Privacy Policy

The controller of the data collected on the Damjitech platform is Rayan Mamouni, Entrepreneur individuel — auto-entrepreneur (immatriculation en cours), which alone determines the purposes and means of the processing described in this policy. Until these particulars are provided, this policy may not be regarded as definitively published.

The point of contact dedicated to data protection and to the exercise of your rights can be reached by email at contact@damjitech.com. We reserve the right to designate a point of contact or a data protection officer and to publish their details by way of an update to this policy.

Where partners act on our behalf (hosting, payment, logistics, verification, artificial intelligence, notifications), they act as processors or service providers governed by contract. Each remains responsible for compliance with its own legal obligations; Damjitech is not liable for breaches specific to such third parties beyond what the law imposes.

This policy applies to all processing of personal data carried out by Damjitech in connection with the platform (application, website and associated services), for users, visitors, buyers, sellers and service providers.

In the relationship between private buyers and sellers, Damjitech acts as a technical intermediary and trusted third party, and not as a party to the sale. When a seller publishes data or exchanges messages, the seller remains responsible at its own level; when Damjitech acts as a seller (for example “Sold by Damji”) or as a verification service provider, it acts in that capacity.

By creating an account or using the service, you acknowledge that you have read this policy. Processing based on your consent (in particular the biometric selfie, geolocation, notifications) is only carried out after that specific and revocable consent has been obtained.

This section exhaustively describes the categories of personal data that we may collect and process. Not all of them necessarily concern you: for each user, we only process the data corresponding to the features they actually use and to the purposes described in section 4. Certain categories are only collected with your consent, on the occasion of a particular operation (identity verification, payment, verified shipping), or when the corresponding feature is activated.

Identification and account data: internal identifier, name or display name, city, language, profile photo, account type (private individual or shop), registration date, role, verified-seller status, notification preferences and, for business accounts, the company name, type of activity, description and registration number (RC/ICE) that you provide.

Authentication and login data: the phone number and/or email address used to create the account and log in; password, stored only in the form of an encrypted hash by our authentication provider and never in plain text; identifiers transmitted by a third-party service in the event of social login (Google, Apple, Facebook); one-time codes (SMS or email), processed by our authentication provider and not retained by us; session tokens, a trusted-device recognition token and technical login logs. These contact details and identifiers are stored in our authentication system and are never published.

Public profile and reputation data: display name, city, profile photo, average rating and number of reviews, response time, badges, level and verified-seller status. Only this data identifies you publicly on the Platform; the phone number, email address and postal address are never displayed.

Private contact data and addresses: phone number, email address, postal and delivery addresses (street, additional details, city, contact phone), meeting places that you propose, and, where applicable, bank or withdrawal details (RIB, IBAN, mobile money) that you register in order to receive a payment. This data is not public.

Identity verification (KYC) data — sensitive data: a copy of the front (and, for the national identity card, the back) of an official identity document (national identity card, passport, driving licence or residence permit), the holder's name, nationality, document type, a fingerprint of the document number and an identity fingerprint (computed from the name, date of birth and country, without these elements being retained in plain text), the version of the consent obtained and a live-captured selfie. This collection is only carried out if you request the verification of your identity or for certain operations, and is subject to the enhanced protections described in sections 5 and 6.

Biometric data — sensitive data: the selfie captured live during identity verification, processed for the sole purpose of confirming that you are indeed the person shown on the document and of preventing impersonation, under the strengthened regime of section 5 (specific consent, restricted access, limited retention and CNDP formalities).

IMEI number and identifiers of the device offered for sale: the IMEI number of the device that you offer for sale or propose for trade-in, collected for verification and anti-theft purposes. It is stored in encrypted and hashed form and is never displayed in plain text; only its last four digits may be retained to help you identify your device. We also process, where applicable, the fingerprints appearing on a list of devices declared stolen or reported.

