{"id":427922,"date":"2026-06-29T21:34:14","date_gmt":"2026-06-29T19:34:14","guid":{"rendered":"https:\/\/reev.com\/data-processing-agreement-dpa-reev\/"},"modified":"2026-08-10T08:09:34","modified_gmt":"2026-08-10T06:09:34","slug":"data-processing-agreement-dpa-reev","status":"publish","type":"page","link":"https:\/\/reev.com\/fr\/data-processing-agreement-dpa-reev\/","title":{"rendered":"Data Processing Agreement (DPA) reev"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t
Home<\/a><\/div>\n\t\t<\/div>\n\t\t<\/div>\n\t\t<\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Data Processing
Agreement (DPA)<\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Mise \u00e0 jour : juillet 2026 <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Avertissement :<\/strong> Traduction du document original en allemand. En cas de divergence, d\u2019incoh\u00e9rence ou de conflit avec la version allemande, notamment en raison de retards de traduction, la version allemande pr\u00e9vaut.<\/span><\/p><\/div><\/div><\/div><\/div><\/div><\/div><\/section><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Le pr\u00e9sent Data Processing Agreement (ci-apr\u00e8s le \u00ab DPA \u00bb) s’applique entre reev GmbH, Sandstra\u00dfe 3, 80335 M\u00fcnchen (ci-apr\u00e8s le \u00ab Sous-traitant \u00bb) et le client concern\u00e9 qui recourt aux prestations du Sous-traitant et qui a conclu le contrat principal servant de fondement au pr\u00e9sent DPA (ci-apr\u00e8s le \u00ab Responsable du traitement \u00bb). Le DPA est int\u00e9gr\u00e9 par la conclusion du contrat principal ou par l’acceptation des conditions<\/span><\/span> g\u00e9n\u00e9rales du Sous-traitant et fait partie int\u00e9grante de la relation contractuelle entre les parties.<\/span><\/span>\u00a0<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

1. <\/strong>Dispositions g\u00e9n\u00e9rales<\/strong> <\/span><\/h3>

1.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>traite<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0au sens de\u00a0<\/span>l’art<\/span>. 4,\u00a0<\/span>point<\/span>\u00a08, et de\u00a0<\/span>l’art<\/span>. 28 du\u00a0<\/span>R\u00e8glement<\/span>\u00a0(UE) 2016\/679 \u2013\u00a0<\/span>R\u00e8glement<\/span>\u00a0<\/span>g\u00e9n\u00e9ral<\/span>\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0(RGPD). Le\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>r\u00e9git<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>droits<\/span>\u00a0et\u00a0<\/span>obligations<\/span>\u00a0des\u00a0<\/span>parties<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>cadre<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

2.2<\/b> Lorsque<\/span>\u00a0le\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>emploie<\/span>\u00a0le\u00a0<\/span>terme<\/span>\u00a0\u00ab\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00bb\u00a0<\/span>ou<\/span>\u00a0\u00ab\u00a0<\/span>traitement<\/span>\u00a0\u00bb (de\u00a0<\/span>donn\u00e9es<\/span>), il se\u00a0<\/span>fonde<\/span>\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>d\u00e9finition<\/span>\u00a0du \u00ab\u00a0<\/span>traitement<\/span>\u00a0\u00bb au sens de\u00a0<\/span>l’art<\/span>. 4,\u00a0<\/span>point<\/span>\u00a02, du RGPD.<\/span><\/span><\/p>

\u00a0<\/h3>

2. Objet du contrat<\/strong><\/h3>

L’objet<\/span>\u00a0du\u00a0<\/span>traitement<\/span>, la\u00a0<\/span>nature<\/span>\u00a0et la\u00a0<\/span>finalit\u00e9<\/span>\u00a0du\u00a0<\/span>traitement<\/span>, le type de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>ainsi<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>cat\u00e9gories<\/span>\u00a0de\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>d\u00e9finis<\/span>\u00a0\u00e0\u00a0<\/span>l’<\/span><\/span>Annexe<\/span>\u00a01<\/span><\/span><\/strong>\u00a0du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

\u00a0<\/h3>

3. Droits et obligations du Responsable du traitement<\/strong><\/h3>

3.1<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>est<\/span>\u00a0le responsable du\u00a0<\/span>traitement<\/span>\u00a0au sens de\u00a0<\/span>l’art<\/span>. 4,\u00a0<\/span>point<\/span>\u00a07, du RGPD\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>effectu\u00e9<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>son<\/span>\u00a0<\/span>compte<\/span>\u00a0par le Sous-<\/span>traitant<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>dispose<\/span>,\u00a0<\/span>conform\u00e9ment<\/span>\u00a0\u00e0 la\u00a0<\/span>clause<\/span>\u00a03, al. 5, du\u00a0<\/span>droit<\/span>\u00a0<\/span>d’attirer<\/span>\u00a0<\/span>l’attention<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>lorsqu’un<\/span>\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>qu’il<\/span>\u00a0<\/span>estime<\/span>\u00a0<\/span>juridiquement<\/span>\u00a0<\/span>inadmissible<\/span>\u00a0fait\u00a0<\/span>l’objet<\/span>\u00a0du\u00a0<\/span>contrat<\/span>\u00a0et\/<\/span>ou<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>instruction<\/span>.\u00a0<\/span><\/span><\/p>

3.2<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>est<\/span>, en\u00a0<\/span>sa<\/span>\u00a0<\/span>qualit\u00e9<\/span>\u00a0de responsable du\u00a0<\/span>traitement<\/span>, responsable du\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>droits<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>informe<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>lorsque<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0<\/span>font<\/span>\u00a0<\/span>valoir<\/span>\u00a0<\/span>aupr\u00e8s<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0<\/span>leurs<\/span>\u00a0<\/span>droits<\/span>\u00a0de\u00a0<\/span>personne<\/span>\u00a0<\/span>concern\u00e9e<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>cadre<\/span>\u00a0de\u00a0<\/span>ce<\/span>\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>effectu\u00e9<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>son<\/span>\u00a0<\/span>compte<\/span>.<\/span><\/span><\/p>

3.3<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0a le\u00a0<\/span>droit<\/span>\u00a0de\u00a0<\/span>donner<\/span>\u00a0\u00e0\u00a0<\/span>tout<\/span>\u00a0<\/span>moment<\/span>\u00a0au Sous-<\/span>traitant<\/span>\u00a0des\u00a0<\/span>instructions<\/span>\u00a0<\/span>compl\u00e9mentaires<\/span>\u00a0<\/span>concernant<\/span>\u00a0la\u00a0<\/span>nature<\/span>,\u00a0<\/span>l’\u00e9tendue<\/span>\u00a0et\u00a0<\/span>les<\/span>\u00a0<\/span>modalit\u00e9s<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>. Les\u00a0<\/span>instructions<\/span>\u00a0<\/span>doivent<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte) (par ex.\u00a0<\/span>courrier<\/span>\u00a0<\/span>\u00e9lectronique<\/span>).\u00a0<\/span><\/span><\/p>

3.4<\/b> Les\u00a0<\/span>dispositions<\/span>\u00a0relatives \u00e0\u00a0<\/span>une<\/span>\u00a0<\/span>\u00e9ventuelle<\/span>\u00a0<\/span>r\u00e9mun\u00e9ration<\/span>\u00a0des\u00a0<\/span>surco\u00fbts<\/span>\u00a0<\/span>occasionn\u00e9s<\/span>\u00a0au Sous-<\/span>traitant<\/span>\u00a0par\u00a0<\/span>les<\/span>\u00a0<\/span>instructions<\/span>\u00a0<\/span>compl\u00e9mentaires<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>demeurent<\/span>\u00a0<\/span>inchang\u00e9es<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

3.5<\/b> Le Responsable du traitement informe sans d\u00e9lai le Sous-traitant lorsqu’il constate des erreurs ou des irr\u00e9gularit\u00e9s en lien avec le traitement de donn\u00e9es \u00e0 caract\u00e8re personnel par le Sous-traitant.<\/span><\/p>

3.6<\/b> Dans le\u00a0<\/span>cas<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>obligation<\/span>\u00a0<\/span>d’information<\/span>\u00a0\u00e0\u00a0<\/span>l’\u00e9gard<\/span>\u00a0de\u00a0<\/span>tiers<\/span>\u00a0<\/span>existe<\/span>\u00a0en vertu des\u00a0<\/span>art.<\/span>\u00a033 et 34 du RGPD\u00a0<\/span>ou<\/span>\u00a0de\u00a0<\/span>toute<\/span>\u00a0<\/span>autre<\/span>\u00a0<\/span>obligation<\/span>\u00a0<\/span>l\u00e9gale<\/span>\u00a0de\u00a0<\/span>notification<\/span>\u00a0<\/span>applicable<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>, le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>est<\/span>\u00a0responsable de\u00a0<\/span>son<\/span>\u00a0<\/span>respect<\/span>.<\/span><\/span><\/p>

\u00a0<\/span><\/b><\/h3>

4. Obligations g\u00e9n\u00e9rales du Sous-traitant<\/span><\/b><\/h3>

4.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>traite<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>exclusivement<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>cadre<\/span>\u00a0des\u00a0<\/span>accords<\/span>\u00a0<\/span>conclus<\/span>\u00a0et\/<\/span>ou<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>instructions<\/span>\u00a0<\/span>compl\u00e9mentaires<\/span>\u00a0<\/span>\u00e9ventuellement<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>. En\u00a0<\/span>sont<\/span>\u00a0<\/span>except\u00e9es<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>dispositions<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0<\/span>qui<\/span>\u00a0<\/span>obligent<\/span>\u00a0le\u00a0<\/span>cas<\/span>\u00a0<\/span>\u00e9ch\u00e9ant<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0<\/span>traitement<\/span>\u00a0<\/span>diff\u00e9rent<\/span>. Dans\u00a0<\/span>un<\/span>\u00a0<\/span>tel<\/span>\u00a0<\/span>cas<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>communique<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>ces<\/span>\u00a0<\/span>exigences<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0avant le\u00a0<\/span>traitement<\/span>, sauf si le\u00a0<\/span>droit<\/span>\u00a0<\/span>concern\u00e9<\/span>\u00a0<\/span>interdit<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>telle<\/span>\u00a0<\/span>communication<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>motif<\/span>\u00a0important\u00a0<\/span>d’int\u00e9r\u00eat<\/span>\u00a0<\/span>public<\/span>. La\u00a0<\/span>finalit\u00e9<\/span>, la\u00a0<\/span>nature<\/span>\u00a0et\u00a0<\/span>l’\u00e9tendue<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>sont<\/span>\u00a0par\u00a0<\/span>ailleurs<\/span>\u00a0<\/span>d\u00e9termin\u00e9es<\/span>\u00a0<\/span>exclusivement<\/span>\u00a0par le\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0et\/<\/span>ou<\/span>\u00a0par\u00a0<\/span>les<\/span>\u00a0<\/span>instructions<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>. Tout\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>s’en<\/span>\u00a0<\/span>\u00e9cartant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>interdit<\/span>\u00a0au Sous-<\/span>traitant<\/span>, \u00e0\u00a0<\/span>moins<\/span>\u00a0<\/span>que<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>n’y<\/span>\u00a0<\/span>ait<\/span>\u00a0<\/span>consenti<\/span>\u00a0par\u00a0<\/span>\u00e9crit<\/span>.\u00a0<\/span><\/span><\/p>

4.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>effectue<\/span>\u00a0en\u00a0<\/span>principe<\/span>\u00a0le\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>dans<\/span>\u00a0des \u00c9tats\u00a0<\/span>membres<\/span>\u00a0de\u00a0<\/span>l’Union<\/span>\u00a0<\/span>europ\u00e9enne<\/span>\u00a0(UE)\u00a0<\/span>ou<\/span>\u00a0de\u00a0<\/span>l’Espace<\/span>\u00a0<\/span>\u00e9conomique<\/span>\u00a0<\/span>europ\u00e9en<\/span>\u00a0(EEE). Tout\u00a0<\/span>transfert<\/span>\u00a0<\/span>vers<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>pays<\/span>\u00a0<\/span>tiers<\/span>\u00a0<\/span>requiert<\/span>\u00a0le\u00a0<\/span>consentement<\/span>\u00a0<\/span>pr\u00e9alable<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0et ne\u00a0<\/span>peut<\/span>\u00a0<\/span>intervenir<\/span>\u00a0<\/span>que<\/span>\u00a0si\u00a0<\/span>les<\/span>\u00a0<\/span>conditions<\/span>\u00a0<\/span>particuli\u00e8res<\/span>\u00a0des\u00a0<\/span>art.<\/span>\u00a044 \u00e0 48 du RGPD\u00a0<\/span>sont<\/span>\u00a0<\/span>remplies<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>qu’une<\/span>\u00a0<\/span>d\u00e9rogation<\/span>\u00a0au sens de\u00a0<\/span>l’art<\/span>. 49 du RGPD\u00a0<\/span>est<\/span>\u00a0<\/span>applicable<\/span>.<\/span>\u00a0<\/span><\/span><\/p>

4.3<\/b><\/span><\/strong>\u00a0Le Sous-<\/span>traitant<\/span>\u00a0<\/span>informe<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>lorsqu’une<\/span>\u00a0<\/span>instruction<\/span>\u00a0<\/span>donn\u00e9e<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>enfreint<\/span>,\u00a0<\/span>selon<\/span>\u00a0<\/span>lui<\/span>, des\u00a0<\/span>dispositions<\/span>\u00a0<\/span>l\u00e9gales<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0en\u00a0<\/span>droit<\/span>\u00a0de\u00a0<\/span>suspendre<\/span>\u00a0<\/span>l’ex\u00e9cution<\/span>\u00a0de\u00a0<\/span>l’instruction<\/span>\u00a0<\/span>concern\u00e9e<\/span>\u00a0<\/span>jusqu’\u00e0<\/span>\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>celle<\/span>-ci\u00a0<\/span>soit<\/span>\u00a0<\/span>confirm\u00e9e<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>modifi\u00e9e<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>.\u00a0<\/span>Si<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>d\u00e9montrer<\/span>\u00a0<\/span>qu’un<\/span>\u00a0<\/span>traitement<\/span>\u00a0<\/span>effectu\u00e9<\/span>\u00a0<\/span>selon<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>instructions<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>susceptible<\/span>\u00a0<\/span>d’engager<\/span>\u00a0<\/span>sa<\/span>\u00a0<\/span>responsabilit\u00e9<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 82 du RGPD, le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>libre<\/span>\u00a0de\u00a0<\/span>suspendre<\/span>\u00a0la\u00a0<\/span>poursuite<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0\u00e0\u00a0<\/span>cet<\/span>\u00a0<\/span>\u00e9gard<\/span>\u00a0<\/span>jusqu’\u00e0<\/span>\u00a0<\/span>clarification<\/span>\u00a0de la\u00a0<\/span>responsabilit\u00e9<\/span>\u00a0entre\u00a0<\/span>les<\/span>\u00a0<\/span>parties<\/span>.<\/span><\/p>

\u00a0<\/h3>

5. D\u00e9l\u00e9gu\u00e9 \u00e0 la protection des donn\u00e9es du Sous-traitant<\/strong><\/h3>

5.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>confirme<\/span>\u00a0<\/span>avoir<\/span>\u00a0<\/span>d\u00e9sign\u00e9<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0\u00e0\u00a0<\/span>l’art<\/span>. 37 du RGPD. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>veille<\/span>\u00a0\u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0le\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>dispose<\/span>\u00a0de la\u00a0<\/span>qualification<\/span>\u00a0et des\u00a0<\/span>connaissances<\/span>\u00a0<\/span>sp\u00e9cialis\u00e9es<\/span>\u00a0<\/span>requises<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

