"#4DE034",0,[29],"19bf7be9-2369-40c2-b238-a9123311bffc",[31],{"id":32,"label":33,"ref":24,"description":34,"workspaceId":35,"archived":25,"dateUpdate":36,"dateCreation":37,"areaId":38,"processingType":39},"a20475c5-b93d-40cc-36cd-08df38010b74","Programme de fidélité","Ce modèle de traitement est relatif à la gestion d'un programme de fidélité : adhésion des clients, cumul et utilisation des points, attribution d'avantages, personnalisation des offres et communication auprès des adhérents.",68,"2026-11-03T07:46:59.4305091","2026-11-03T07:46:58.1367915",354,"Default",[41,51,60,66,72,79],{"id":42,"customFields":43,"ref":24,"archivingPolicy":24,"required":25,"label":44,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":46,"dataType":24,"dateCreation":47,"dateUpdate":24,"creator":48,"workflowStepId":49,"workflowStep":24,"source":50},"7c823bf6-c568-496f-028a-08df38010ba5",{},"Civilité, nom, prénom","Current","CivilStatus","2026-11-03T07:45:52.3583478",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},83450,"Api",{"id":52,"customFields":53,"ref":24,"archivingPolicy":24,"required":25,"label":54,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":55,"dataType":24,"dateCreation":56,"dateUpdate":57,"creator":24,"workflowStepId":58,"workflowStep":24,"source":59},"b05d36ab-7b23-42c5-a659-b806b3b26050",{},"Adresse postale","PersonalLife","2021-09-27T22:25:11.201927","2023-09-25T09:25:21.3319653",83451,"Intern",{"id":61,"customFields":62,"ref":24,"archivingPolicy":24,"required":25,"label":63,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":46,"dataType":24,"dateCreation":64,"dateUpdate":24,"creator":65,"workflowStepId":49,"workflowStep":24,"source":50},"a98d72f1-b4e9-4726-028c-08df38010ba5",{},"Adresse électronique et téléphone","2026-11-03T07:45:52.7520463",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":67,"customFields":68,"ref":24,"archivingPolicy":24,"required":25,"label":69,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":46,"dataType":24,"dateCreation":70,"dateUpdate":71,"creator":24,"workflowStepId":58,"workflowStep":24,"source":59},"039070e3-2f19-4fc7-b7b3-1c39b218a3d1",{},"Date de naissance","2021-01-18T22:33:53.1173564","2023-09-11T07:57:23.6513312",{"id":73,"customFields":74,"ref":24,"archivingPolicy":24,"required":25,"label":75,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":76,"dataType":24,"dateCreation":77,"dateUpdate":24,"creator":78,"workflowStepId":49,"workflowStep":24,"source":50},"0e356e8f-78af-4a87-02be-08df38010ba5",{},"Numéro de carte ou identifiant fidélité (code interne distinct de tout numéro de carte bancaire)","Other","2026-11-03T07:46:54.5019191",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":80,"customFields":81,"ref":24,"archivingPolicy":24,"required":25,"label":82,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":76,"dataType":24,"dateCreation":83,"dateUpdate":24,"creator":84,"workflowStepId":49,"workflowStep":24,"source":50},"0cf3476c-7f45-4362-02bf-08df38010ba5",{},"Date d'adhésion et statut du compte","2026-11-03T07:46:54.6953514",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},[],"3c145c7f-bfdc-437a-df25-08df38010b98","Adhésion et compte fidélité","2026-11-03T07:46:56.3040251","2026-11-03T07:46:56.7104166","Durée de la relation contractuelle, c'est-à-dire tant que le client est adhérent actif. Un délai d'inactivité (par exemple 2 ans sans achat ni connexion) est à fixer par le responsable de traitement, avec avertissement préalable du client.","Exécution du contrat (art. 6.1.b du RGPD), puis intérêt légitime ou obligation légale pour l'archivage.","Archivage intermédiaire après la fin de l'adhésion si nécessaire à des fins de preuve, dans la limite du délai de prescription applicable.","À l'issue de la durée de conservation, les données sont supprimées de manière sécurisée ou anonymisées de façon irréversible.","Direct","Recommandation CNIL : données de gestion du contrat conservées pendant la durée de la relation contractuelle, puis archivage intermédiaire limité au délai de prescription. Le référentiel ne chiffre pas l'inactivité d'un programme de fidélité ; la durée de 2 ans qu'il juge proportionnée vise les comptes en ligne inactifs et ne vaut ici que par