5.2<\/b> L’obligation<\/span>\u00a0de\u00a0<\/span>d\u00e9signer<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pr\u00e9vue<\/span>\u00a0\u00e0\u00a0<\/span>l’alin\u00e9a<\/span>\u00a01\u00a0<\/span>peut<\/span>, \u00e0 la discr\u00e9tion du Responsable du\u00a0<\/span>traitement<\/span>, ne\u00a0<\/span>pas<\/span>\u00a0<\/span>s’appliquer<\/span>\u00a0si le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>d\u00e9montrer<\/span>\u00a0<\/span>qu’il<\/span>\u00a0<\/span>n’est<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>l\u00e9galement<\/span>\u00a0<\/span>tenu<\/span>\u00a0de\u00a0<\/span>d\u00e9signer<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0et\u00a0<\/span>que<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>d\u00e9montrer<\/span>\u00a0<\/span>l’existence<\/span>\u00a0de\u00a0<\/span>r\u00e8gles<\/span>\u00a0internes\u00a0<\/span>garantissant<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>dispositions<\/span>\u00a0<\/span>l\u00e9gales<\/span>, des\u00a0<\/span>r\u00e8gles<\/span>\u00a0du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>ainsi<\/span>\u00a0<\/span>que<\/span>\u00a0de\u00a0<\/span>toutes<\/span>\u00a0<\/span>autres<\/span>\u00a0<\/span>instructions<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>.<\/span><\/span><\/p>

\u00a0<\/h3>

6. Obligations de notification du Sous-traitant<\/strong><\/h3>

6.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0est\u00a0<\/span>tenu<\/span>\u00a0de\u00a0<\/span>communiquer<\/span>\u00a0sans\u00a0<\/span>d\u00e9lai<\/span>\u00a0au\u00a0<\/span>Responsable<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0toute violation des dispositions\u00a0<\/span>en<\/span>\u00a0mati\u00e8re de protection des donn\u00e9es\u00a0<\/span>ou<\/span>\u00a0des accords\u00a0<\/span>contractuels<\/span>\u00a0<\/span>conclus<\/span>\u00a0et\/<\/span>ou<\/span>\u00a0des instructions donn\u00e9es par le\u00a0<\/span>Responsable<\/span>\u00a0du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>survenue<\/span>\u00a0au\u00a0<\/span>cours<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0de donn\u00e9es par\u00a0<\/span>lui-m\u00eame<\/span>\u00a0<\/span>ou<\/span>\u00a0par\u00a0<\/span>d’autres<\/span>\u00a0<\/span>personnes<\/span>\u00a0<\/span>charg\u00e9es<\/span>\u00a0du\u00a0<\/span>traitement<\/span>.\u00a0<\/span><\/span>Il en\u00a0<\/span>va<\/span>\u00a0de\u00a0<\/span>m\u00eame<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>toute<\/span>\u00a0<\/span>violation<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>que<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>traite<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>.<\/span><\/span><\/span><\/p>

6.2<\/b> Par\u00a0<\/span>ailleurs<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>informe<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>lorsqu’une<\/span>\u00a0<\/span>autorit\u00e9<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>intervient<\/span>\u00a0\u00e0\u00a0<\/span>l’\u00e9gard<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0en vertu de\u00a0<\/span>l’art<\/span>. 58 du RGPD et\u00a0<\/span>que<\/span>\u00a0<\/span>cela<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0<\/span>concerner<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0<\/span>que<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>effectue<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>.<\/span><\/span><\/p>

6.3<\/b> Le Sous-<\/span>traitant<\/span>\u00a0a\u00a0<\/span>connaissance<\/span>\u00a0du fait\u00a0<\/span>qu’une<\/span>\u00a0<\/span>obligation<\/span>\u00a0de\u00a0<\/span>notification<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>incomber<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0en\u00a0<\/span>cas<\/span>\u00a0de\u00a0<\/span>violation<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0des\u00a0<\/span>art.<\/span>\u00a033 et 34 du RGPD,\u00a0<\/span>pr\u00e9voyant<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>notification<\/span>\u00a0\u00e0\u00a0<\/span>l’autorit\u00e9<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>les<\/span>\u00a072\u00a0<\/span>heures<\/span>\u00a0apr\u00e8s en\u00a0<\/span>avoir<\/span>\u00a0<\/span>pris<\/span>\u00a0<\/span>connaissance<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>assiste<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mise<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0de\u00a0<\/span>notification<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>communique<\/span>\u00a0en\u00a0<\/span>particulier<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>tout<\/span>\u00a0<\/span>acc\u00e8s<\/span>\u00a0non\u00a0<\/span>autoris\u00e9<\/span>\u00a0\u00e0 des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>trait\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0et au plus\u00a0<\/span>tard<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>les<\/span>\u00a072\u00a0<\/span>heures<\/span>\u00a0\u00e0\u00a0<\/span>compter<\/span>\u00a0de la\u00a0<\/span>connaissance<\/span>\u00a0de\u00a0<\/span>l’acc\u00e8s<\/span>. La\u00a0<\/span>notification<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>notamment<\/span>\u00a0<\/span>contenir<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>informations<\/span>\u00a0<\/span>suivantes<\/span>\u00a0:<\/span><\/span><\/p>

  • une<\/span>\u00a0<\/span>description<\/span>\u00a0de la\u00a0<\/span>nature<\/span>\u00a0de la\u00a0<\/span>violation<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>, y\u00a0<\/span>compris<\/span>, si possible,\u00a0<\/span>les<\/span>\u00a0<\/span>cat\u00e9gories<\/span>\u00a0et le\u00a0<\/span>nombre<\/span>\u00a0<\/span>approximatif<\/span>\u00a0de\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>cat\u00e9gories<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0et le\u00a0<\/span>nombre<\/span>\u00a0<\/span>approximatif<\/span>\u00a0<\/span>d’enregistrements<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>concern\u00e9s<\/span>\u00a0;<\/span><\/span>\u00a0<\/span><\/li>
  • une<\/span>\u00a0<\/span>description<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>prises<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>propos\u00e9es<\/span>\u00a0par le Sous-<\/span>traitant<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>rem\u00e9dier<\/span>\u00a0\u00e0 la\u00a0<\/span>violation<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0et, le\u00a0<\/span>cas<\/span>\u00a0<\/span>\u00e9ch\u00e9ant<\/span>, des\u00a0<\/span>mesures<\/span>\u00a0<\/span>destin\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>att\u00e9nuer<\/span>\u00a0<\/span>ses<\/span>\u00a0<\/span>\u00e9ventuelles<\/span>\u00a0<\/span>cons\u00e9quences<\/span>\u00a0<\/span>n\u00e9gatives<\/span>.<\/span><\/span>\u00a0<\/span><\/li><\/ul>

    \u00a0<\/h3>

    7. Obligations de collaboration du Sous-traitant<\/strong><\/h3>

    7.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>assiste<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>son<\/span>\u00a0<\/span>obligation<\/span>\u00a0de\u00a0<\/span>r\u00e9pondre<\/span>\u00a0aux\u00a0<\/span>demandes<\/span>\u00a0<\/span>d’exercice<\/span>\u00a0des\u00a0<\/span>droits<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0des\u00a0<\/span>art.<\/span>\u00a012 \u00e0 23 du RGPD. Les\u00a0<\/span>dispositions<\/span>\u00a0de la\u00a0<\/span>clause<\/span>\u00a012 du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>s’appliquent<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    7.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>assiste<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>l’\u00e9tablissement<\/span>\u00a0des\u00a0<\/span>registres<\/span>\u00a0des\u00a0<\/span>activit\u00e9s<\/span>\u00a0de\u00a0<\/span>traitement<\/span>. Il\u00a0<\/span>communique<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>, de\u00a0<\/span>mani\u00e8re<\/span>\u00a0<\/span>appropri\u00e9e<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>informations<\/span>\u00a0<\/span>n\u00e9cessaires<\/span>\u00a0\u00e0\u00a0<\/span>cet<\/span>\u00a0<\/span>\u00e9gard<\/span>.<\/span><\/span><\/p>

    7.3<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>assiste<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>, en\u00a0<\/span>tenant<\/span>\u00a0<\/span>compte<\/span>\u00a0de la\u00a0<\/span>nature<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0et des\u00a0<\/span>informations<\/span>\u00a0<\/span>dont<\/span>\u00a0il\u00a0<\/span>dispose<\/span>,\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>\u00e9nonc\u00e9es<\/span>\u00a0aux art. 32 \u00e0 36 du RGPD.<\/span><\/span><\/p>

    7.4<\/b> Pour\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0<\/span>d’assistance<\/span>\u00a0<\/span>qui<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>comprises<\/span>\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>description<\/span>\u00a0des\u00a0<\/span>prestations<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>qui<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>imputables<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0<\/span>manquement<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0et\u00a0<\/span>qui<\/span>\u00a0<\/span>vont<\/span>\u00a0au-<\/span>del\u00e0<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0du Sous-<\/span>traitant<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>pr\u00e9tendre<\/span>\u00a0\u00e0\u00a0<\/span>une<\/span>\u00a0<\/span>r\u00e9mun\u00e9ration<\/span>\u00a0<\/span>appropri\u00e9e<\/span>\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>base<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>offre<\/span>\u00a0<\/span>conforme<\/span>\u00a0aux\u00a0<\/span>conditions<\/span>\u00a0du\u00a0<\/span>march\u00e9<\/span>\u00a0(cf.\u00a0<\/span>clause<\/span>\u00a01<\/span>3<\/span>).\u00a0<\/span><\/span><\/p>

    \u00a0<\/h3>

    8. Disposition relative aux postes de travail mobiles<\/strong><\/h3>

    8.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>autoriser<\/span>\u00a0<\/span>ses<\/span>\u00a0<\/span>employ\u00e9s<\/span>\u00a0<\/span>charg\u00e9s<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0\u00e0\u00a0<\/span>traiter<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>sur<\/span>\u00a0des\u00a0<\/span>postes<\/span>\u00a0de\u00a0<\/span>travail<\/span>\u00a0mobiles\u00a0<\/span>situ\u00e9s<\/span>\u00a0en\u00a0<\/span>dehors<\/span>\u00a0des\u00a0<\/span>locaux<\/span>\u00a0du Sous-<\/span>traitant<\/span>.<\/span><\/span><\/p>

    8.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>garantir<\/span>\u00a0<\/span>que<\/span>\u00a0le\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>convenues<\/span>\u00a0<\/span>contractuellement<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0<\/span>assur\u00e9<\/span>\u00a0<\/span>lors<\/span>\u00a0de\u00a0<\/span>l’utilisation<\/span>\u00a0de\u00a0<\/span>postes<\/span>\u00a0de\u00a0<\/span>travail<\/span>\u00a0mobiles par\u00a0<\/span>les<\/span>\u00a0<\/span>employ\u00e9s<\/span>\u00a0du Sous-<\/span>traitant<\/span>. Les\u00a0<\/span>d\u00e9rogations<\/span>\u00a0\u00e0\u00a0<\/span>certaines<\/span>\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>convenues<\/span>\u00a0<\/span>contractuellement<\/span>\u00a0<\/span>doivent<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>concert\u00e9es<\/span>\u00a0au\u00a0<\/span>pr\u00e9alable<\/span>\u00a0<\/span>avec<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0et\u00a0<\/span>approuv\u00e9es<\/span>\u00a0par\u00a0<\/span>celui<\/span>-ci\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte).\u00a0<\/span><\/span><\/p>

    8.3<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>veille<\/span>\u00a0en\u00a0<\/span>particulier<\/span>\u00a0\u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>,\u00a0<\/span>lors<\/span>\u00a0<\/span>d’un<\/span>\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>sur<\/span>\u00a0des\u00a0<\/span>postes<\/span>\u00a0de\u00a0<\/span>travail<\/span>\u00a0mobiles,\u00a0<\/span>les<\/span>\u00a0<\/span>emplacements<\/span>\u00a0de\u00a0<\/span>stockage<\/span>\u00a0<\/span>soient<\/span>\u00a0<\/span>configur\u00e9s<\/span>\u00a0de\u00a0<\/span>mani\u00e8re<\/span>\u00a0\u00e0\u00a0<\/span>exclure<\/span>\u00a0<\/span>tout<\/span>\u00a0<\/span>stockage<\/span>\u00a0<\/span>local<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>syst\u00e8mes<\/span>\u00a0<\/span>informatiques<\/span>.\u00a0<\/span>Si<\/span>\u00a0<\/span>cela<\/span>\u00a0<\/span>n’est<\/span>\u00a0<\/span>pas<\/span>\u00a0possible, le Sous-<\/span>traitant<\/span>\u00a0<\/span>veille<\/span>\u00a0\u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0le\u00a0<\/span>stockage<\/span>\u00a0<\/span>local<\/span>\u00a0<\/span>s’effectue<\/span>\u00a0<\/span>exclusivement<\/span>\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>chiffr\u00e9e<\/span>\u00a0et \u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>autres<\/span>\u00a0<\/span>personnes<\/span>\u00a0<\/span>pr\u00e9sentes<\/span>\u00a0<\/span>sur<\/span>\u00a0le\u00a0<\/span>lieu<\/span>\u00a0du poste de\u00a0<\/span>travail<\/span>\u00a0mobile\u00a0<\/span>concern\u00e9<\/span>\u00a0<\/span>n’aient<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>acc\u00e8s<\/span>\u00a0\u00e0\u00a0<\/span>ces<\/span>\u00a0<\/span>donn\u00e9es<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    9. Pouvoirs de contr\u00f4le<\/strong><\/h3>

    9.1<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0a le\u00a0<\/span>droit<\/span>\u00a0de\u00a0<\/span>contr\u00f4ler<\/span>\u00a0\u00e0\u00a0<\/span>tout<\/span>\u00a0<\/span>moment<\/span>,\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>, le\u00a0<\/span>respect<\/span>\u00a0par le Sous-<\/span>traitant<\/span>\u00a0des\u00a0<\/span>dispositions<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0relatives \u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0et\/<\/span>ou<\/span>\u00a0le\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>r\u00e8gles<\/span>\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>convenues<\/span>\u00a0entre\u00a0<\/span>les<\/span>\u00a0<\/span>parties<\/span>\u00a0et\/<\/span>ou<\/span>\u00a0le\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>instructions<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    9.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>tenu<\/span>\u00a0de\u00a0<\/span>fournir<\/span>\u00a0des\u00a0<\/span>informations<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0<\/span>cela<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>\u00a0\u00e0 la\u00a0<\/span>r\u00e9alisation<\/span>\u00a0du\u00a0<\/span>contr\u00f4le<\/span>\u00a0au sens de\u00a0<\/span>l’alin\u00e9a<\/span>\u00a01.<\/span><\/span><\/p>

    9.3<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>peut<\/span>, apr\u00e8s\u00a0<\/span>annonce<\/span>\u00a0<\/span>pr\u00e9alable<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0<\/span>raisonnable<\/span>,\u00a0<\/span>proc\u00e9der<\/span>\u00a0au\u00a0<\/span>contr\u00f4le<\/span>\u00a0au sens de\u00a0<\/span>l’alin\u00e9a<\/span>\u00a01\u00a0<\/span>dans<\/span>\u00a0<\/span>l’\u00e9tablissement<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0<\/span>pendant<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>heures<\/span>\u00a0<\/span>d’ouverture<\/span>\u00a0habituelles. Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>veille<\/span>\u00a0\u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>contr\u00f4les<\/span>\u00a0ne\u00a0<\/span>soient<\/span>\u00a0<\/span>effectu\u00e9s<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>,\u00a0<\/span>afin<\/span>\u00a0de\u00a0<\/span>ne<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>perturber<\/span>\u00a0de\u00a0<\/span>mani\u00e8re<\/span>\u00a0<\/span>disproportionn\u00e9e<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>processus<\/span>\u00a0<\/span>op\u00e9rationnels<\/span>\u00a0du Sous-<\/span>traitant<\/span>. Les\u00a0<\/span>parties<\/span>\u00a0<\/span>partent<\/span>\u00a0du\u00a0<\/span>principe<\/span>\u00a0<\/span>qu’un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>\u00a0au maximum\u00a0<\/span>une<\/span>\u00a0<\/span>fois<\/span>\u00a0par an. Tout\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>suppl\u00e9mentaire<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>motiv\u00e9<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>\u00a0en\u00a0<\/span>indiquant<\/span>\u00a0le\u00a0<\/span>motif<\/span>. En\u00a0<\/span>cas<\/span>\u00a0de\u00a0<\/span>contr\u00f4les<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>, le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>rembourse<\/span>\u00a0au Sous-<\/span>traitant<\/span>,\u00a0<\/span>dans<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>mesure<\/span>\u00a0<\/span>appropri\u00e9e<\/span>,\u00a0<\/span>les<\/span>\u00a0frais\u00a0<\/span>occasionn\u00e9s<\/span>, y\u00a0<\/span>compris<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>co\u00fbts<\/span>\u00a0de\u00a0<\/span>personnel<\/span>\u00a0<\/span>li\u00e9s<\/span>\u00a0\u00e0\u00a0<\/span>l’encadrement<\/span>\u00a0et \u00e0\u00a0<\/span>l’accompagnement<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>charg\u00e9es<\/span>\u00a0du\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>. Les\u00a0<\/span>bases<\/span>\u00a0du\u00a0<\/span>calcul<\/span>\u00a0des\u00a0<\/span>co\u00fbts<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>communiqu\u00e9es<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0par le Sous-<\/span>traitant<\/span>\u00a0avant la\u00a0<\/span>r\u00e9alisation<\/span>\u00a0du\u00a0<\/span>contr\u00f4le<\/span>.<\/span><\/span><\/p>

    9.4<\/b> Au\u00a0<\/span>choix<\/span>\u00a0du Sous-<\/span>traitant<\/span>, la\u00a0<\/span>preuve<\/span>\u00a0du\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>apport\u00e9e<\/span>, au\u00a0<\/span>lieu<\/span>\u00a0<\/span>d’un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>, par la\u00a0<\/span>pr\u00e9sentation<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>attestation<\/span>\u00a0<\/span>appropri\u00e9e<\/span>\u00a0et\u00a0<\/span>actuelle<\/span>, de\u00a0<\/span>rapports<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>d’extraits<\/span>\u00a0de\u00a0<\/span>rapports<\/span>\u00a0<\/span>d’instances<\/span>\u00a0<\/span>ind\u00e9pendantes<\/span>\u00a0(par ex.\u00a0<\/span>commissaires<\/span>\u00a0aux\u00a0<\/span>comptes<\/span>,\u00a0<\/span>audit<\/span>\u00a0interne,\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>,\u00a0<\/span>service<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0<\/span>informatique<\/span>,\u00a0<\/span>auditeurs<\/span>\u00a0en\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>auditeurs<\/span>\u00a0<\/span>qualit\u00e9<\/span>)\u00a0<\/span>ou<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>certification<\/span>\u00a0<\/span>appropri\u00e9e<\/span>,\u00a0<\/span>lorsque<\/span>\u00a0le\u00a0<\/span>rapport<\/span>\u00a0<\/span>d’audit<\/span>\u00a0<\/span>permet<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>s’assurer<\/span>\u00a0de\u00a0<\/span>mani\u00e8re<\/span>\u00a0<\/span>appropri\u00e9e<\/span>\u00a0du\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0\u00e0\u00a0<\/span>l’Annexe<\/span>\u00a03 du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>.\u00a0<\/span>Si<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0a des\u00a0<\/span>doutes<\/span>\u00a0<\/span>fond\u00e9s<\/span>\u00a0<\/span>quant<\/span>\u00a0\u00e0\u00a0<\/span>l’ad\u00e9quation<\/span>\u00a0du\u00a0<\/span>document<\/span>\u00a0<\/span>d’audit<\/span>\u00a0au sens de la\u00a0<\/span>premi\u00e8re<\/span>\u00a0<\/span>phrase<\/span>,\u00a0<\/span>un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>effectu\u00e9<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>. Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0a\u00a0<\/span>connaissance<\/span>\u00a0du fait\u00a0<\/span>qu’un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>centres<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>n’est<\/span>\u00a0<\/span>pas<\/span>\u00a0possible\u00a0<\/span>ou<\/span>\u00a0<\/span>ne<\/span>\u00a0<\/span>l’est<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>dans<\/span>\u00a0des\u00a0<\/span>cas<\/span>\u00a0<\/span>exceptionnels<\/span>\u00a0<\/span>justifi\u00e9s<\/span>. Pour\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0<\/span>d’assistance<\/span>\u00a0<\/span>qui<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>comprises<\/span>\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>description<\/span>\u00a0des\u00a0<\/span>prestations<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>qui<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>imputables<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0<\/span>manquement<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0et\u00a0<\/span>qui<\/span>\u00a0<\/span>vont<\/span>\u00a0au-<\/span>del\u00e0<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0du Sous-<\/span>traitant<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>pr\u00e9tendre<\/span>\u00a0\u00e0\u00a0<\/span>une<\/span>\u00a0<\/span>r\u00e9mun\u00e9ration<\/span>\u00a0<\/span>appropri\u00e9e<\/span>\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>base<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>offre<\/span>\u00a0<\/span>conforme<\/span>\u00a0aux\u00a0<\/span>conditions<\/span>\u00a0du\u00a0<\/span>march\u00e9<\/span>\u00a0(cf.\u00a0<\/span>clause<\/span>\u00a01<\/span>3<\/span>).<\/span><\/span><\/p>

    9.5<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>tenu<\/span>, en\u00a0<\/span>cas<\/span>\u00a0de\u00a0<\/span>mesures<\/span>\u00a0de\u00a0<\/span>l’autorit\u00e9<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0\u00e0\u00a0<\/span>l’\u00e9gard<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0au sens de\u00a0<\/span>l’art<\/span>. 58 du RGPD,\u00a0<\/span>notamment<\/span>\u00a0en\u00a0<\/span>ce<\/span>\u00a0<\/span>qui<\/span>\u00a0<\/span>concerne<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>obligations<\/span>\u00a0<\/span>d’information<\/span>\u00a0et de\u00a0<\/span>contr\u00f4le<\/span>, de\u00a0<\/span>fournir<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>informations<\/span>\u00a0<\/span>n\u00e9cessaires<\/span>\u00a0et de\u00a0<\/span>permettre<\/span>\u00a0\u00e0\u00a0<\/span>l’autorit\u00e9<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>comp\u00e9tente<\/span>\u00a0<\/span>d’effectuer<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>informe<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>pr\u00e9vues<\/span>\u00a0\u00e0\u00a0<\/span>cet<\/span>\u00a0<\/span>\u00e9gard<\/span>.<\/span><\/span><\/p>

    9.6<\/b> Les\u00a0<\/span>parties<\/span>\u00a0<\/span>conviennent<\/span>\u00a0<\/span>que<\/span>,\u00a0<\/span>lors<\/span>\u00a0<\/span>d’un<\/span>\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>sur<\/span>\u00a0des\u00a0<\/span>postes<\/span>\u00a0de\u00a0<\/span>travail<\/span>\u00a0mobiles,\u00a0<\/span>les<\/span>\u00a0<\/span>mesures<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>s’effectuent<\/span>\u00a0en\u00a0<\/span>priorit\u00e9<\/span>,\u00a0<\/span>afin<\/span>\u00a0de\u00a0<\/span>pr\u00e9server<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>droits<\/span>\u00a0de la\u00a0<\/span>personnalit\u00e9<\/span>\u00a0<\/span>d’autres<\/span>\u00a0<\/span>personnes<\/span>\u00a0<\/span>pr\u00e9sentes<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>ces<\/span>\u00a0<\/span>postes<\/span>\u00a0de\u00a0<\/span>travail<\/span>\u00a0mobiles, par\u00a0<\/span>un<\/span>\u00a0<\/span>contr\u00f4le<\/span>\u00a0de la\u00a0<\/span>mise<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0\u00e0\u00a0<\/span>prendre<\/span>\u00a0par le Sous-<\/span>traitant<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0\u00e0 la\u00a0<\/span>clause<\/span>\u00a09, al. 2 et 3. Le\u00a0<\/span>cas<\/span>\u00a0<\/span>\u00e9ch\u00e9ant<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0<\/span>permettre<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>contr\u00f4ler<\/span>\u00a0le poste de\u00a0<\/span>travail<\/span>\u00a0mobile des\u00a0<\/span>employ\u00e9s<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    10. Sous-traitance ult\u00e9rieure<\/strong><\/h3>

    10.1 <\/b><\/span>Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0en\u00a0<\/span>droit<\/span>\u00a0de\u00a0<\/span>recourir<\/span>\u00a0aux\u00a0<\/span>sous-traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0<\/span>indiqu\u00e9s<\/span>\u00a0\u00e0\u00a0<\/span>l’<\/span><\/span>Annexe<\/span>\u00a02<\/span><\/span>\u00a0du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>. Le\u00a0<\/span>remplacement<\/span>\u00a0de\u00a0<\/span>sous-traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0<\/span>ou<\/span>\u00a0le\u00a0<\/span>recours<\/span>\u00a0\u00e0\u00a0<\/span>d’autres<\/span>\u00a0<\/span>sous-traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>admis<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>conditions<\/span>\u00a0<\/span>\u00e9nonc\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>l’alin\u00e9a<\/span>\u00a02.<\/span><\/span>\u00a0<\/span><\/p>

    10.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>s\u00e9lectionner<\/span>\u00a0<\/span>avec<\/span>\u00a0<\/span>soin<\/span>\u00a0le\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0et\u00a0<\/span>v\u00e9rifier<\/span>, avant de\u00a0<\/span>lui<\/span>\u00a0<\/span>confier<\/span>\u00a0des\u00a0<\/span>t\u00e2ches<\/span>,\u00a0<\/span>que<\/span>\u00a0<\/span>celui<\/span>-ci\u00a0<\/span>est<\/span>\u00a0en\u00a0<\/span>mesure<\/span>\u00a0de\u00a0<\/span>respecter<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>accords<\/span>\u00a0<\/span>conclus<\/span>\u00a0entre le Responsable du\u00a0<\/span>traitement<\/span>\u00a0et le Sous-<\/span>traitant<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0en\u00a0<\/span>particulier<\/span>\u00a0<\/span>contr\u00f4ler<\/span>, au\u00a0<\/span>pr\u00e9alable<\/span>\u00a0et\u00a0<\/span>r\u00e9guli\u00e8rement<\/span>\u00a0<\/span>pendant<\/span>\u00a0la\u00a0<\/span>dur\u00e9e<\/span>\u00a0du\u00a0<\/span>contrat<\/span>,\u00a0<\/span>que<\/span>\u00a0le\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0a\u00a0<\/span>pris<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>requises<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 32 du RGPD\u00a0<\/span>pour<\/span>\u00a0la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>informe<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte), en\u00a0<\/span>temps<\/span>\u00a0<\/span>utile<\/span>\u00a0et au plus\u00a0<\/span>tard<\/span>\u00a04\u00a0<\/span>semaines<\/span>\u00a0avant le\u00a0<\/span>remplacement<\/span>\u00a0<\/span>ou<\/span>\u00a0le nouveau\u00a0<\/span>recours<\/span>, en\u00a0<\/span>cas<\/span>\u00a0de\u00a0<\/span>remplacement<\/span>\u00a0<\/span>pr\u00e9vu<\/span>\u00a0<\/span>d’un<\/span>\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>ou<\/span>\u00a0de\u00a0<\/span>recours<\/span>\u00a0<\/span>pr\u00e9vu<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0nouveau\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0(\u00ab Information \u00bb). Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0a le\u00a0<\/span>droit<\/span>\u00a0de\u00a0<\/span>s’opposer<\/span>\u00a0au\u00a0<\/span>remplacement<\/span>\u00a0<\/span>ou<\/span>\u00a0au nouveau\u00a0<\/span>recours<\/span>\u00a0au\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>, en\u00a0<\/span>indiquant<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>motif<\/span>\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte),\u00a0<\/span>dans<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0de 2\u00a0<\/span>semaines<\/span>\u00a0\u00e0\u00a0<\/span>compter<\/span>\u00a0de la\u00a0<\/span>r\u00e9ception<\/span>\u00a0de l’\u00ab Information \u00bb.\u00a0<\/span>L’opposition<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>retir\u00e9e<\/span>\u00a0\u00e0\u00a0<\/span>tout<\/span>\u00a0<\/span>moment<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte). En\u00a0<\/span>cas<\/span>\u00a0<\/span>d’opposition<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>r\u00e9silier<\/span>\u00a0la\u00a0<\/span>relation<\/span>\u00a0<\/span>contractuelle<\/span>\u00a0<\/span>avec<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>moyennant<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>pr\u00e9avis<\/span>\u00a0<\/span>d’au<\/span>\u00a0<\/span>moins<\/span>\u00a014\u00a0<\/span>jours<\/span>\u00a0<\/span>pour<\/span>\u00a0la fin\u00a0<\/span>d’un<\/span>\u00a0<\/span>mois<\/span>\u00a0<\/span>civil<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>tient<\/span>\u00a0<\/span>d\u00fbment<\/span>\u00a0<\/span>compte<\/span>\u00a0des\u00a0<\/span>int\u00e9r\u00eats<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>lors<\/span>\u00a0de la\u00a0<\/span>fixation<\/span>\u00a0du\u00a0<\/span>d\u00e9lai<\/span>\u00a0de\u00a0<\/span>pr\u00e9avis<\/span>. \u00c0\u00a0<\/span>d\u00e9faut<\/span>\u00a0<\/span>d’opposition<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0de\u00a0<\/span>2<\/span>\u00a0<\/span>semaines<\/span>\u00a0\u00e0\u00a0<\/span>compter<\/span>\u00a0de la\u00a0<\/span>r\u00e9ception<\/span>\u00a0de l’\u00ab Information \u00bb,\u00a0<\/span>cela<\/span>\u00a0<\/span>vaut<\/span>\u00a0<\/span>consentement<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0au\u00a0<\/span>remplacement<\/span>\u00a0<\/span>ou<\/span>\u00a0au nouveau\u00a0<\/span>recours<\/span>\u00a0au\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>concern\u00e9<\/span>.<\/span><\/span><\/p>