analogie.",{"customFields":97,"tags":98,"creator":99,"readonly":25,"purposes":100,"dataProcessings":102,"dataFields":104,"asset":24,"subjectCategories":130,"id":131,"ref":24,"externalId":24,"externalLastSyncDate":24,"externalSource":24,"label":132,"description":24,"dateCreation":133,"dateUpdate":134,"baseActiveOverride":25,"intermediateArchivingOverride":25,"destructionOverride":25,"baseActiveDescription":135,"baseActiveLegalBasis":136,"baseActiveRetentionDuration":24,"baseActiveMinMax":24,"intermediateArchivingLegalBasis":24,"intermediateArchivingDescription":137,"intermediateArchivingRetentionDuration":24,"intermediateArchivingMinMax":24,"destructionDescription":93,"destructionLegalBasis":24,"dataSetSource":94,"sourceDescription":138,"assetId":24,"source":50},{},[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},[29,101],"de5f09cc-18ab-45b9-a0d8-998f82edd3ef",[103],{"id":32,"label":33,"ref":24,"description":34,"workspaceId":35,"archived":25,"dateUpdate":36,"dateCreation":37,"areaId":38,"processingType":39},[105,112,118,124],{"id":106,"customFields":107,"ref":24,"archivingPolicy":24,"required":25,"label":108,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":109,"dataType":24,"dateCreation":110,"dateUpdate":24,"creator":111,"workflowStepId":49,"workflowStep":24,"source":50},"af2554b6-d99b-48ed-02c0-08df38010ba5",{},"Historique des achats rattachés à la carte","EconomicFinancialData","2026-11-03T07:46:54.9444578",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":113,"customFields":114,"ref":24,"archivingPolicy":24,"required":25,"label":115,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":109,"dataType":24,"dateCreation":116,"dateUpdate":24,"creator":117,"workflowStepId":49,"workflowStep":24,"source":50},"5de335c2-ab62-4ad9-02c1-08df38010ba5",{},"Solde et mouvements de points","2026-11-03T07:46:55.122108",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":119,"customFields":120,"ref":24,"archivingPolicy":24,"required":25,"label":121,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":109,"dataType":24,"dateCreation":122,"dateUpdate":24,"creator":123,"workflowStepId":49,"workflowStep":24,"source":50},"ca26efd1-7863-4d58-02c2-08df38010ba5",{},"Avantages et récompenses utilisés","2026-11-03T07:46:55.2980944",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":125,"customFields":126,"ref":24,"archivingPolicy":24,"required":25,"label":127,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":55,"dataType":24,"dateCreation":128,"dateUpdate":24,"creator":129,"workflowStepId":49,"workflowStep":24,"source":50},"89c17d4b-8304-435f-02c3-08df38010ba5",{},"Segment ou profil de préférences issu des achats","2026-11-03T07:46:55.4531831",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},[],"d72b756c-3649-434b-df26-08df38010b98","Points, achats et avantages","2026-11-03T07:46:56.9087241","2026-11-03T07:46:57.3381048","Durée de la relation contractuelle ; pour la personnalisation, jusqu'au retrait du consentement ou à l'exercice du droit d'opposition.","Exécution du contrat ; consentement ou intérêt légitime pour la personnalisation.","","Recommandation CNIL : durée de la relation contractuelle pour l'exécution du contrat ; jusqu'au retrait du consentement ou à l'exercice du droit d'opposition pour les finalités fondées sur ces bases. Aucune durée chiffrée n'est imposée.",{"customFields":140,"tags":141,"creator":142,"readonly":25,"purposes":143,"dataProcessings":145,"dataFields":147,"asset":24,"subjectCategories":166,"id":167,"ref":24,"externalId":24,"externalLastSyncDate":24,"externalSource":24,"label":168,"description":24,"dateCreation":169,"dateUpdate":170,"baseActiveOverride":25,"intermediateArchivingOverride":25,"destructionOverride":25,"baseActiveDescription":171,"baseActiveLegalBasis":172,"baseActiveRetentionDuration":173,"baseActiveMinMax":24,"intermediateArchivingLegalBasis":24,"intermediateArchivingDescription":137,"intermediateArchivingRetentionDuration":24,"intermediateArchivingMinMax":24,"destructionDescription":93,"destructionLegalBasis":24,"dataSetSource":94,"sourceDescription":174,"assetId":24,"source":50},{},[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},[144],"e80c0370-cbbc-4e97-b657-26f34d17e281",[146],{"id":32,"label":33,"ref":24,"description":34,"workspaceId":35,"archived":25,"dateUpdate":36,"dateCreation":37,"areaId":38,"processingType":39},[148,154,160],{"id":149,"customFields":150,"ref":24,"archivingPolicy":24,"required":25,"label":151,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":55,"dataType":24,"dateCreation":152,"dateUpdate":24,"creator":153,"workflowStepId":49,"workflowStep":24,"source":50},"a92d24ec-cfd4-414f-02c4-08df38010ba5",{},"Préférences de communication et canaux acceptés","2026-11-03T07:46:55.6455674",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":155,"customFields":156,"ref":24,"archivingPolicy":24,"required":25,"label":157,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":76,"dataType":24,"dateCreation":158,"dateUpdate":24,"creator":159,"workflowStepId":49,"workflowStep":24,"source":50},"668f2d6e-96e5-47b8-02c5-08df38010ba5",{},"Preuve du consentement (date, support)","2026-11-03T07:46:55.803745",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":161,"customFields":162,"ref":24,"archivingPolicy":24,"required":25,"label":163,"definition":24,"technicalDefinition":24,"sensitiveDataFieldLegalJustification":24,"sensitiveDataFieldLegalJustificationDescription":24,"sensitiveData":25,"sensitivityClassification":45,"personalDataCategory":76,"dataType":24,"dateCreation":164,"dateUpdate":24,"creator":165,"workflowStepId":49,"workflowStep":24,"source":50},"9f2d4ae4-bc64-4f06-02c6-08df38010ba5",{},"Historique des messages reçus","2026-11-03T07:46:55.9926726",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},[],"85af5354-085d-49aa-df27-08df38010b98","Prospection auprès des adhérents","2026-11-03T07:46:57.5325533","2026-11-03T07:46:57.9506731","Pendant la relation commerciale, puis 3 ans à compter de la fin de la relation (dernier achat ou dernier contact du client) ; jusqu'au retrait du consentement lorsqu'il est la base.","Consentement ou intérêt légitime selon le canal.",1576800,"Recommandation CNIL (référentiel gestion des activités commerciales, point 7) : données clients utilisées pour la prospection conservées pendant la relation commerciale puis 3 ans à compter de sa fin. Recommandation non contraignante.",{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},[],{},{"dpo":24,"referent":24,"owner":24,"representative":24,"dataProtectionAuthority":24,"id":38,"type":180,"parentId":24,"ref":24,"label":181,"description":24,"logoUrl":24,"address":24,"zipCode":24,"city":24,"region":24,"countryCode":182,"immatriculationNumber":24,"phoneNumber":24,"mailAddress":24,"dpoId":24,"referentId":24,"ownerId":24,"representativeId":24,"dataProtectionAuthorityId":24},"Entity","Entité","FR",{"dpo":24,"referent":24,"owner":24,"representative":24,"dataProtectionAuthority":24,"id":38,"type":180,"parentId":24,"ref":24,"label":181,"description":24,"logoUrl":24,"address":24,"zipCode":24,"city":24,"region":24,"countryCode":182,"immatriculationNumber":24,"phoneNumber":24,"mailAddress":24,"dpoId":24,"referentId":24,"ownerId":24,"representativeId":24,"dataProtectionAuthorityId":24},{"id":185,"label":186,"color":187,"order":27,"itemLimit":24,"type":11,"finalStep":25,"initialStep":188,"authorizedRole":24,"authorizedRoleId":24,"descriptionHtml":24,"mappedState":189},9439,"A compléter","#CCCCCC",true,"Draft",[],[],[],[194,208,220,231,244,255,266,276,286,297,308,318,328,339,350,361,371],{"date":195,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":197,"id":198,"ref":24,"label":199,"type":200,"description":201,"relatedRisk":24,"moreDetailsUrl":202,"dateCreation":203,"dateUpdate":24,"tags":204,"attachments":205,"creatorUser":206,"workflowStepId":207,"workflowStep":24},"2026-11-03T11:37:36.3097046Z","Done",{},"beba9da4-69b2-451b-69b0-08df38010b92","Pilotage de la sécurité des données","Organizational","L’intégration de la protection des données personnelles dans les processus de décision de l’organisme permet d’en assurer la prise en compte dans la durée et aux moments clés d’arbitrages des budgets et des projets. Les précautions élémentaires Impliquer la direction et formaliser des objectifs généraux en matière de sécurité et de protection des données personnelles, validés par la direction de l’organisme.","https://www.cnil.fr/fr/securite-piloter-la-securite-des-donnees","2026-11-02T20:57:37.2709862",[],[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},90384,{"date":209,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":210,"id":211,"ref":24,"label":212,"type":200,"description":213,"relatedRisk":24,"moreDetailsUrl":214,"dateCreation":215,"dateUpdate":216,"tags":217,"attachments":218,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097087Z",{},"cde1cad2-4195-4ffe-9406-08dd823909d1","Cadre d'usage des utilisateurs","La charte doit rappeler les règles de protection des données et les sanctions possibles, définir son champ d’application (interventions informatiques, moyens d’authentification) et énoncer les règles de sécurité : signaler toute tentative d’intrusion, garder ses identifiants secrets, ne pas installer ni modifier de logiciels sans autorisation, verrouiller son poste en cas d’absence, n’accéder qu’aux informations utiles et respecter la procédure pour copier des données sur supports amovibles. Elle précise aussi les conditions d’usage des équipements informatiques et télécoms (poste de travail, matériels nomades, stockage, réseaux, appareils personnels, Internet, messagerie, téléphonie), les modalités d’administration du système (filtrage, traçabilité, gestion des postes) ainsi que les responsabilités et sanctions en cas de manquement.","https://www.cnil.fr/fr/securite-definir-un-cadre-pour-les-utilisateurs","2025-04-25T07:14:13.031896","2026-11-02T20:57:14.658541",[],[],90385,{"date":221,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":222,"id":223,"ref":24,"label":224,"type":200,"description":225,"relatedRisk":24,"moreDetailsUrl":226,"dateCreation":227,"dateUpdate":228,"tags":229,"attachments":230,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097094Z",{},"d77a94b8-cd42-409c-a02e-323ffad3924a","Sensibilisation et formation des utilisateurs","Les erreurs humaines et les attaques par ingénierie sociale sont à l’origine d’un nombre important d’incidents de sécurité. Les solutions techniques ne sont pas suffisantes pour assurer la protection des données personnelles détenues par un organisme.","https://www.cnil.fr/fr/securite-impliquer-et-former-les-utilisateurs","2019-01-01T00:00:00","2026-11-02T20:57:16.1776695",[],[],{"date":232,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":233,"id":234,"ref":24,"label":235,"type":236,"description":237,"relatedRisk":238,"moreDetailsUrl":239,"dateCreation":240,"dateUpdate":241,"tags":242,"attachments":243,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097103Z",{},"6c2ddc74-6750-4e76-bdad-317c6c0305ce","Authentification des utilisateurs","Technical","Avant toute utilisation des moyens informatiques, un utilisateur doit être doté d’un identifiant qui lui est propre et doit s’authentifier afin de permettre de contrôler son identité et ses accès aux données dont il a besoin. Les mécanismes permettant de réaliser l’authentification des personnes sont catégorisés selon qu’ils font intervenir :","Accès non autorisé, mots de passe partagés.","https://www.cnil.fr/fr/securite-authentifier-les-utilisateurs","2021-10-19T15:35:32.3166158","2026-11-02T20:57:18.0371731",[],[],{"date":245,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":246,"id":247,"ref":24,"label":248,"type":200,"description":249,"relatedRisk":24,"moreDetailsUrl":250,"dateCreation":251,"dateUpdate":252,"tags":253,"attachments":254,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097109Z",{},"f54ac346-ee7b-45de-9cc0-39506032df7e","Gestion des habilitations","Respecter le principe de moindre privilège, à travers la gestion des profils d’habilitation, permet de limiter les conséquences d’une usurpation de comptes ou d’une erreur de manipulation.","https://www.cnil.fr/fr/securite-gerer-les-habilitations","2021-10-19T15:35:32.1054015","2026-11-02T20:57:19.3398542",[],[],{"date":256,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":257,"id":258,"ref":24,"label":259,"type":236,"description":260,"relatedRisk":24,"moreDetailsUrl":261,"dateCreation":262,"dateUpdate":263,"tags":264,"attachments":265,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097123Z",{},"f748340f-fe32-47c4-983c-135130915929","Sécurité des postes de travail","Les risques d’intrusion dans les systèmes informatiques sont multiples et les postes de travail constituent un des principaux points d’entrée.","https://www.cnil.fr/fr/securite-securiser-les-postes-de-travail","2021-12-15T14:06:35.2861825","2026-11-02T20:57:20.9746731",[],[],{"date":267,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":268,"id":269,"ref":24,"label":270,"type":236,"description":271,"relatedRisk":24,"moreDetailsUrl":272,"dateCreation":227,"dateUpdate":273,"tags":274,"attachments":275,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097138Z",{},"ac192187-f8f9-42aa-9111-814f4a321407","Protection du réseau informatique","Le réseau interne interconnecte l’ensemble des composants des systèmes d’information d’un organisme et dispose souvent de points de connexion avec l’extérieur. Il s’agit tout autant