    10.3<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>tenu<\/span>\u00a0de se faire\u00a0<\/span>confirmer<\/span>\u00a0par le\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>celui<\/span>-ci a\u00a0<\/span>d\u00e9sign\u00e9<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0\u00e0\u00a0<\/span>l’art<\/span>. 37 du RGPD,\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0le\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>l\u00e9galement<\/span>\u00a0<\/span>tenu<\/span>\u00a0de\u00a0<\/span>d\u00e9signer<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9l\u00e9gu\u00e9<\/span>\u00a0\u00e0 la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.4<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>s’assurer<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>r\u00e8gles<\/span>\u00a0<\/span>convenues<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0et, le\u00a0<\/span>cas<\/span>\u00a0<\/span>\u00e9ch\u00e9ant<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>instructions<\/span>\u00a0<\/span>compl\u00e9mentaires<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>s’appliquent<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0\u00e0\u00a0<\/span>l’\u00e9gard<\/span>\u00a0du\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.5<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>conclure<\/span>\u00a0<\/span>avec<\/span>\u00a0le\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>contrat<\/span>\u00a0de\u00a0<\/span>sous-traitance<\/span>\u00a0<\/span>conforme<\/span>\u00a0aux\u00a0<\/span>exigences<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 28 du RGPD. En\u00a0<\/span>outre<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>imposer<\/span>\u00a0au\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>m\u00eames<\/span>\u00a0<\/span>obligations<\/span>\u00a0de\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>celles<\/span>\u00a0<\/span>fix\u00e9es<\/span>\u00a0entre le Responsable du\u00a0<\/span>traitement<\/span>\u00a0et le Sous-<\/span>traitant<\/span>.\u00a0<\/span>Une<\/span>\u00a0<\/span>copie<\/span>\u00a0du\u00a0<\/span>contrat<\/span>\u00a0de\u00a0<\/span>sous-traitance<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>transmise<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>demande<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.6<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>notamment<\/span>\u00a0<\/span>tenu<\/span>\u00a0de\u00a0<\/span>garantir<\/span>, par des\u00a0<\/span>dispositions<\/span>\u00a0<\/span>contractuelles<\/span>,\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>pouvoirs<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0(<\/span>clause<\/span>\u00a09 du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>) du Responsable du\u00a0<\/span>traitement<\/span>\u00a0et des\u00a0<\/span>autorit\u00e9s<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>s’appliquent<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0\u00e0\u00a0<\/span>l’\u00e9gard<\/span>\u00a0du\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0et\u00a0<\/span>que<\/span>\u00a0des\u00a0<\/span>droits<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>correspondants<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0et des\u00a0<\/span>autorit\u00e9s<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>soient<\/span>\u00a0<\/span>convenus<\/span>. Il\u00a0<\/span>convient<\/span>\u00a0en\u00a0<\/span>outre<\/span>\u00a0de\u00a0<\/span>pr\u00e9voir<\/span>\u00a0<\/span>contractuellement<\/span>\u00a0<\/span>que<\/span>\u00a0le\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>tol\u00e9rer<\/span>\u00a0<\/span>ces<\/span>\u00a0<\/span>mesures<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0et\u00a0<\/span>les<\/span>\u00a0<\/span>\u00e9ventuels<\/span>\u00a0<\/span>contr\u00f4les<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>place<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    10.7<\/b> Ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>consid\u00e9r\u00e9es<\/span>\u00a0comme des\u00a0<\/span>relations<\/span>\u00a0de\u00a0<\/span>sous-traitance<\/span>\u00a0<\/span>ult\u00e9rieure<\/span>\u00a0au sens des\u00a0<\/span>alin\u00e9as<\/span>\u00a01 \u00e0 6\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0de\u00a0<\/span>services<\/span>\u00a0<\/span>auxquelles<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0a\u00a0<\/span>recours<\/span>\u00a0<\/span>aupr\u00e8s<\/span>\u00a0de\u00a0<\/span>tiers<\/span>\u00a0\u00e0\u00a0<\/span>titre<\/span>\u00a0de simple\u00a0<\/span>prestation<\/span>\u00a0<\/span>accessoire<\/span>,\u00a0<\/span>afin<\/span>\u00a0<\/span>d’exercer<\/span>\u00a0<\/span>son<\/span>\u00a0<\/span>activit\u00e9<\/span>\u00a0<\/span>commerciale<\/span>. En\u00a0<\/span>font<\/span>\u00a0<\/span>partie<\/span>, par exemple,\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0de\u00a0<\/span>nettoyage<\/span>,\u00a0<\/span>les<\/span>\u00a0simples\u00a0<\/span>prestations<\/span>\u00a0de\u00a0<\/span>t\u00e9l\u00e9communication<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>lien<\/span>\u00a0<\/span>concret<\/span>\u00a0<\/span>avec<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0<\/span>que<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>fournit<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>services<\/span>\u00a0<\/span>postaux<\/span>\u00a0et de\u00a0<\/span>coursier<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0de\u00a0<\/span>transport<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>services<\/span>\u00a0de\u00a0<\/span>gardiennage<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>n\u00e9anmoins<\/span>\u00a0<\/span>tenu<\/span>, y\u00a0<\/span>compris<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0<\/span>accessoires<\/span>\u00a0<\/span>fournies<\/span>\u00a0par des\u00a0<\/span>tiers<\/span>, de\u00a0<\/span>veiller<\/span>\u00a0\u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0des\u00a0<\/span>pr\u00e9cautions<\/span>\u00a0<\/span>appropri\u00e9es<\/span>\u00a0<\/span>ainsi<\/span>\u00a0<\/span>que<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>aient<\/span>\u00a0<\/span>\u00e9t\u00e9<\/span>\u00a0<\/span>prises<\/span>\u00a0<\/span>afin<\/span>\u00a0de\u00a0<\/span>garantir<\/span>\u00a0la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>. La\u00a0<\/span>maintenance<\/span>\u00a0et\u00a0<\/span>l’entretien<\/span>\u00a0de\u00a0<\/span>syst\u00e8mes<\/span>\u00a0<\/span>informatiques<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>d’applications<\/span>\u00a0<\/span>constituent<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>relation<\/span>\u00a0de\u00a0<\/span>sous-traitance<\/span>\u00a0<\/span>ult\u00e9rieure<\/span>\u00a0<\/span>soumise<\/span>\u00a0\u00e0\u00a0<\/span>consentement<\/span>\u00a0et\u00a0<\/span>un<\/span>\u00a0<\/span>traitement<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0au sens de\u00a0<\/span>l’art<\/span>. 28 du RGPD\u00a0<\/span>lorsque<\/span>\u00a0la\u00a0<\/span>maintenance<\/span>\u00a0et le\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>concernent<\/span>\u00a0des\u00a0<\/span>syst\u00e8mes<\/span>\u00a0<\/span>informatiques<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0<\/span>utilis\u00e9s<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>cadre<\/span>\u00a0de la\u00a0<\/span>fourniture<\/span>\u00a0de\u00a0<\/span>prestations<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0et\u00a0<\/span>que<\/span>\u00a0la\u00a0<\/span>maintenance<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>donner<\/span>\u00a0<\/span>acc\u00e8s<\/span>\u00a0\u00e0 des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>trait\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    11. Obligation de confidentialit\u00e9<\/strong><\/h3>

    11.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>tenu<\/span>,\u00a0<\/span>lors<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>, de\u00a0<\/span>pr\u00e9server<\/span>\u00a0la\u00a0<\/span>confidentialit\u00e9<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>qu’il<\/span>\u00a0<\/span>re\u00e7oit<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>dont<\/span>\u00a0il\u00a0<\/span>prend<\/span>\u00a0<\/span>connaissance<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>cadre<\/span>\u00a0du\u00a0<\/span>contrat<\/span>.<\/span><\/span><\/p>

    11.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0a\u00a0<\/span>familiaris\u00e9<\/span>\u00a0<\/span>ses<\/span>\u00a0<\/span>employ\u00e9s<\/span>\u00a0<\/span>avec<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>dispositions<\/span>\u00a0de la\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>qui<\/span>\u00a0<\/span>leur<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>applicables<\/span>\u00a0et\u00a0<\/span>les<\/span>\u00a0a\u00a0<\/span>astreints<\/span>\u00a0\u00e0 la\u00a0<\/span>confidentialit\u00e9<\/span>.\u00a0<\/span><\/span><\/p>

    11.3<\/b> L’engagement des\u00a0<\/span>employ\u00e9s<\/span>\u00a0<\/span>vis\u00e9<\/span>\u00a0\u00e0\u00a0<\/span>l’alin\u00e9a<\/span>\u00a02\u00a0<\/span>doit<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>justifi\u00e9<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>sur<\/span>\u00a0<\/span>demande<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    12. Respect des droits des personnes concern\u00e9es<\/strong><\/h3>

    12.1<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>seul<\/span>\u00a0responsable du\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>droits<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>tenu<\/span>\u00a0<\/span>d’assister<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>son<\/span>\u00a0<\/span>obligation<\/span>\u00a0de\u00a0<\/span>traiter<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>demandes<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0des\u00a0<\/span>art.<\/span>\u00a012 \u00e0 23 du RGPD. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>veille<\/span>\u00a0en\u00a0<\/span>particulier<\/span>\u00a0\u00e0\u00a0<\/span>ce<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>informations<\/span>\u00a0<\/span>n\u00e9cessaires<\/span>\u00a0\u00e0\u00a0<\/span>cet<\/span>\u00a0<\/span>\u00e9gard<\/span>\u00a0<\/span>soient<\/span>\u00a0<\/span>fournies<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>afin<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>celui<\/span>-ci\u00a0<\/span>puisse<\/span>\u00a0<\/span>notamment<\/span>\u00a0<\/span>satisfaire<\/span>\u00a0\u00e0\u00a0<\/span>ses<\/span>\u00a0<\/span>obligations<\/span>\u00a0<\/span>d\u00e9coulant<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 12,\u00a0<\/span>paragraphe<\/span>\u00a03, du RGPD.\u00a0<\/span><\/span><\/p>

    12.2<\/b> Dans la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>collaboration<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>\u00a0au\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>droits<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0\u2013\u00a0<\/span>notamment<\/span>\u00a0<\/span>d’acc\u00e8s<\/span>, de\u00a0<\/span>rectification<\/span>, de\u00a0<\/span>limitation<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>d’effacement<\/span>\u00a0\u2013 par le Responsable du\u00a0<\/span>traitement<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>prend<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>mesures<\/span>\u00a0<\/span>n\u00e9cessaires<\/span>\u00a0\u00e0\u00a0<\/span>cet<\/span>\u00a0<\/span>\u00e9gard<\/span>\u00a0<\/span>selon<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>instructions<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>assiste<\/span>\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0du possible le Responsable du\u00a0<\/span>traitement<\/span>, par des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>appropri\u00e9es<\/span>,\u00a0<\/span>dans<\/span>\u00a0<\/span>l’accomplissement<\/span>\u00a0de\u00a0<\/span>son<\/span>\u00a0<\/span>obligation<\/span>\u00a0de\u00a0<\/span>r\u00e9pondre<\/span>\u00a0aux\u00a0<\/span>demandes<\/span>\u00a0<\/span>d’exercice<\/span>\u00a0des\u00a0<\/span>droits<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>.<\/span><\/span><\/p>

    12.3<\/b> Pour\u00a0<\/span>les<\/span>\u00a0<\/span>prestations<\/span>\u00a0<\/span>d’assistance<\/span>\u00a0<\/span>qui<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>comprises<\/span>\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>description<\/span>\u00a0des\u00a0<\/span>prestations<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>qui<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>imputables<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0<\/span>manquement<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0et\u00a0<\/span>qui<\/span>\u00a0<\/span>vont<\/span>\u00a0au-<\/span>del\u00e0<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0du Sous-<\/span>traitant<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>pr\u00e9tendre<\/span>\u00a0\u00e0\u00a0<\/span>une<\/span>\u00a0<\/span>r\u00e9mun\u00e9ration<\/span>\u00a0<\/span>appropri\u00e9e<\/span>\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>base<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>offre<\/span>\u00a0<\/span>conforme<\/span>\u00a0aux\u00a0<\/span>conditions<\/span>\u00a0du\u00a0<\/span>march\u00e9<\/span>\u00a0(cf.\u00a0<\/span>clause<\/span>\u00a01<\/span>3<\/span>).<\/span><\/span>\u00a0<\/span><\/span><\/p>

    \u00a0<\/h3>

    13. R\u00e9mun\u00e9ration<\/strong><\/h3>

    Les\u00a0<\/span>cr\u00e9ances<\/span>\u00a0de\u00a0<\/span>r\u00e9mun\u00e9ration<\/span>\u00a0<\/span>que<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>pourrait<\/span>\u00a0<\/span>\u00e9ventuellement<\/span>\u00a0<\/span>r\u00e9clamer<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0des\u00a0<\/span>clauses<\/span>\u00a0<\/span>pr\u00e9c\u00e9dentes<\/span>\u00a0<\/span>doivent<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>appropri\u00e9es<\/span>. Est\u00a0<\/span>consid\u00e9r\u00e9e<\/span>\u00a0comme\u00a0<\/span>appropri\u00e9e<\/span>\u00a0la\u00a0<\/span>facturation<\/span>\u00a0des frais\u00a0<\/span>occasionn\u00e9s<\/span>\u00a0<\/span>selon<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>taux<\/span>\u00a0<\/span>horaires<\/span>\u00a0<\/span>conformes<\/span>\u00a0aux\u00a0<\/span>conditions<\/span>\u00a0du\u00a0<\/span>march\u00e9<\/span>\u00a0<\/span>demand\u00e9s<\/span>\u00a0par le Sous-<\/span>traitant<\/span>,\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>base<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>offre<\/span>\u00a0convenue entre le Responsable du\u00a0<\/span>traitement<\/span>\u00a0et le Sous-<\/span>traitant<\/span>\u00a0avant\u00a0<\/span>que<\/span>\u00a0<\/span>les<\/span>\u00a0frais ne\u00a0<\/span>soient<\/span>\u00a0<\/span>occasionn\u00e9s<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    \u00a0<\/h3>

    14. Mesures techniques et organisationnelles relatives \u00e0 la s\u00e9curit\u00e9 des donn\u00e9es<\/strong><\/h3>

    14.1<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>s’engage<\/span>\u00a0\u00e0\u00a0<\/span>l’\u00e9gard<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0\u00e0\u00a0<\/span>respecter<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>n\u00e9cessaires<\/span>\u00a0au\u00a0<\/span>respect<\/span>\u00a0des\u00a0<\/span>dispositions<\/span>\u00a0<\/span>applicables<\/span>\u00a0en\u00a0<\/span>mati\u00e8re<\/span>\u00a0de\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>. Cela\u00a0<\/span>comprend<\/span>\u00a0<\/span>notamment<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>exigences<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 32 du RGPD.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    14.2<\/b> L’\u00e9tat<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>existant<\/span>\u00a0au\u00a0<\/span>moment<\/span>\u00a0de la\u00a0<\/span>conclusion<\/span>\u00a0du\u00a0<\/span>contrat<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>joint<\/span>\u00a0au\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0en tant\u00a0<\/span>qu’<\/span><\/span>Annexe<\/span>\u00a03<\/span><\/span><\/strong>. Les\u00a0<\/span>parties<\/span>\u00a0<\/span>conviennent<\/span>\u00a0<\/span>que<\/span>\u00a0des\u00a0<\/span>modifications<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>peuvent<\/span>\u00a0<\/span>s’av\u00e9rer<\/span>\u00a0<\/span>n\u00e9cessaires<\/span>\u00a0en vue de\u00a0<\/span>l’adaptation<\/span>\u00a0aux\u00a0<\/span>\u00e9volutions<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>juridiques<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>concertera<\/span>\u00a0au\u00a0<\/span>pr\u00e9alable<\/span>\u00a0<\/span>avec<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>modifications<\/span>\u00a0<\/span>substantielles<\/span>\u00a0<\/span>susceptibles<\/span>\u00a0de\u00a0<\/span>porter<\/span>\u00a0<\/span>atteinte<\/span>\u00a0\u00e0\u00a0<\/span>l’int\u00e9grit\u00e9<\/span>, \u00e0 la\u00a0<\/span>confidentialit\u00e9<\/span>\u00a0<\/span>ou<\/span>\u00a0\u00e0 la\u00a0<\/span>disponibilit\u00e9<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>. Les\u00a0<\/span>mesures<\/span>\u00a0<\/span>n’entra\u00eenant<\/span>\u00a0<\/span>que<\/span>\u00a0des\u00a0<\/span>modifications<\/span>\u00a0<\/span>techniques<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>mineures<\/span>\u00a0et\u00a0<\/span>n’affectant<\/span>\u00a0<\/span>pas<\/span>\u00a0<\/span>n\u00e9gativement<\/span>\u00a0<\/span>l’int\u00e9grit\u00e9<\/span>, la\u00a0<\/span>confidentialit\u00e9<\/span>\u00a0et la\u00a0<\/span>disponibilit\u00e9<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>peuvent<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>mises<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0par le Sous-<\/span>traitant<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>concertation<\/span>\u00a0<\/span>avec<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>. Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>peut<\/span>\u00a0\u00e0\u00a0<\/span>tout<\/span>\u00a0<\/span>moment<\/span>\u00a0<\/span>demander<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>version<\/span>\u00a0<\/span>actuelle<\/span>\u00a0des\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>prises<\/span>\u00a0par le Sous-<\/span>traitant<\/span>.<\/span><\/span><\/span><\/p>

    \u00a0<\/h3>

    15. Dur\u00e9e du contrat<\/strong><\/h3>

    15.1<\/b> Le\u00a0<\/span>pr\u00e9sent<\/span>\u00a0DPA\u00a0<\/span>prend<\/span>\u00a0<\/span>effet<\/span>\u00a0\u00e0 la\u00a0<\/span>conclusion<\/span>\u00a0du\u00a0<\/span>contrat<\/span>\u00a0<\/span>principal<\/span>\u00a0<\/span>ou<\/span>\u00a0\u00e0\u00a0<\/span>l’acceptation<\/span>\u00a0par le Responsable du\u00a0<\/span>traitement<\/span>\u00a0des\u00a0<\/span>conditions<\/span>\u00a0<\/span>g\u00e9n\u00e9rales<\/span>\u00a0du Sous-<\/span>traitant<\/span>\u00a0<\/span>sous<\/span>\u00a0forme\u00a0<\/span>\u00e9lectronique<\/span>\u00a0(art. 28,\u00a0<\/span>paragraphe<\/span>\u00a09, du RGPD) et\u00a0<\/span>court<\/span>\u00a0<\/span>pour<\/span>\u00a0la\u00a0<\/span>dur\u00e9e<\/span>\u00a0du\u00a0<\/span>contrat<\/span>\u00a0<\/span>principal<\/span>\u00a0<\/span>existant<\/span>\u00a0entre\u00a0<\/span>les<\/span>\u00a0<\/span>parties.<\/span><\/span><\/p>