d’un point d’entrée que d’un support de propagation des attaques. Il est donc primordial de sécuriser le réseau interne.","https://www.cnil.fr/fr/securite-proteger-le-reseau-informatique","2026-11-02T20:57:22.9977424",[],[],{"date":277,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":278,"id":279,"ref":24,"label":280,"type":236,"description":281,"relatedRisk":24,"moreDetailsUrl":282,"dateCreation":227,"dateUpdate":283,"tags":284,"attachments":285,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097144Z",{},"ed9bf5c2-97d3-4505-9b42-adabf6e7bd1d","Sécurité des serveurs","La sécurité des serveurs doit être une priorité car ils centralisent un grand nombre de données et hébergent les services permettant d’y accéder et de les manipuler. Les précautions élémentaires Désinstaller ou désactiver les services et interfaces inutiles. Limiter l’accès aux outils et interfaces d’administration aux seules personnes habilitées. Utiliser des comptes de moindres privilèges pour les opérations courantes.","https://www.cnil.fr/fr/securite-securiser-les-serveurs","2026-11-02T20:57:24.1598199",[],[],{"date":287,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":288,"id":289,"ref":24,"label":290,"type":291,"description":292,"relatedRisk":24,"moreDetailsUrl":293,"dateCreation":227,"dateUpdate":294,"tags":295,"attachments":296,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097153Z",{},"56e975ff-1611-4612-b85c-c7efcdd47c2c","Protection des locaux","Physical","L’accès aux locaux doit être contrôlé pour éviter ou ralentir un accès direct, non autorisé, que ce soit aux fichiers papier ou aux matériels informatiques, notamment aux serveurs. Les locaux doivent également être protégés contre les autres types de menaces (ex. : incendie, inondation). Les précautions élémentaires Restreindre les accès aux locaux au moyen de portes verrouillées. Installer des alarmes anti-intrusion et les vérifier périodiquement leur bon fonctionnement périodiquement.","https://www.cnil.fr/fr/securite-proteger-les-locaux","2026-11-02T20:57:28.139351",[],[],{"date":298,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":299,"id":300,"ref":24,"label":301,"type":200,"description":302,"relatedRisk":24,"moreDetailsUrl":303,"dateCreation":304,"dateUpdate":24,"tags":305,"attachments":306,"creatorUser":307,"workflowStepId":207,"workflowStep":24},"2026-11-03T11:37:36.3097161Z",{},"637227f2-e809-4991-69b1-08df38010b92","Encadrement de la maintenance et de la fin de vie des matériels et logiciels","Les opérations de support doivent être encadrées pour maitriser l’accès aux données par les prestataires. Les données doivent être préalablement effacées des matériels destinés à être mis au rebut.","https://www.cnil.fr/fr/securite-encadrer-la-maintenance-et-la-fin-de-vie-des-materiels-et-logiciels","2026-11-02T20:57:38.8686714",[],[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"date":309,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":310,"id":311,"ref":24,"label":312,"type":236,"description":313,"relatedRisk":24,"moreDetailsUrl":314,"dateCreation":227,"dateUpdate":315,"tags":316,"attachments":317,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097169Z",{},"c8b527e2-07bc-4677-8c00-d222be26d357","Traçabilité des opérations","Afin de pouvoir identifier un accès frauduleux ou une utilisation abusive de données personnelles, ou de déterminer l’origine d’un incident, il convient d’enregistrer certaines des actions effectuées sur les systèmes informatiques. Les traces alors collectées sont également des éléments de preuve utiles pour la démonstration de la conformité.","https://www.cnil.fr/fr/securite-tracer-les-operations","2026-11-02T20:57:33.4681365",[],[],{"date":319,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":320,"id":321,"ref":24,"label":322,"type":236,"description":323,"relatedRisk":24,"moreDetailsUrl":324,"dateCreation":227,"dateUpdate":325,"tags":326,"attachments":327,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097178Z",{},"cae348c2-e9f2-4e49-8d60-ab56e438d5a4","Sauvegarde","Des copies de sauvegarde doivent être réalisées et testées régulièrement pour être disponibles en cas de besoin. Les précautions élémentaires S’agissant de la sauvegarde des