    15.2<\/b> Le Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>r\u00e9silier<\/span>\u00a0le\u00a0<\/span>contrat<\/span>\u00a0\u00e0\u00a0<\/span>tout<\/span>\u00a0<\/span>moment<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>pr\u00e9avis<\/span>\u00a0en\u00a0<\/span>cas<\/span>\u00a0de\u00a0<\/span>violation<\/span>\u00a0grave par le Sous-<\/span>traitant<\/span>\u00a0des\u00a0<\/span>dispositions<\/span>\u00a0<\/span>applicables<\/span>\u00a0en\u00a0<\/span>mati\u00e8re<\/span>\u00a0de\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>ou<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>d\u00e9coulant<\/span>\u00a0du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>,\u00a0<\/span>lorsque<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0ne\u00a0<\/span>peut<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>ne<\/span>\u00a0veut\u00a0<\/span>pas<\/span>\u00a0<\/span>ex\u00e9cuter<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>instruction<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>ou<\/span>\u00a0<\/span>lorsque<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>refuse<\/span>\u00a0<\/span>l’acc\u00e8s<\/span>\u00a0au Responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>ou<\/span>\u00a0\u00e0\u00a0<\/span>l’autorit\u00e9<\/span>\u00a0de\u00a0<\/span>contr\u00f4le<\/span>\u00a0<\/span>comp\u00e9tente<\/span>\u00a0en\u00a0<\/span>violation<\/span>\u00a0du\u00a0<\/span>contrat<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    16. Fin du contrat<\/strong><\/h3>

    16.1<\/b> \u00c0\u00a0<\/span>l’issue<\/span>\u00a0du\u00a0<\/span>contrat<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>, au\u00a0<\/span>choix<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>restituer<\/span>\u00a0\u00e0\u00a0<\/span>celui<\/span>-ci\u00a0<\/span>ou<\/span>\u00a0<\/span>effacer<\/span>\u00a0<\/span>l’ensemble<\/span>\u00a0des\u00a0<\/span>documents<\/span>,\u00a0<\/span>donn\u00e9es<\/span>\u00a0et\u00a0<\/span>r\u00e9sultats<\/span>\u00a0de\u00a0<\/span>traitement<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>d’utilisation<\/span>\u00a0<\/span>\u00e9tablis<\/span>\u00a0<\/span>qui<\/span>\u00a0<\/span>sont<\/span>\u00a0en\u00a0<\/span>sa<\/span>\u00a0<\/span>possession<\/span>\u00a0et\u00a0<\/span>qui<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>li\u00e9s<\/span>\u00a0\u00e0 la\u00a0<\/span>relation<\/span>\u00a0<\/span>contractuelle<\/span>.\u00a0<\/span>L’effacement<\/span>\u00a0<\/span>doit<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>document\u00e9<\/span>\u00a0de\u00a0<\/span>mani\u00e8re<\/span>\u00a0<\/span>appropri\u00e9e<\/span>.<\/span><\/span><\/p>

    16.2<\/b> Le Sous-<\/span>traitant<\/span>\u00a0<\/span>peut<\/span>\u00a0<\/span>conserver<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>trait\u00e9es<\/span>\u00a0<\/span>dans<\/span>\u00a0le\u00a0<\/span>cadre<\/span>\u00a0du\u00a0<\/span>contrat<\/span>\u00a0au-<\/span>del\u00e0<\/span>\u00a0de la fin du\u00a0<\/span>contrat<\/span>, si et\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>obligation<\/span>\u00a0<\/span>l\u00e9gale<\/span>\u00a0de\u00a0<\/span>conservation<\/span>\u00a0<\/span>incombe<\/span>\u00a0au Sous-<\/span>traitant<\/span>. Dans\u00a0<\/span>ces<\/span>\u00a0<\/span>cas<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0ne\u00a0<\/span>peuvent<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>trait\u00e9es<\/span>\u00a0<\/span>qu’aux<\/span>\u00a0<\/span>fins<\/span>\u00a0de la\u00a0<\/span>mise<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0de\u00a0<\/span>conservation<\/span>\u00a0<\/span>concern\u00e9es<\/span>. \u00c0\u00a0<\/span>l’expiration<\/span>\u00a0de\u00a0<\/span>l’obligation<\/span>\u00a0de\u00a0<\/span>conservation<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>doivent<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>effac\u00e9es<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>.<\/span><\/span><\/p>

    \u00a0<\/h3>

    17. Dispositions finales<\/strong><\/h3>

    17.1<\/b> Si la\u00a0<\/span>propri\u00e9t\u00e9<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>\u00a0se\u00a0<\/span>trouvant<\/span>\u00a0<\/span>chez<\/span>\u00a0le Sous-<\/span>traitant<\/span>\u00a0<\/span>venait<\/span>\u00a0\u00e0\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>menac\u00e9e<\/span>\u00a0par des\u00a0<\/span>mesures<\/span>\u00a0de\u00a0<\/span>tiers<\/span>\u00a0(par exemple par\u00a0<\/span>une<\/span>\u00a0<\/span>saisie<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>confiscation<\/span>), par\u00a0<\/span>une<\/span>\u00a0<\/span>proc\u00e9dure<\/span>\u00a0<\/span>d’insolvabilit\u00e9<\/span>\u00a0<\/span>ou<\/span>\u00a0par\u00a0<\/span>d’autres<\/span>\u00a0<\/span>\u00e9v\u00e9nements<\/span>, le Sous-<\/span>traitant<\/span>\u00a0<\/span>doit<\/span>\u00a0en\u00a0<\/span>informer<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0le Responsable du\u00a0<\/span>traitement<\/span>. Le Sous-<\/span>traitant<\/span>\u00a0<\/span>informe<\/span>\u00a0<\/span>sans<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>cr\u00e9anciers<\/span>\u00a0du fait\u00a0<\/span>qu’il<\/span>\u00a0<\/span>s’agit<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>trait\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0<\/span>d’autrui<\/span>.<\/span><\/span><\/p>

    17.2<\/b> La forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte) (\u00a7 126b BGB)\u00a0<\/span>s’applique<\/span>\u00a0aux\u00a0<\/span>accords<\/span>\u00a0<\/span>annexes<\/span>,\u00a0<\/span>modifications<\/span>\u00a0et\u00a0<\/span>compl\u00e9ments<\/span>\u00a0du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0;\u00a0<\/span>cela<\/span>\u00a0<\/span>vaut<\/span>\u00a0<\/span>\u00e9galement<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>toute<\/span>\u00a0<\/span>modification<\/span>\u00a0de la\u00a0<\/span>pr\u00e9sente<\/span>\u00a0<\/span>clause<\/span>\u00a0de forme\u00a0<\/span>\u00e9crite<\/span>\u00a0(texte)<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    17.3<\/b> Si\u00a0<\/span>certaines<\/span>\u00a0<\/span>parties<\/span>\u00a0du\u00a0<\/span>pr\u00e9sent<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>devaient<\/span>\u00a0<\/span>\u00eatre<\/span>\u00a0<\/span>inapplicables<\/span>,\u00a0<\/span>cela<\/span>\u00a0<\/span>n’affecte<\/span>\u00a0<\/span>pas<\/span>\u00a0la\u00a0<\/span>validit\u00e9<\/span>\u00a0des\u00a0<\/span>autres<\/span>\u00a0<\/span>dispositions<\/span>\u00a0du\u00a0<\/span>contrat<\/span>.<\/span><\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Annexe 1 – Objet du contrat\u00a0<\/strong><\/h3>

    L’objet du contrat r\u00e9sulte du contrat principal (offre, accompagn\u00e9e de l’annexe au bordereau des prestations et de la confirmation de commande du Sous-traitant).\u00a0<\/span>\u00a0<\/span><\/p>

    Dur\u00e9e<\/strong> : dur\u00e9e du contrat principal major\u00e9e des d\u00e9lais l\u00e9gaux de conservation. <\/span>\u00a0<\/span><\/p>
    Type de donn\u00e9es<\/strong><\/th>Finalit\u00e9 du traitement<\/strong><\/th>Cat\u00e9gories de personnes concern\u00e9es<\/strong><\/th><\/tr><\/thead>
    Nom (pr\u00e9nom, nom de famille)Adresse e-mailNum\u00e9ro de t\u00e9l\u00e9phone (professionnel) \u2013 facultatif<\/td>Cr\u00e9ation d\u2019un compte utilisateur et identification lors de la transmission du mot de passe<\/td>Collaborateurs ayant acc\u00e8s \u00e0 l\u2019interface d\u2019administration<\/td><\/tr>
    Adresse e-mailNum\u00e9ro de tag RFID, num\u00e9ro de carte de recharge (le cas \u00e9ch\u00e9ant) et nom de la carte<\/td>Cr\u00e9ation d\u2019un compte utilisateur et identification lors de la transmission du mot de passe<\/td>

    \u2022 Collaborateurs en tant que conducteurs de VE (v\u00e9hicules \u00e9lectriques)<\/p>

    \u2022 Autres personnes (invit\u00e9s, sous-traitants) en tant que conducteurs de VE r\u00e9guli\u00e8rement autoris\u00e9s \u00e0 utiliser l\u2019infrastructure de recharge<\/p><\/td><\/tr>

    Nom de famille, pr\u00e9nomAdresse (rue, num\u00e9ro, code postal, ville)<\/td>Facturation des sessions de recharge effectu\u00e9es<\/td>

    \u2022 Collaborateurs en tant que conducteurs de VE<\/p>

    \u2022 Autres personnes (invit\u00e9s, sous-traitants) en tant que conducteurs de VE r\u00e9guli\u00e8rement autoris\u00e9s \u00e0 utiliser l\u2019infrastructure de recharge<\/p><\/td><\/tr>

    Scan du certificat d\u2019immatriculation du v\u00e9hiculeCoordonn\u00e9es bancaires :<\/p>

    \u2022 Titulaire du compte (nom, pr\u00e9nom)<\/p>

    \u2022 IBAN<\/p><\/td>

    		Traitement et r\u00e8glement des \u00e9changes de quotas de r\u00e9duction des \u00e9missions de gaz \u00e0 effet de serre<\/td>Collaborateurs en tant que conducteurs de VE<\/td><\/tr>

    Donn\u00e9es relatives aux v\u00e9hicules de soci\u00e9t\u00e9 :<\/p>

    \u2022 Num\u00e9ro d\u2019immatriculation<\/p>

    \u2022 Num\u00e9ro de tag RFID<\/p>

    \u2022 Facultatif : fabricant, marque<\/p><\/td>

    		Autorisation et attribution des sessions de recharge<\/td>D\u00e9tenteurs des v\u00e9hicules de soci\u00e9t\u00e9 du client<\/td><\/tr>
    Scan du certificat d\u2019immatriculation du v\u00e9hicule<\/td>Traitement des \u00e9changes de quotas de r\u00e9duction des \u00e9missions de gaz \u00e0 effet de serre<\/td>D\u00e9tenteurs des v\u00e9hicules de soci\u00e9t\u00e9 du client<\/td><\/tr>

    Donn\u00e9es relatives aux sessions de recharge :<\/p>

    \u2022 Borne de recharge et connecteur<\/p>

    \u2022 Num\u00e9ro de tag RFID du conducteur ou du v\u00e9hicule<\/p>

    \u2022 D\u00e9but et fin<\/p>

    \u2022 Quantit\u00e9 d\u2019\u00e9nergie charg\u00e9e, \u00e9tat de la recharge et puissance de recharge toutes les 5 minutes pendant la session<\/p>

    \u2022 Tarif<\/p><\/td>

    		Autorisation, attribution et facturation des sessions de recharge<\/td>

    \u2022 Collaborateurs en tant que conducteurs de VE<\/p>

    \u2022 Autres personnes (invit\u00e9s, sous-traitants) en tant que conducteurs de VE r\u00e9guli\u00e8rement autoris\u00e9s \u00e0 utiliser l\u2019infrastructure de recharge<\/p>

    \u2022 D\u00e9tenteurs des v\u00e9hicules de soci\u00e9t\u00e9 du client<\/p><\/td><\/tr>

    \u2022 Coordonn\u00e9es g\u00e9ographiques de l\u2019installation photovolta\u00efque\/\u00e9olienne (emplacement)<\/p>

    \u2022 Donn\u00e9es d\u2019exploitation\/de comptage de l\u2019installation<\/p>

    \u2022 Adresse e-mail de contact<\/p><\/td>

    		\u00c9tablissement de pr\u00e9visions de production et de demande d\u2019\u00e9nergie<\/td>Exploitants priv\u00e9s d\u2019installations (dans la mesure o\u00f9 l\u2019installation peut \u00eatre attribu\u00e9e \u00e0 une personne physique), interlocuteurs du client<\/td><\/tr>

    \u2022 Donn\u00e9es du compte v\u00e9hicule (autorisation\/r\u00f4le de l\u2019utilisateur, statut d\u2019appairage de la cl\u00e9 num\u00e9rique)<\/p>

    \u2022 Donn\u00e9es du v\u00e9hicule et de recharge (limites de recharge, capacit\u00e9 de la batterie, \u00e9tat de charge, kilom\u00e9trage, identification du v\u00e9hicule)<\/p><\/td>

    		Connexion des v\u00e9hicules \u00e9lectriques via l\u2019API Smartcar afin de fournir les donn\u00e9es de batterie et de recharge<\/td>D\u00e9tenteurs\/utilisateurs des v\u00e9hicules \u00e9lectriques connect\u00e9s<\/td><\/tr>

    Donn\u00e9es relatives aux sessions de recharge \u00ab at work \u00bb, si l\u2019option a \u00e9t\u00e9 souscrite :<\/p>

    \u2022 Donn\u00e9es relatives au conducteur (nom\/e-mail, ID de carte de recharge\/tagUid, type de carte)<\/p>

    \u2022 Cas d\u2019utilisation (p. ex. Charge at Work)<\/p>

    \u2022 IDX (ID de la session de recharge)<\/p>

    \u2022 Date de recharge<\/p>

    \u2022 Dur\u00e9e de la session de recharge (heure de d\u00e9but et de fin ainsi que dur\u00e9e totale de la session)<\/p>

    \u2022 Consommation d\u2019\u00e9lectricit\u00e9 en kW<\/p>

    \u2022 Co\u00fbts<\/p>

    \u2022 Tarif, justificatif<\/p><\/td>

    		Mise \u00e0 disposition des donn\u00e9es relatives aux sessions de recharge via une interface API \u00e0 LOCIO GmbH pour leur affichage dans le tableau de bord de gestion de flotte du responsable du traitement<\/td>Conducteurs de v\u00e9hicules de soci\u00e9t\u00e9 du responsable du traitement utilisant l\u2019infrastructure de recharge sur leur lieu de travail<\/td><\/tr>

    Donn\u00e9es statistiques relatives au comportement d\u2019utilisation (pseudonymis\u00e9es) :<\/p>

    \u2022 Utilisation de l\u2019infrastructure de recharge \u2013 fr\u00e9quence, quantit\u00e9 d\u2019\u00e9nergie et emplacement par utilisateur<\/p><\/td>

    		Am\u00e9lioration du produit<\/td>

    \u2022 Collaborateurs ayant acc\u00e8s \u00e0 l\u2019interface d\u2019administration<\/p>

    \u2022 Collaborateurs en tant que conducteurs de VE<\/p>

    \u2022 Autres personnes (invit\u00e9s, sous-traitants) en tant que conducteurs de VE r\u00e9guli\u00e8rement autoris\u00e9s \u00e0 utiliser l\u2019infrastructure de recharge<\/p><\/td><\/tr><\/tbody><\/table>

    \u00a0<\/p>

    Annexe 2 – Sous-traitants\u00a0<\/strong><\/h3>

    Le\u00a0<\/span><\/span>Sous-<\/span>traitant<\/span><\/span>\u00a0<\/span>recourt<\/span>,\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>traitement<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0du Responsable du\u00a0<\/span>traitement<\/span>, \u00e0 des <\/span>prestations<\/span>\u00a0de\u00a0<\/span>tiers<\/span>\u00a0<\/span>qui<\/span>\u00a0<\/span>traitent<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>son<\/span>\u00a0<\/span>compte<\/span>\u00a0(\u00ab\u00a0<\/span>sous-traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0\u00bb).<\/span><\/span>\u00a0<\/span><\/p>

    Il s’agit des entreprises suivantes :<\/span><\/p>
    Sous-traitant<\/strong><\/th>Objet de la sous-traitance<\/strong><\/th>Lieu du traitement<\/strong><\/th>Transfert de donn\u00e9es vers des pays tiers (base juridique)<\/strong><\/th><\/tr><\/thead>
    Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L1855 Luxembourg<\/td>Infrastructure cloud et CDN<\/td>Allemagne \/ UE<\/td>\/<\/td><\/tr>
    Intercom R&D Unlimited Company, 124 St Stephen’s Green, Dublin 2, D02 C628, Irlande<\/td>Support et chat en direct<\/td>Irlande \/ UE<\/td>\/<\/td><\/tr>
    PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, \u00c9tats-Unis (serveurs \u00e0 Francfort, Allemagne)<\/td>Analyse des produits et de leur utilisation \u00e0 des fins d\u2019am\u00e9lioration des produits<\/td>Allemagne \/ UE<\/td>\/<\/td><\/tr>
    enercast GmbH, Universit\u00e4tsplatz 12, 34127 Kassel<\/td>Pr\u00e9visions \u00e9nerg\u00e9tiques (pr\u00e9visions de production et de demande pour les installations photovolta\u00efques\/\u00e9oliennes)<\/td>Allemagne<\/td>\/<\/td><\/tr>
    Smartcar, Inc., 650 Castro Street, Ste 120-99699, Mountain View, CA 94041<\/td>Int\u00e9gration des donn\u00e9es du v\u00e9hicule (donn\u00e9es de recharge et de batterie)<\/td>\u00c9tats-Unis<\/td>D\u00e9cision d\u2019ad\u00e9quation conform\u00e9ment \u00e0 l\u2019art. 45 du RGPD. Smartcar est certifi\u00e9e dans le cadre du EU-U.S. Data Privacy Framework.<\/td><\/tr><\/tbody><\/table>

    \u00a0<\/h3>

    Annexe 3 – Mesures techniques et organisationnelles<\/strong><\/h3>

    1. Introduction\u00a0<\/span><\/strong><\/h3>

    Conform\u00e9ment \u00e0 l’art. 32 du RGPD, reev GmbH (\u00ab reev \u00bb) met en \u0153uvre des mesures techniques et organisationnelles appropri\u00e9es afin de garantir un niveau de protection adapt\u00e9 au risque. \u00c0 cet \u00e9gard, reev tient compte de l’\u00e9tat de l’art, des co\u00fbts de mise en \u0153uvre ainsi que de la nature, de l’\u00e9tendue, des circonstances et des finalit\u00e9s du traitement, de m\u00eame que de la probabilit\u00e9 de survenance et de la gravit\u00e9 du risque pour les droits et libert\u00e9s des personnes physiques. <\/span>\u00a0<\/span><\/p>

    Ces mesures visent \u00e0 prot\u00e9ger les donn\u00e9es \u00e0 caract\u00e8re personnel contre tout traitement non autoris\u00e9 ou illicite ainsi que contre la perte, la destruction, l’alt\u00e9ration, la divulgation accidentelles ou l’acc\u00e8s non autoris\u00e9. Les mesures d\u00e9crites ci-apr\u00e8s s’appliquent au traitement de donn\u00e9es \u00e0 caract\u00e8re personnel effectu\u00e9 par reev dans le cadre des produits, services, processus internes et de l’infrastructure cloud de soutien de reev, sauf disposition contraire pr\u00e9vue dans un accord sp\u00e9cifique au client. <\/span>\u00a0<\/span><\/p>

    reev exploite un syst\u00e8me de management de la s\u00e9curit\u00e9 de l’information (SMSI) certifi\u00e9 selon la norme ISO\/IEC 27001. La mise en \u0153uvre, la surveillance et la d\u00e9monstration des contr\u00f4les de s\u00e9curit\u00e9 peuvent \u00eatre appuy\u00e9es par des outils de conformit\u00e9 appropri\u00e9s, y compris Vanta. <\/span>\u00a0<\/span><\/p>

    \u00a0<\/h3>

    2. Mesures techniques<\/span><\/b>\u00a0<\/span><\/h3>
    2.1 Confidentialit\u00e9<\/span><\/b><\/h5>
    Contr\u00f4le d’acc\u00e8s<\/strong><\/h6>

    L’acc\u00e8s aux informations, syst\u00e8mes, applications, infrastructures et donn\u00e9es \u00e0 caract\u00e8re personnel est limit\u00e9 aux personnes autoris\u00e9es et est accord\u00e9 conform\u00e9ment aux besoins op\u00e9rationnels ainsi que selon le principe du moindre privil\u00e8ge. reev applique un strict principe du besoin d’en conna\u00eetre (need-to-know). <\/span>\u00a0<\/span><\/p>

    Les droits d’acc\u00e8s sont attribu\u00e9s, adapt\u00e9s, v\u00e9rifi\u00e9s et retir\u00e9s conform\u00e9ment \u00e0 la Access Control Policy de reev ainsi que selon des processus d\u00e9finis pour les arriv\u00e9es, mutations et d\u00e9parts (joiner, mover, leaver). Les acc\u00e8s sont r\u00e9voqu\u00e9s ou adapt\u00e9s lorsque des employ\u00e9s changent de r\u00f4le ou quittent l’entreprise. Les acc\u00e8s privil\u00e9gi\u00e9s sont limit\u00e9s aux personnes autoris\u00e9es et soumis \u00e0 des contr\u00f4les suppl\u00e9mentaires. <\/span>\u00a0<\/p>

    Authentification\u00a0<\/strong><\/h6>

    reev utilise des m\u00e9canismes d’authentification s\u00e9curis\u00e9s afin d’emp\u00eacher tout acc\u00e8s non autoris\u00e9 aux syst\u00e8mes d’information. L’authentification multifacteur (MFA) est requise pour l’acc\u00e8s aux environnements de production ainsi que pour d’autres syst\u00e8mes, dans la mesure o\u00f9 cela est requis sur la base du risque et selon la criticit\u00e9. <\/span>\u00a0<\/span><\/p>

    Dans la mesure o\u00f9 cela est techniquement possible, une gestion centralis\u00e9e des identit\u00e9s et des acc\u00e8s, des contr\u00f4les d’acc\u00e8s bas\u00e9s sur les r\u00f4les ainsi que des exigences s\u00e9curis\u00e9es en mati\u00e8re de mots de passe ou d’authentification sont appliqu\u00e9s.<\/span>\u00a0<\/p>

    Chiffrement des donn\u00e9es au repos\u00a0<\/strong><\/h6>

    Les donn\u00e9es confidentielles au repos sont prot\u00e9g\u00e9es par des m\u00e9canismes de chiffrement robustes, y compris le chiffrement AES-256 bits, dans la mesure applicable, conform\u00e9ment \u00e0 la Cryptography Policy de reev. Les cl\u00e9s de chiffrement et les secrets sont g\u00e9r\u00e9s au moyen de m\u00e9canismes contr\u00f4l\u00e9s de gestion des cl\u00e9s et des secrets. L’acc\u00e8s aux cl\u00e9s de chiffrement et aux secrets est limit\u00e9 aux syst\u00e8mes et personnes autoris\u00e9s ; les cl\u00e9s sont renouvel\u00e9es conform\u00e9ment aux exigences de s\u00e9curit\u00e9 internes. <\/span>\u00a0<\/p>

    Chiffrement lors de la transmission\u00a0<\/strong><\/h6>

    Les donn\u00e9es transmises via des r\u00e9seaux publics sont prot\u00e9g\u00e9es au moyen du Transport Layer Security (TLS) et de suites de chiffrement robustes. Les services accessibles publiquement sont configur\u00e9s et r\u00e9guli\u00e8rement v\u00e9rifi\u00e9s de mani\u00e8re \u00e0 maintenir des configurations TLS s\u00e9curis\u00e9es. reev s’efforce de faire en sorte que les points d’acc\u00e8s publics respectent les normes reconnues du secteur en mati\u00e8re de chiffrement du transport. <\/span><\/p>

    S\u00e9curit\u00e9 physique\u00a0<\/strong><\/h6>

    reev met en \u0153uvre des mesures destin\u00e9es \u00e0 emp\u00eacher tout acc\u00e8s physique non autoris\u00e9 aux installations de traitement de l’information. Des contr\u00f4les d’acc\u00e8s physique, des zones de s\u00e9curit\u00e9 et des contr\u00f4les d’acc\u00e8s sont appliqu\u00e9s conform\u00e9ment \u00e0 la Physical Security Policy de reev. Dans la mesure o\u00f9 l’infrastructure est h\u00e9berg\u00e9e chez des fournisseurs tiers de services cloud, la s\u00e9curit\u00e9 physique est couverte par les contr\u00f4les certifi\u00e9s des centres de donn\u00e9es et les engagements contractuels de s\u00e9curit\u00e9 du fournisseur concern\u00e9. <\/span>\u00a0<\/p>

    S\u00e9paration des donn\u00e9es et s\u00e9paration logique\u00a0<\/strong><\/h6>

    Dans la mesure applicable, les donn\u00e9es des clients sont logiquement s\u00e9par\u00e9es afin d’emp\u00eacher tout acc\u00e8s non autoris\u00e9 entre clients, environnements et syst\u00e8mes. Les environnements de production, de d\u00e9veloppement et de test sont s\u00e9par\u00e9s les uns des autres ; les donn\u00e9es de production ne sont pas utilis\u00e9es dans des environnements hors production, sauf si elles sont prot\u00e9g\u00e9es de mani\u00e8re appropri\u00e9e et que leur utilisation est autoris\u00e9e. <\/span>\u00a0<\/p>

    Pseudonymisation, masquage et minimisation des donn\u00e9es\u00a0<\/strong><\/h6>

    Dans la mesure appropri\u00e9e et techniquement possible, reev recourt \u00e0 la minimisation des donn\u00e9es, \u00e0 la pseudonymisation, au masquage, \u00e0 l’agr\u00e9gation ou \u00e0 des restrictions d’acc\u00e8s afin de r\u00e9duire la divulgation de donn\u00e9es \u00e0 caract\u00e8re personnel et de limiter le traitement \u00e0 ce qui est n\u00e9cessaire \u00e0 la finalit\u00e9 concern\u00e9e.<\/span>\u00a0<\/span><\/p>

    2.2 Int\u00e9grit\u00e9<\/span><\/b>\u00a0<\/span><\/h5>
    Gestion des changements\u00a0<\/strong><\/h6>

    Les modifications substantielles apport\u00e9es aux syst\u00e8mes, r\u00e9seaux, infrastructures et installations de traitement sont document\u00e9es, v\u00e9rifi\u00e9es, test\u00e9es et approuv\u00e9es avant leur d\u00e9ploiement dans l’environnement de production. Les modifications sont test\u00e9es dans des environnements s\u00e9par\u00e9s de la production, par exemple dans des environnements de staging ou de d\u00e9veloppement. <\/span>\u00a0<\/span><\/p>

    Les modifications d’urgence font l’objet d’une v\u00e9rification et d’une documentation appropri\u00e9es apr\u00e8s leur mise en \u0153uvre. Les proc\u00e9dures de gestion des changements visent \u00e0 r\u00e9duire le risque de modifications non autoris\u00e9es, non test\u00e9es ou involontaires des syst\u00e8mes de production. <\/span>\u00a0<\/p>

    D\u00e9veloppement s\u00e9curis\u00e9\u00a0<\/strong><\/h6>

    reev applique des principes de d\u00e9veloppement s\u00e9curis\u00e9 et des normes d’ing\u00e9nierie aux activit\u00e9s de d\u00e9veloppement logiciel. Les environnements de d\u00e9veloppement, de test, de staging et de production sont s\u00e9par\u00e9s les uns des autres. L’acc\u00e8s aux d\u00e9p\u00f4ts de code source et aux pipelines de d\u00e9ploiement est limit\u00e9 aux personnes autoris\u00e9es. <\/span>\u00a0<\/span><\/p>

    Les aspects de s\u00e9curit\u00e9 sont int\u00e9gr\u00e9s au cycle de vie de d\u00e9veloppement, y compris les revues de code, les tests, la gestion des d\u00e9pendances et les pratiques de configuration s\u00e9curis\u00e9e.<\/span>\u00a0<\/p>

    Journalisation et surveillance\u00a0<\/strong><\/h6>

    L’infrastructure de production et les applications pertinentes sont configur\u00e9es de mani\u00e8re \u00e0 g\u00e9n\u00e9rer des journaux des \u00e9v\u00e9nements relatifs \u00e0 la s\u00e9curit\u00e9, y compris les \u00e9v\u00e9nements d’authentification des utilisateurs, les acc\u00e8s aux syst\u00e8mes, les activit\u00e9s administratives, les op\u00e9rations CRUD pertinentes et les modifications des param\u00e8tres de s\u00e9curit\u00e9, dans la mesure o\u00f9 cela est techniquement possible.<\/span>\u00a0<\/span><\/p>

    Les journaux sont prot\u00e9g\u00e9s contre tout acc\u00e8s, toute modification et toute suppression non autoris\u00e9s. Les journaux sont conserv\u00e9s pendant une dur\u00e9e d\u00e9termin\u00e9e qui d\u00e9pend de la criticit\u00e9 du syst\u00e8me, des exigences l\u00e9gales, des obligations contractuelles et des besoins op\u00e9rationnels. Les journaux de production pertinents sont conserv\u00e9s pendant au moins 30 jours, sauf si une dur\u00e9e de conservation plus longue s’applique. <\/span>\u00a0<\/p>

    Protection de l’int\u00e9grit\u00e9\u00a0<\/strong><\/h6>

    reev met en \u0153uvre des contr\u00f4les destin\u00e9s \u00e0 prot\u00e9ger les syst\u00e8mes et les donn\u00e9es contre toute modification non autoris\u00e9e, y compris des restrictions d’acc\u00e8s, la gestion des changements, la journalisation, la surveillance, des proc\u00e9dures de sauvegarde et des processus de d\u00e9ploiement s\u00e9curis\u00e9s.<\/span>\u00a0<\/span><\/p>

    2.3 Disponibilit\u00e9 et r\u00e9silience<\/span><\/b>\u00a0<\/span><\/h5>
    Sauvegarde des donn\u00e9es\u00a0<\/strong><\/h6>

    Des sauvegardes des syst\u00e8mes et bases de donn\u00e9es pertinents sont effectu\u00e9es quotidiennement. Les sauvegardes sont stock\u00e9es s\u00e9par\u00e9ment des donn\u00e9es de production et prot\u00e9g\u00e9es contre tout acc\u00e8s non autoris\u00e9. reev utilise, dans la mesure applicable, la Cross-Region Replication (CRR) dans AWS afin de soutenir la redondance, la r\u00e9silience et la reprise apr\u00e8s sinistre (disaster recovery). <\/span>\u00a0<\/span><\/p>

    Les donn\u00e9es de sauvegarde sont prot\u00e9g\u00e9es par des mesures techniques et organisationnelles appropri\u00e9es, y compris des restrictions d’acc\u00e8s et le chiffrement, dans la mesure applicable.<\/span>\u00a0<\/p>

    Tests de restauration\u00a0<\/strong><\/h6>

    La restaurabilit\u00e9 des sauvegardes est test\u00e9e au moins une fois par an afin de valider l’int\u00e9grit\u00e9 des donn\u00e9es, les proc\u00e9dures de restauration et la pr\u00e9paration op\u00e9rationnelle. Les r\u00e9sultats des tests de restauration sont document\u00e9s et examin\u00e9s ; les probl\u00e8mes identifi\u00e9s sont trait\u00e9s par des mesures correctives appropri\u00e9es. <\/span>\u00a0<\/p>

    Redondance et r\u00e9silience\u00a0<\/strong><\/h6>

    Les installations de traitement de l’information sont mises en \u0153uvre avec une redondance suffisante afin de satisfaire aux exigences de disponibilit\u00e9 et de r\u00e9silience. reev recourt \u00e0 des contr\u00f4les d’infrastructure et d’architecture cloud appropri\u00e9s afin de r\u00e9duire le risque d’interruptions de service et de perte de donn\u00e9es. <\/span>\u00a0<\/span><\/p>