données","https://www.cnil.fr/fr/securite-sauvegarder","2026-11-02T20:57:34.7827534",[],[],{"date":329,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":330,"id":331,"ref":24,"label":332,"type":236,"description":333,"relatedRisk":24,"moreDetailsUrl":334,"dateCreation":335,"dateUpdate":24,"tags":336,"attachments":337,"creatorUser":338,"workflowStepId":207,"workflowStep":24},"2026-11-03T11:37:36.3097184Z",{},"6eddff0a-1378-4160-69b2-08df38010b92","Continuité et reprise d'activité","Pour limiter le temps d’indisponibilité du système, il faut anticiper les incidents les plus courants. Assurer la continuité d’activité consiste à prévoir des moyens de continuer de fonctionner, en général de manière dégradée, malgré des dysfonctionnements. La reprise d’activité, quant à elle, englobe toutes les actions nécessaires pour relancer un système arrêté.","https://www.cnil.fr/fr/securite-prevoir-la-continuite-et-la-reprise-dactivite","2026-11-02T20:57:39.8112993",[],[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"date":340,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":341,"id":342,"ref":24,"label":343,"type":200,"description":344,"relatedRisk":24,"moreDetailsUrl":345,"dateCreation":346,"dateUpdate":24,"tags":347,"attachments":348,"creatorUser":349,"workflowStepId":207,"workflowStep":24},"2026-11-03T11:37:36.309719Z",{},"10c6151c-c44c-46df-69b3-08df38010b92","Gestion des incidents et des violations","Il convient d’être préparé à l’éventualité d’un incident pour intervenir à temps et de manière appropriée, en intégrant l’objectif de limiter les effets pour les personnes dont les données sont concernées. Le responsable de traitement peut être amené à notifier la CNIL ou informer les personnes concernées de l’incident en fonction du risque pour celles-ci.","https://www.cnil.fr/fr/securite-gerer-les-incidents-et-les-violations","2026-11-02T20:57:40.7676498",[],[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"date":351,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":352,"id":353,"ref":24,"label":354,"type":200,"description":355,"relatedRisk":24,"moreDetailsUrl":356,"dateCreation":357,"dateUpdate":24,"tags":358,"attachments":359,"creatorUser":360,"workflowStepId":207,"workflowStep":24},"2026-11-03T11:37:36.3097196Z",{},"e064565b-514e-4755-69b4-08df38010b92","Analyse de risques","En parallèle de la mise en conformité aux précautions élémentaires présentées dans ce guide, il est pertinent, voire obligatoire selon la criticité des traitements, de réaliser des analyses de risques relative à la protection des données. Ces analyses permettent de décider des mesures de sécurité complémentaires, adaptées au contexte, permettant de limiter l’impact sur les personnes concernées par le traitement.","https://www.cnil.fr/fr/securite-analyse-de-risques","2026-11-02T20:57:42.2940193",[],[],{"id":22,"displayName":23,"familyName":24,"givenName":24,"email":23,"active":25,"color":26,"avatarUrl":24,"tenantId":27},{"date":362,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":363,"id":364,"ref":24,"label":365,"type":200,"description":366,"relatedRisk":24,"moreDetailsUrl":367,"dateCreation":227,"dateUpdate":368,"tags":369,"attachments":370,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097203Z",{},"47c52bcb-a6e9-487b-a958-f027b20dbd87","Encadrement de la sous-traitance","Les traitements de données réalisés par un sous-traitant pour le compte du responsable de traitement doivent bénéficier de garanties suffisantes, notamment en matière de sécurité.","https://www.cnil.fr/fr/securite-gerer-la-sous-traitance","2026-11-02T20:57:31.4211019",[],[],{"date":372,"state":196,"descriptionHtml":24,"readonly":25,"purposes":24,"customFields":373,"id":374,"ref":24,"label":375,"type":200,"description":376,"relatedRisk":24,"moreDetailsUrl":377,"dateCreation":227,"dateUpdate":378,"tags":379,"attachments":380,"creatorUser":24,"workflowStepId":219,"workflowStep":24},"2026-11-03T11:37:36.3097209Z",{},"49230bff-1cd3-46bd-85f5-e43809136dc9","Sécurité des échanges avec l'extérieur","Sans mesure complémentaire, les canaux de transmission de données grand public (ex. : messagerie électronique, messagerie instantanée, plateforme de dépôt de fichiers) constituent rarement un moyen de communication sûr pour transmettre des données personnelles. Une simple erreur d’inattention peut conduire des personnes non habilitées à prendre connaissance de données personnelles, ce qui porte atteinte au droit à la vie privée des personnes