    Les donn\u00e9es \u00e0 caract\u00e8re personnel trait\u00e9es dans la plateforme reev sont par d\u00e9faut h\u00e9berg\u00e9es dans des centres de donn\u00e9es AWS situ\u00e9s au sein de l’Union europ\u00e9enne, en particulier dans la r\u00e9gion eu-central-1, Frankfurt am Main. Dans la mesure o\u00f9 la Cross-Region Replication est utilis\u00e9e, celle-ci s’effectue au sein de l’Union europ\u00e9enne ou de l’Espace \u00e9conomique europ\u00e9en. Un traitement de donn\u00e9es \u00e0 caract\u00e8re personnel en dehors de l’UE\/de l’EEE n’a lieu que conform\u00e9ment aux r\u00e8gles relatives aux transferts internationaux d\u00e9crites \u00e0 la clause 3.4. <\/span>\u00a0<\/p>

    Continuit\u00e9 des activit\u00e9s et reprise apr\u00e8s sinistre\u00a0<\/strong><\/h6>

    reev maintient des mesures de continuit\u00e9 d’activit\u00e9 (business continuity) et de reprise apr\u00e8s sinistre (disaster recovery) pour les syst\u00e8mes et processus critiques. Ces mesures sont con\u00e7ues pour soutenir la disponibilit\u00e9 continue des services ainsi que le r\u00e9tablissement rapide de l’acc\u00e8s aux donn\u00e9es \u00e0 caract\u00e8re personnel en cas d’incident physique ou technique, conform\u00e9ment \u00e0 l’art. 32 du RGPD. <\/span>\u00a0<\/span><\/p>

    Les proc\u00e9dures de restauration et les responsabilit\u00e9s sont d\u00e9finies et r\u00e9guli\u00e8rement v\u00e9rifi\u00e9es.<\/span>\u00a0<\/span><\/p>

    2.4 Gestion des vuln\u00e9rabilit\u00e9s, des correctifs et des logiciels malveillants<\/span><\/b>\u00a0<\/span><\/h5>
    Gestion technique des vuln\u00e9rabilit\u00e9s\u00a0<\/strong><\/h6>

    reev obtient des informations sur les vuln\u00e9rabilit\u00e9s techniques au moyen de scans de vuln\u00e9rabilit\u00e9s, d’avis de fournisseurs, de la surveillance des d\u00e9pendances, d’alertes de s\u00e9curit\u00e9 et de tests d’intrusion. Les vuln\u00e9rabilit\u00e9s sont \u00e9valu\u00e9es sur la base de leur gravit\u00e9, de leur exploitabilit\u00e9, de l’exposition et des impacts potentiels.
    Les vuln\u00e9rabilit\u00e9s critiques sont corrig\u00e9es ou att\u00e9nu\u00e9es sans d\u00e9lai sur la base du risque. <\/span>\u00a0<\/span><\/p>

    Les vuln\u00e9rabilit\u00e9s \u00e0 haut risque sont corrig\u00e9es dans des d\u00e9lais internes d\u00e9finis, en principe dans un d\u00e9lai de 30 jours, dans la mesure o\u00f9 cela est techniquement et op\u00e9rationnellement possible, sauf si une d\u00e9rogation document\u00e9e fond\u00e9e sur le risque s’applique. <\/span>\u00a0<\/p>

    Gestion des correctifs\u00a0<\/strong><\/h6>

    Les mises \u00e0 jour de s\u00e9curit\u00e9 sont \u00e9valu\u00e9es et appliqu\u00e9es sur la base du risque, de la gravit\u00e9 et de la criticit\u00e9 du syst\u00e8me. Les proc\u00e9dures de gestion des correctifs sont con\u00e7ues pour r\u00e9duire l’exposition aux vuln\u00e9rabilit\u00e9s connues tout en maintenant la stabilit\u00e9 et la disponibilit\u00e9 des syst\u00e8mes. <\/span>\u00a0<\/p>

    Tests d’intrusion et \u00e9valuations de s\u00e9curit\u00e9\u00a0<\/strong><\/h6>

    reev r\u00e9alise des tests d’intrusion au moins une fois par an et proc\u00e8de \u00e0 des \u00e9valuations de s\u00e9curit\u00e9 suppl\u00e9mentaires, dans la mesure o\u00f9 cela est appropri\u00e9, par exemple apr\u00e8s des modifications substantielles des syst\u00e8mes ou de l’architecture. Les constatations sont examin\u00e9es, hi\u00e9rarchis\u00e9es et corrig\u00e9es sur la base du risque. <\/span>\u00a0<\/p>

    Protection contre les logiciels malveillants\u00a0<\/strong><\/h6>

    Des mesures de protection anti-logiciels malveillants et de protection des terminaux (endpoint protection) sont d\u00e9ploy\u00e9es sur les terminaux fournis par reev et sur les syst\u00e8mes de messagerie pertinents. Les m\u00e9canismes de protection sont, dans la mesure o\u00f9 cela est techniquement possible, configur\u00e9s de mani\u00e8re \u00e0 \u00eatre mis \u00e0 jour automatiquement. <\/span>\u00a0<\/span><\/p>

    2.5 V\u00e9rification, \u00e9valuation et appr\u00e9ciation r\u00e9guli\u00e8res<\/span><\/b>\u00a0<\/span><\/h5>

    reev teste, appr\u00e9cie et \u00e9value r\u00e9guli\u00e8rement l’efficacit\u00e9 des mesures techniques et organisationnelles au moyen de revues internes, d’\u00e9valuations de vuln\u00e9rabilit\u00e9s, de tests d’intrusion, d’\u00e9valuations des risques, d’activit\u00e9s de surveillance, d’audits et de v\u00e9rifications des contr\u00f4les ISO\/IEC 27001. Les faiblesses identifi\u00e9es font l’objet d’un suivi et sont trait\u00e9es par des mesures correctives appropri\u00e9es. <\/span>\u00a0<\/span><\/p>

    3. Mesures organisationnelles<\/span><\/b>\u00a0<\/span><\/h3>
    3.1 Gouvernance et gestion des risques<\/span><\/b><\/h5>
    Cadre du SMSI<\/b>
    <\/strong><\/h6>

    reev exploite un syst\u00e8me de management de la s\u00e9curit\u00e9 de l’information (SMSI) certifi\u00e9 selon la norme ISO\/IEC 27001. Le SMSI d\u00e9finit les structures de gouvernance, les responsabilit\u00e9s, les politiques, les contr\u00f4les, les proc\u00e9dures de gestion des risques et les processus d’am\u00e9lioration continue pour la s\u00e9curit\u00e9 de l’information. <\/span><\/p>

    \u00c9valuation des risques<\/b>
    <\/strong><\/h6>

    reev proc\u00e8de r\u00e9guli\u00e8rement \u00e0 des \u00e9valuations des risques dans le domaine de la s\u00e9curit\u00e9 de l’information afin d’identifier les menaces, les vuln\u00e9rabilit\u00e9s et les risques pesant sur les actifs informationnels et les donn\u00e9es \u00e0 caract\u00e8re personnel. Les mesures de traitement des risques sont d\u00e9finies, mises en \u0153uvre, surveill\u00e9es et v\u00e9rifi\u00e9es conform\u00e9ment au SMSI. <\/span>\u00a0<\/p>

    Gestion des politiques<\/b>
    <\/span><\/h6>

    Les politiques de s\u00e9curit\u00e9 de l’information et de protection des donn\u00e9es sont v\u00e9rifi\u00e9es au moins une fois par an ou en cas de modifications substantielles. Les politiques sont communiqu\u00e9es aux personnes concern\u00e9es et mises \u00e0 disposition par des canaux internes appropri\u00e9s. <\/span>\u00a0<\/p>

    Classification des actifs et des informations<\/b>
    <\/strong><\/h6>

    reev maintient des processus d’identification et de classification des actifs informationnels sur la base de leur sensibilit\u00e9, de leur importance pour l’activit\u00e9 et des exigences de s\u00e9curit\u00e9. Des exigences de traitement appropri\u00e9es sont appliqu\u00e9es en fonction de la classification de l’information ou de l’actif concern\u00e9. <\/span>\u00a0<\/span><\/p>

    3.2 S\u00e9curit\u00e9 du personnel<\/span><\/b>\u00a0<\/span><\/h5>
    V\u00e9rification des ant\u00e9c\u00e9dents\u00a0<\/b>
    <\/span><\/h6>

    Dans la mesure o\u00f9 cela est l\u00e9galement admissible et proportionn\u00e9 au r\u00f4le concern\u00e9, reev proc\u00e8de, avant le d\u00e9but de l’emploi, \u00e0 des v\u00e9rifications correspondant aux responsabilit\u00e9s, aux droits d’acc\u00e8s et au profil de risque du poste.<\/span>\u00a0<\/p>

    Sensibilisation et formation<\/b>
    <\/strong><\/h6>

    Tous les employ\u00e9s re\u00e7oivent r\u00e9guli\u00e8rement des formations \u00e0 la s\u00e9curit\u00e9 de l’information, y compris des formations relatives aux responsabilit\u00e9s en mati\u00e8re de protection des donn\u00e9es, \u00e0 la confidentialit\u00e9, au traitement s\u00e9curis\u00e9 des donn\u00e9es \u00e0 caract\u00e8re personnel, \u00e0 la sensibilisation au hame\u00e7onnage (phishing), au signalement des incidents de s\u00e9curit\u00e9 et aux obligations RGPD pertinentes. Les formations ont lieu au moins une fois par an ainsi que dans le cadre de l’int\u00e9gration (onboarding). <\/span>\u00a0<\/p>

    Engagements de confidentialit\u00e9\u00a0<\/b><\/h6>

    Les employ\u00e9s, sous-traitants et autres personnes ayant acc\u00e8s \u00e0 des informations confidentielles ou \u00e0 des donn\u00e9es \u00e0 caract\u00e8re personnel sont tenus de souscrire des engagements de confidentialit\u00e9 ou des accords de non-divulgation. Ces engagements continuent de s’appliquer, dans la mesure o\u00f9 ils sont juridiquement ex\u00e9cutoires, au-del\u00e0 de la fin de la relation de travail ou contractuelle. <\/span>\u00a0<\/p>

    Utilisation autoris\u00e9e et s\u00e9curit\u00e9 des terminaux<\/b>
    <\/strong><\/h6>

    reev d\u00e9finit des exigences relatives \u00e0 l’utilisation autoris\u00e9e des syst\u00e8mes, appareils et actifs informationnels de l’entreprise. Les terminaux fournis par reev sont soumis \u00e0 des contr\u00f4les de s\u00e9curit\u00e9 appropri\u00e9s, qui peuvent inclure la gestion des appareils, le chiffrement, des exigences de verrouillage d’\u00e9cran, la protection anti-logiciels malveillants et la gestion des mises \u00e0 jour. <\/span>\u00a0<\/span><\/p>

    3.3 Gestion des incidents<\/span><\/b>\u00a0<\/span><\/h5>
    Plan de r\u00e9ponse aux incidents<\/b><\/strong><\/h6>

    reev\u00a0<\/span>maintient<\/span>\u00a0<\/span>un<\/span>\u00a0plan\u00a0<\/span>formel<\/span>\u00a0de\u00a0<\/span>r\u00e9ponse<\/span>\u00a0aux\u00a0<\/span>incidents<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>l’identification<\/span>, le\u00a0<\/span>signalement<\/span>,\u00a0<\/span>l’\u00e9valuation<\/span>,\u00a0<\/span>l’escalade<\/span>, le\u00a0<\/span>confinement<\/span>,\u00a0<\/span>l’investigation<\/span>\u00a0et la\u00a0<\/span>r\u00e9solution<\/span>\u00a0des\u00a0<\/span>incidents<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>. Les\u00a0<\/span>employ\u00e9s<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>tenus<\/span>\u00a0de\u00a0<\/span>signaler<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>incidents<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0<\/span>suspect\u00e9s<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>confirm\u00e9s<\/span>\u00a0via\u00a0<\/span>les<\/span>\u00a0<\/span>voies<\/span>\u00a0de\u00a0<\/span>signalement<\/span>\u00a0<\/span>d\u00e9finies<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    Traitement des violations de donn\u00e9es \u00e0 caract\u00e8re personnel<\/b><\/strong><\/h6>

    Dans la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>incident<\/span>\u00a0<\/span>concerne<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>, reev <\/span>\u00e9value<\/span>\u00a0si\u00a0<\/span>l’incident<\/span>\u00a0<\/span>constitue<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>violation<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0et\u00a0<\/span>examine<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>obligations<\/span>\u00a0de\u00a0<\/span>notification<\/span>\u00a0et de\u00a0<\/span>communication<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0des\u00a0<\/span>art.<\/span>\u00a033 et 34 du RGPD. Dans la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0reev\u00a0<\/span>agit<\/span>\u00a0en\u00a0<\/span>qualit\u00e9<\/span>\u00a0de\u00a0<\/span>sous-traitant<\/span>, reev\u00a0<\/span>notifie<\/span>\u00a0au responsable du\u00a0<\/span>traitement<\/span>\u00a0<\/span>concern\u00e9<\/span>\u00a0<\/span>dans<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>d\u00e9lai<\/span>\u00a0de\u00a0<\/span>soixante-douze<\/span>\u00a0(72)\u00a0<\/span>heures<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0\u00e0\u00a0<\/span>l’art<\/span>. 33,\u00a0<\/span>paragraphe<\/span>\u00a02, du RGPD et aux\u00a0<\/span>obligations<\/span>\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>applicables<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    Les\u00a0<\/span>incidents<\/span>\u00a0et\u00a0<\/span>les<\/span>\u00a0<\/span>violations<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>document\u00e9s<\/span>, y <\/span>compris<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>faits<\/span>\u00a0<\/span>relatifs<\/span>\u00a0\u00e0\u00a0<\/span>l’incident<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>impacts<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>mesures<\/span>\u00a0<\/span>correctives<\/span>\u00a0<\/span>prises<\/span>\u00a0et\u00a0<\/span>les<\/span>\u00a0<\/span>d\u00e9cisions<\/span>\u00a0relatives aux\u00a0<\/span>notifications<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>communications<\/span>. Les\u00a0<\/span>enseignements<\/span>\u00a0<\/span>tir\u00e9s<\/span>\u00a0des\u00a0<\/span>incidents<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>utilis\u00e9s<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>am\u00e9liorer<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>contr\u00f4les<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0et\u00a0<\/span>les<\/span>\u00a0<\/span>proc\u00e9dures<\/span>\u00a0de\u00a0<\/span>r\u00e9ponse<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    3.4 Gestion des fournisseurs tiers et des sous-traitants<\/span><\/b>\u00a0<\/span><\/h5>
    S\u00e9curit\u00e9 des fournisseurs<\/b><\/strong>\u00a0<\/span><\/h6>

    Les\u00a0<\/span>exigences<\/span>\u00a0en\u00a0<\/span>mati\u00e8re<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0de\u00a0<\/span>l’information<\/span>\u00a0et de\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>d\u00e9finies<\/span>\u00a0et\u00a0<\/span>convenues<\/span>\u00a0<\/span>avec<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>fournisseurs<\/span>\u00a0<\/span>sur<\/span>\u00a0la\u00a0<\/span>base<\/span>\u00a0de la\u00a0<\/span>nature<\/span>\u00a0des\u00a0<\/span>prestations<\/span>\u00a0<\/span>fournies<\/span>\u00a0et du\u00a0<\/span>risque<\/span>\u00a0<\/span>associ\u00e9<\/span>\u00a0au\u00a0<\/span>traitement<\/span>. Les\u00a0<\/span>fournisseurs<\/span>\u00a0<\/span>qui<\/span>\u00a0<\/span>traitent<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>pour<\/span>\u00a0le\u00a0<\/span>compte<\/span>\u00a0de reev\u00a0<\/span>ou<\/span>\u00a0de\u00a0<\/span>clients<\/span>\u00a0de reev\u00a0<\/span>sont<\/span>\u00a0<\/span>soumis<\/span>\u00a0\u00e0 des\u00a0<\/span>obligations<\/span>\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>appropri\u00e9es<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    Contrats de sous-traitance<\/b><\/strong><\/h6>

    reev ne\u00a0<\/span>transmet<\/span>\u00a0<\/span>pas<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ou<\/span>\u00a0\u00e0\u00a0<\/span>un<\/span>\u00a0<\/span>sous-traitant<\/span>\u00a0<\/span>ult\u00e9rieur<\/span>\u00a0en\u00a0<\/span>l’absence<\/span>\u00a0de\u00a0<\/span>dispositions<\/span>\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>appropri\u00e9es<\/span>, y\u00a0<\/span>compris<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>contrat<\/span>\u00a0de\u00a0<\/span>sous-traitance<\/span>\u00a0<\/span>ou<\/span>\u00a0des\u00a0<\/span>clauses<\/span>\u00a0<\/span>\u00e9quivalentes<\/span>\u00a0en\u00a0<\/span>mati\u00e8re<\/span>\u00a0de\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>,\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0<\/span>cela<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>requis<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 28 du RGPD.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    Sous-traitants ult\u00e9rieurs<\/b><\/strong><\/h6>