concernées.","https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-lexterieur","2026-11-02T20:57:29.3610605",[],[],[382,391],{"subjectCategory":383,"displayName":385,"id":389,"subjectCategoryId":384,"comment":24,"dataSubjectVolumeMax":24,"readonly":25,"purposes":390},{"id":384,"label":385,"ref":24,"dateCreation":386,"dateUpdate":24,"creatorUserId":24,"creatorUser":24,"description":24,"minorConcerned":25,"workflowStepId":387,"workflowStep":24,"dataRetentionRules":388},"983407ad-24f5-48b6-268b-08dac757bbf1","Clients","2022-11-15T22:21:36.912217",97319,[],"08070e5a-3d30-4c68-e6f1-08df38010be0",[],{"subjectCategory":392,"displayName":394,"id":397,"subjectCategoryId":393,"comment":24,"dataSubjectVolumeMax":24,"readonly":25,"purposes":398},{"id":393,"label":394,"ref":24,"dateCreation":395,"dateUpdate":24,"creatorUserId":24,"creatorUser":24,"description":24,"minorConcerned":25,"workflowStepId":387,"workflowStep":24,"dataRetentionRules":396},"cfe84374-765b-44fd-268c-08dac757bbf1","Anciens clients","2022-11-15T22:21:37.4944855",[],"724c3d1c-9611-43f5-e6f2-08df38010be0",[],"\u003Cblockquote>\u003Cp>\u003Cstrong>Modèle à adapter\u003C/strong>\u003C/p>\u003Cp>Modèle de traitement fourni à titre indicatif, à adapter à votre organisation. Les finalités, les données, les durées de conservation, les destinataires, les mesures de sécurité et l'analyse d'impact y sont des valeurs de départ, établies à partir des textes et référentiels cités ci-dessous. \u003Cstrong>Ce modèle ne constitue pas un avis juridique\u003C/strong> : faites-le valider par votre DPO ou votre conseil.\u003C/p>\u003C/blockquote>\u003Cblockquote>\u003Cp>\u003Cstrong>Point d'attention\u003C/strong> : Le référentiel CNIL cite la fidélité comme finalité mais ne fixe pas de durée spécifique en cas d'inactivité : la durée de 2 ans de la CNIL vise les comptes en ligne et n'est reprise ici que par analogie.\u003C/p>\u003C/blockquote>\u003Ch3>Sources\u003C/h3>\u003Cp>\u003Cem>Classement selon le guide pratique CNIL « Les durées de conservation ».\u003C/em>\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Doctrine CNIL (durée recommandée)\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/sites/cnil/files/atoms/files/referentiel_traitements-donnees-caractere-personnel_gestion-activites-commerciales.pdf\">CNIL, Référentiel relatif aux traitements de données à caractère personnel mis en oeuvre aux fins de gestion des activités commerciales\u003C/a>. Finalité « gestion de programmes de fidélité », y compris multi-entités (information sur le ou les responsables et l'étendue du programme) ; bases légales par finalité ; profilage limité aux données collectées directement ; durées (relation contractuelle, 3 ans pour la prospection, 2 ans pour les comptes en ligne inactifs).\u003C/li>\u003Cli>\u003Cstrong>Doctrine CNIL\u003C/strong> : \u003Ca href=\"https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookies/FAQ\">CNIL, Questions-réponses sur les lignes directrices modificatives et la recommandation « cookies et autres traceurs »\u003C/a>. Tout site doit proposer un moyen de refuser les traceurs, aussi facile qu'accepter ; la poursuite de la navigation s'interprète comme un refus ; conservation des choix pendant 6 mois présentée comme une bonne pratique ; le reciblage par courriel d'un panier abandonné nécessite le consentement ; l'information doit mentionner tous les responsables conjoints.\u003C/li>\u003C/ul>","Automatic","ManualOrOnDemand","Les personnes sont informées au moment de la collecte (art. 13 du RGPD) ou, en cas de collecte indirecte, au plus tard dans un délai d'un mois (art. 14).","Lien de désinscription dans chaque message de prospection (art. 21.2 et 21.3 du RGPD).",[],[406,414,420,435,442,449],{"purposes":407,"dataRetentionRules":24,"parentId":24,"children":408,"displayName":409,"label":409,"transfers":410,"recipientType":411,"type":412,"jobTitle":24,"id":413,"actorId":24,"actor":24,"areaId":24,"area":24,"description":24,"readonly":25},[],[],"Service marketing et fidélisation",[],"InternalService","Recipient","b05cc88b-380c-487d-a112-08df38010bcb",{"purposes":415,"dataRetentionRules":24,"parentId":24,"children":416,"displayName":417,"label":417,"transfers":418,"recipientType":411,"type":412,"jobTitle":24,"id":419,"actorId":24,"actor":24,"areaId":24,"area":24,"description":24,"readonly":25},[],[],"Service client",[],"95f300a0-82ab-4ee6-a113-08df38010bcb",{"purposes":421,"dataRetentionRules":24,"parentId":24,"children":422,"displayName":423,"label":424,"transfers":425,"recipientType":426,"type":412,"jobTitle":24,"id":427,"actorId":428,"actor":429,"areaId":24,"area":24,"description":24,"readonly":25},[],[],"Sous-traitant