    Les\u00a0<\/span>sous-traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>recourus<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0aux\u00a0<\/span>accords<\/span>\u00a0<\/span>clients<\/span>\u00a0<\/span>applicables<\/span>\u00a0et aux\u00a0<\/span>exigences<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 28 du RGPD. Dans la\u00a0<\/span>mesure<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>obligations<\/span>\u00a0des\u00a0<\/span>sous-traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0<\/span>comprennent<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>appropri\u00e9es<\/span>\u00a0en\u00a0<\/span>mati\u00e8re<\/span>\u00a0de\u00a0<\/span>protection<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>, de\u00a0<\/span>confidentialit\u00e9<\/span>, de\u00a0<\/span>s\u00e9curit\u00e9<\/span>,\u00a0<\/span>d’assistance<\/span>,\u00a0<\/span>d’audit<\/span>,\u00a0<\/span>d’effacement<\/span>\u00a0<\/span>ou<\/span>\u00a0de\u00a0<\/span>restitution<\/span>\u00a0<\/span>ainsi<\/span>\u00a0<\/span>que<\/span>\u00a0de\u00a0<\/span>transmission<\/span>\u00a0<\/span>ult\u00e9rieure<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    Une\u00a0<\/span>liste<\/span>\u00a0<\/span>actualis\u00e9e<\/span>\u00a0des sous-<\/span>traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0<\/span>auxquels<\/span>\u00a0reev a\u00a0<\/span>recours<\/span>\u00a0est tenue \u00e0\u00a0<\/span>l’adresse<\/span>\u00a0reev.com\/legal. reev\u00a0<\/span>informe<\/span>\u00a0les\u00a0<\/span>clients<\/span>\u00a0au\u00a0<\/span>moins<\/span>\u00a030\u00a0<\/span>jours<\/span>\u00a0\u00e0\u00a0<\/span>l’avance<\/span>\u00a0de toute modification\u00a0<\/span>envisag\u00e9e<\/span>\u00a0<\/span>concernant<\/span>\u00a0les sous-<\/span>traitants<\/span>\u00a0<\/span>ult\u00e9rieurs<\/span>\u00a0qui\u00a0<\/span>traitent<\/span>\u00a0des donn\u00e9es \u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0personnel du client\u00a0<\/span>concern\u00e9<\/span>,\u00a0<\/span>sauf<\/span>\u00a0<\/span>si<\/span>\u00a0un\u00a0<\/span>d\u00e9lai<\/span>\u00a0plus court est\u00a0<\/span>requis<\/span>\u00a0pour des raisons de\u00a0<\/span>s\u00e9curit\u00e9, de\u00a0<\/span>disponibilit\u00e9<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>d’autres<\/span>\u00a0raisons\u00a0<\/span>urgentes<\/span>. Les clients\u00a0<\/span>peuvent<\/span>, pour des motifs\u00a0<\/span>l\u00e9gitimes<\/span>\u00a0relevant de la protection des donn\u00e9es, faire opposition \u00e0 la modification dans le\u00a0<\/span>d\u00e9lai<\/span>\u00a0<\/span>d’annonce<\/span>.\u00a0<\/span><\/span>Dans\u00a0<\/span>ce<\/span>\u00a0<\/span>cas<\/span>,\u00a0<\/span>les<\/span>\u00a0<\/span>parties<\/span>\u00a0<\/span>coop\u00e9reront<\/span>\u00a0de\u00a0<\/span>bonne<\/span>\u00a0<\/span>foi<\/span>\u00a0<\/span>afin<\/span>\u00a0de\u00a0<\/span>trouver<\/span>\u00a0<\/span>une<\/span>\u00a0<\/span>solution<\/span>\u00a0<\/span>appropri\u00e9e<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>

    Transferts internationaux<\/b><\/h6>

    Dans la <\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0des\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>transf\u00e9r\u00e9es<\/span>\u00a0<\/span>vers<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>pays<\/span>\u00a0<\/span>situ\u00e9<\/span>\u00a0en\u00a0<\/span>dehors<\/span>\u00a0de\u00a0<\/span>l’Espace<\/span>\u00a0<\/span>\u00e9conomique<\/span>\u00a0<\/span>europ\u00e9en<\/span>\u00a0<\/span>ou<\/span>\u00a0y\u00a0<\/span>sont<\/span>\u00a0<\/span>accessibles<\/span>\u00a0<\/span>depuis<\/span>\u00a0<\/span>un<\/span>\u00a0<\/span>tel<\/span>\u00a0<\/span>pays<\/span>, reev\u00a0<\/span>met<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0des\u00a0<\/span>m\u00e9canismes<\/span>\u00a0de\u00a0<\/span>transfert<\/span>\u00a0et des\u00a0<\/span>garanties<\/span>\u00a0<\/span>appropri\u00e9s<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0au\u00a0<\/span>chapitre<\/span>\u00a0V du RGPD, par exemple des\u00a0<\/span>d\u00e9cisions<\/span>\u00a0<\/span>d’ad\u00e9quation<\/span>, des\u00a0<\/span>clauses<\/span>\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>types<\/span>\u00a0et des\u00a0<\/span>mesures<\/span>\u00a0<\/span>suppl\u00e9mentaires<\/span>,\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    3.5 Conservation des donn\u00e9es et effacement s\u00e9curis\u00e9<\/span><\/b>\u00a0<\/span><\/h5>

    Les\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0ne\u00a0<\/span>sont<\/span>\u00a0<\/span>conserv\u00e9es<\/span>\u00a0<\/span>que<\/span>\u00a0<\/span>pendant<\/span>\u00a0la\u00a0<\/span>dur\u00e9e<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>\u00a0\u00e0 la\u00a0<\/span>finalit\u00e9<\/span>\u00a0de\u00a0<\/span>traitement<\/span>\u00a0<\/span>concern\u00e9e<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>pendant<\/span>\u00a0la\u00a0<\/span>dur\u00e9e<\/span>\u00a0<\/span>n\u00e9cessaire<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0du\u00a0<\/span>droit<\/span>\u00a0<\/span>applicable<\/span>,\u00a0<\/span>d’un<\/span>\u00a0<\/span>contrat<\/span>\u00a0<\/span>ou<\/span>\u00a0de\u00a0<\/span>besoins<\/span>\u00a0<\/span>commerciaux<\/span>\u00a0<\/span>l\u00e9gitimes<\/span>. Des\u00a0<\/span>proc\u00e9dures<\/span>\u00a0de\u00a0<\/span>conservation<\/span>\u00a0et\u00a0<\/span>d’effacement<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>mises<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0<\/span>pour<\/span>\u00a0<\/span>les<\/span>\u00a0<\/span>syst\u00e8mes<\/span>\u00a0et\u00a0<\/span>cat\u00e9gories<\/span>\u00a0de\u00a0<\/span>donn\u00e9es<\/span>\u00a0<\/span>pertinents<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    \u00c0\u00a0<\/span>l’expiration<\/span>\u00a0des\u00a0<\/span>dur\u00e9es<\/span>\u00a0de\u00a0<\/span>conservation<\/span>\u00a0<\/span>applicables<\/span>\u00a0<\/span>ou<\/span>\u00a0en\u00a0<\/span>cas<\/span>\u00a0de\u00a0<\/span>demandes<\/span>\u00a0<\/span>d’effacement<\/span>\u00a0valables,\u00a0<\/span>les<\/span>\u00a0<\/span>donn\u00e9es<\/span>\u00a0\u00e0\u00a0<\/span>caract\u00e8re<\/span>\u00a0<\/span>personnel<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>effac\u00e9es<\/span>,\u00a0<\/span>anonymis\u00e9es<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>trait\u00e9es<\/span>\u00a0<\/span>d’une<\/span>\u00a0<\/span>autre<\/span>\u00a0<\/span>mani\u00e8re<\/span>\u00a0<\/span>conform\u00e9ment<\/span>\u00a0aux\u00a0<\/span>exigences<\/span>\u00a0<\/span>l\u00e9gales<\/span>\u00a0et\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>applicables<\/span>, sauf si\u00a0<\/span>une<\/span>\u00a0<\/span>conservation<\/span>\u00a0<\/span>ult\u00e9rieure<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>l\u00e9galement<\/span>\u00a0<\/span>requise<\/span>\u00a0<\/span>ou<\/span>\u00a0<\/span>admise<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    3.6 Droits des personnes concern\u00e9es et assistance au responsable du traitement<\/span><\/b>\u00a0<\/span><\/h5>

    Dans la\u00a0<\/span>mesure<\/span>\u00a0<\/span>o\u00f9<\/span>\u00a0reev\u00a0<\/span>agit<\/span>\u00a0en\u00a0<\/span>qualit\u00e9<\/span>\u00a0de\u00a0<\/span>sous-traitant<\/span>, reev\u00a0<\/span>assiste<\/span>\u00a0le responsable du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>dans<\/span>\u00a0la\u00a0<\/span>mesure<\/span>\u00a0du possible et en\u00a0<\/span>tenant<\/span>\u00a0<\/span>compte<\/span>\u00a0de la\u00a0<\/span>nature<\/span>\u00a0du\u00a0<\/span>traitement<\/span>,\u00a0<\/span>dans<\/span>\u00a0<\/span>l’accomplissement<\/span>\u00a0des\u00a0<\/span>obligations<\/span>\u00a0<\/span>li\u00e9es<\/span>\u00a0aux\u00a0<\/span>droits<\/span>\u00a0des\u00a0<\/span>personnes<\/span>\u00a0<\/span>concern\u00e9es<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0du\u00a0<\/span>chapitre<\/span>\u00a0III du RGPD\u00a0<\/span>ainsi<\/span>\u00a0<\/span>qu’\u00e0<\/span>\u00a0la\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0du\u00a0<\/span>traitement<\/span>\u00a0au\u00a0<\/span>titre<\/span>\u00a0de\u00a0<\/span>l’art<\/span>. 32 du RGPD,\u00a0<\/span>conform\u00e9ment<\/span>\u00a0aux\u00a0<\/span>obligations<\/span>\u00a0<\/span>contractuelles<\/span>\u00a0<\/span>applicables<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    3.7 Audit, conformit\u00e9 et am\u00e9lioration continue<\/span><\/b>\u00a0<\/span><\/h5>

    reev\u00a0<\/span>surveille<\/span>\u00a0<\/span>l’efficacit\u00e9<\/span>\u00a0de\u00a0<\/span>ses<\/span>\u00a0<\/span>contr\u00f4les<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0au\u00a0<\/span>moyen<\/span>\u00a0du SMSI, de\u00a0<\/span>revues<\/span>\u00a0internes,\u00a0<\/span>d’audits<\/span>,\u00a0<\/span>d’\u00e9valuations<\/span>\u00a0des\u00a0<\/span>risques<\/span>,\u00a0<\/span>d’\u00e9valuations<\/span>\u00a0<\/span>techniques<\/span>\u00a0et de\u00a0<\/span>processus<\/span>\u00a0de\u00a0<\/span>mesures<\/span>\u00a0<\/span>correctives<\/span>. La\u00a0<\/span>documentation<\/span>\u00a0relative \u00e0 la\u00a0<\/span>s\u00e9curit\u00e9<\/span>\u00a0et \u00e0 la\u00a0<\/span>conformit\u00e9<\/span>\u00a0<\/span>est<\/span>\u00a0<\/span>tenue<\/span>\u00a0<\/span>afin<\/span>\u00a0de\u00a0<\/span>d\u00e9montrer<\/span>\u00a0la\u00a0<\/span>mise<\/span>\u00a0en\u00a0<\/span>\u0153uvre<\/span>\u00a0de\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>appropri\u00e9es<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    Les\u00a0<\/span>mesures<\/span>\u00a0<\/span>techniques<\/span>\u00a0et\u00a0<\/span>organisationnelles<\/span>\u00a0<\/span>sont<\/span>\u00a0<\/span>r\u00e9guli\u00e8rement<\/span>\u00a0<\/span>v\u00e9rifi\u00e9es<\/span>\u00a0et\u00a0<\/span>actualis\u00e9es<\/span>\u00a0en tant\u00a0<\/span>que<\/span>\u00a0de\u00a0<\/span>besoin<\/span>,\u00a0<\/span>notamment<\/span>\u00a0en\u00a0<\/span>raison<\/span>\u00a0de\u00a0<\/span>modifications<\/span>\u00a0des\u00a0<\/span>exigences<\/span>\u00a0<\/span>l\u00e9gales<\/span>, de la\u00a0<\/span>technologie<\/span>, du\u00a0<\/span>contexte<\/span>\u00a0de\u00a0<\/span>risque<\/span>, de la\u00a0<\/span>structure<\/span>\u00a0<\/span>organisationnelle<\/span>, des\u00a0<\/span>activit\u00e9s<\/span>\u00a0de\u00a0<\/span>traitement<\/span>\u00a0<\/span>ou<\/span>\u00a0des\u00a0<\/span>pratiques<\/span>\u00a0de\u00a0<\/span>s\u00e9curit\u00e9<\/span>.<\/span><\/span>\u00a0<\/span><\/p>

    Version :<\/span>\u00a0<\/span>juillet<\/span>\u00a0<\/span>2026<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

    Home Data Processing Agreement (DPA) Mise \u00e0 jour : juillet 2026 Avertissement : Traduction du document original en allemand. En cas de divergence, d\u2019incoh\u00e9rence ou de conflit avec la version allemande, notamment en raison de retards de traduction, la version allemande pr\u00e9vaut. Le pr\u00e9sent Data Processing Agreement (ci-apr\u00e8s le \u00ab DPA \u00bb) s’applique entre reev […]<\/p>\n","protected":false},"author":14,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_seopress_titles_title":"Accord sur le traitement des donn\u00e9es (DPA) %%sep%% %%sitetitle%%","_seopress_titles_desc":"reev GmbH - Sandstra\u00dfe 3 - 80335 Munich Nous g\u00e9rons nos sites Web conform\u00e9ment aux principes \u00e9nonc\u00e9s ci-apr\u00e8s : nous nous engageons \u00e0 respecter les dispositions l\u00e9gales en mati\u00e8re de protection des donn\u00e9es et nous nous effor\u00e7ons de toujours tenir compte des principes de limitation et de minimisation des donn\u00e9es.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"Accord sur le traitement des donn\u00e9es (DPA) %%sep%% %%sitetitle%%","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"Accord sur le traitement des donn\u00e9es (DPA) %%sep%% %%sitetitle%%","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"both","_seopress_redirections_param":"","_seopress_redirections_type":301,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-427922","page","type-page","status-publish","hentry"],"translations":{"de":"data-processing-agreement-dpa-reev","en":"data-processing-agreement-dpa-reev","fr":"data-processing-agreement-dpa-reev"},"_links":{"self":[{"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/pages\/427922","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/comments?post=427922"}],"version-history":[{"count":10,"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/pages\/427922\/revisions"}],"predecessor-version":[{"id":430533,"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/pages\/427922\/revisions\/430533"}],"wp:attachment":[{"href":"https:\/\/reev.com\/fr\/wp-json\/wp\/v2\/media?parent=427922"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}