à préciser","Prestataire de gestion du programme et de la base clients (sous-traitant)",[],"Vendor","57ac79fa-3d74-40c6-a114-08df38010bcb","1af96d46-eb9e-45f3-64bc-08df38010bd1",{"label":423,"id":428,"ref":24,"dateCreation":430,"dateUpdate":24,"reviewDate":24,"nextReviewDate":24,"logoUrl":24,"state":431,"actorType":432,"description":433,"countryCode":24,"readonly":25,"email":24,"phoneNumber":24,"contactName":24,"contactPosition":24,"immatriculationNumber":24,"websiteUrl":24,"address":24,"zipCode":24,"city":24,"region":24,"workflowStepId":434,"areaId":24,"source":50},"2026-11-02T20:57:51.2801474","New","Morale","Acteur générique des modèles de traitement : à remplacer par le prestataire retenu (sous-traitant au sens de l'article 28 du RGPD).",76516,{"purposes":436,"dataRetentionRules":24,"parentId":24,"children":437,"displayName":423,"label":438,"transfers":439,"recipientType":426,"type":412,"jobTitle":24,"id":440,"actorId":428,"actor":441,"areaId":24,"area":24,"description":24,"readonly":25},[],[],"Prestataire d'envoi de messages (sous-traitant)",[],"2b2f3cb5-ce20-4d4d-a115-08df38010bcb",{"label":423,"id":428,"ref":24,"dateCreation":430,"dateUpdate":24,"reviewDate":24,"nextReviewDate":24,"logoUrl":24,"state":431,"actorType":432,"description":433,"countryCode":24,"readonly":25,"email":24,"phoneNumber":24,"contactName":24,"contactPosition":24,"immatriculationNumber":24,"websiteUrl":24,"address":24,"zipCode":24,"city":24,"region":24,"workflowStepId":434,"areaId":24,"source":50},{"purposes":443,"dataRetentionRules":24,"parentId":24,"children":444,"displayName":445,"label":445,"transfers":446,"recipientType":447,"type":412,"jobTitle":24,"id":448,"actorId":24,"actor":24,"areaId":24,"area":24,"description":24,"readonly":25},[],[],"Enseignes partenaires du programme (responsables conjoints si programme multi-entités)",[],"JointController","637387c2-b9fe-4790-a116-08df38010bcb",{"purposes":450,"dataRetentionRules":24,"parentId":24,"children":451,"displayName":452,"label":452,"transfers":453,"recipientType":411,"type":412,"jobTitle":24,"id":454,"actorId":24,"actor":24,"areaId":24,"area":24,"description":24,"readonly":25},[],[],"Service comptabilité",[],"de034aa8-fb7d-4a35-a117-08df38010bcb",[],[457,463,469,473],{"id":458,"key":29,"label":459,"description":460,"legalBasis":461,"legalBasisText":462,"legalBasisDescription":24,"readonly":25},"d313a132-f9ba-4b21-10c1-08df38010b80","Gestion de l'adhésion et du compte fidélité","Inscrire le client au programme, tenir son compte, cumuler et déduire les points, délivrer les avantages. Base : exécution du contrat d'adhésion (le référentiel CNIL cite la gestion des programmes de fidélité parmi les traitements fondés sur le contrat, durée de la relation contractuelle).","Contract","Contrat ou mesures précontractuelles",{"id":464,"key":101,"label":465,"description":466,"legalBasis":467,"legalBasisText":468,"legalBasisDescription":24,"readonly":25},"a1671242-219d-492e-10c2-08df38010b80","Personnalisation des offres et avantages","Adapter les offres à l'historique d'achats du client, à partir des seules données collectées directement auprès de lui (le référentiel CNIL admet ce profilage). Base au choix du responsable de traitement : consentement ou intérêt légitime, selon l'intrusion de la personnalisation. Tout profilage à partir de traceurs ou de sources tierces sort du référentiel.","Consent","Consentement",{"id":470,"key":144,"label":471,"description":472,"legalBasis":467,"legalBasisText":468,"legalBasisDescription":24,"readonly":25},"77ae9985-9023-4b50-10c3-08df38010b80","Communication et prospection auprès des adhérents","Envoi d'offres et de messages sur le programme. Par voie électronique à des non-clients : consentement ; pour des produits analogues à ceux déjà achetés ou par voie postale : intérêt légitime possible (tableau du référentiel CNIL).",{"id":474,"key":475,"label":476,"description":477,"legalBasis":478,"legalBasisText":479,"legalBasisDescription":24,"readonly":25},"5fe56cc9-413a-4c2d-10c4-08df38010b80","908dd68b-213c-4cc4-b947-12c6d551af1f","Conservation à des fins de preuve et obligations comptables","Archivage des données nécessaires à la comptabilité ou à la défense en cas de litige, après la fin du programme pour le client.","LegitimateInterest","Intérêts légitimes du responsable du traitement ou d'un tiers",100,67,5]