Listing and catalogue data (content you publish): model, brand, category, declared condition (grade), description, photographs of the device, price, specifications and the device's “passport” (information you declare and, when you use the automatic assistance, items it detects from your photos), sale lane (functional, for repair, for parts, or declared blocked) and the approximate location of the device when you indicate it.

Messaging and communication data: the content of conversations exchanged through the messaging (text and images), offers and counter-offers, appointment proposals and details, reviews and replies to reviews, reports, disputes, return requests, support tickets and messages, feedback and suggestions, catalogue-addition requests, and notifications addressed to you.

Transaction and order data: orders, in-person sales, accepted offers, handover method, order stages and timestamps, shipments (carrier and tracking code where provided), returns, warranties, trade-ins and direct purchases, as well as the decisions and reasons associated with them.

Financial and payment data: chosen payment method, amount, any fees, transaction status and references, supporting documents and vouchers, bank or withdrawal details (RIB, IBAN, mobile money), withdrawal requests, credits and benefits, promotion purchases. The details of payment instruments (card number, bank authentication data) are processed directly by the authorised payment service providers and are not retained by Damjitech. This data is only processed when the corresponding payment features are activated (see section 30).

Geolocation data: approximate position from your device when you enable the “nearby” feature, and geographic coordinates that you associate, where applicable, with a listing, an address or a meeting point. The “nearby” position is stored locally on your device and is transmitted to our servers only transiently (see section 19).

Behavioural and usage data: favourites, saved searches and alerts, recently viewed items, comparisons, seller subscriptions, block lists, history of interactions and usage events (for example opening a page, a search, viewing a listing, starting a conversation, sending an offer), usage counters for the automatic assistance features, presence and response-time indicators. We record these events in a structured and minimised form: we do not retain the raw text of your searches (only the existence of a search and its filters, such as the city, brand or model), nor your IP address in these usage logs, nor the full string of the originating site (only the referring domain name).

Technical, device and security data: technical session and visit identifiers, device type inferred from the screen width (mobile, tablet, computer), language, classified acquisition source (for example search, social network, direct link), notification subscription tokens (web or native), access and action logs, timestamps, and data strictly necessary for security (request rate limiting, abuse prevention). Your IP address is used transiently for security and rate-limiting purposes; it is not retained as analytics data.

Consent and preference data: proof and version of your acceptance of the Terms of Use and of this policy, the version of the specific consent obtained for biometric processing, choices relating to notifications, geolocation and communications, and display and language preferences.

Referral data: when you are invited or when you invite, the referral link used and the referrer's identifier, as well as the associated rewards.

Moderation, security and audit data: reports and moderation signals (including the detection of contact details in messages, described in section 17), restriction measures (warning, suspension, ban, cash-on-delivery ban), action logs of authorised staff and technical fraud-prevention signals.

Data transmitted to our automatic assistance features (artificial intelligence): when you use a feature relying on AI (writing assistance, translation, diagnosis from photos, price estimation, reply assistance in the chat), only the data necessary for that feature may be transmitted to an AI provider, under the conditions and with the limitations described in sections 8 and 10. These features are disabled by default and transmit no data until they are activated.

Derived and inferred data: from the data above, we compute information concerning you or your listings — in particular a visibility and quality score for listings, a risk score and anti-fraud signals (for example duplicate photos detected by fingerprint, risky wording, IMEI duplicates or reports), a seller reputation score and level, response-time statistics, a technical diagnosis result, as well as fingerprints intended to detect the re-registration of an excluded person (computed from identity data, without retaining the latter in plain text). The processing of this derived data is described in section 18.

We may be led to collect new categories of data when future features are added (for example new payment methods, an integrated delivery service or an automated identity-verification provider). In such a case, we update this section, specify the corresponding purpose and legal basis, and complete, where they are required, the formalities before the CNDP prior to implementation.

In accordance with Articles 3 and 4 of Law 09-08, each processing operation pursues a specific, explicit and legitimate purpose, and relies on a precise legal basis.

Account creation, connecting buyers and sellers, management of listings, offers, orders and messaging: legal basis = performance of the contract formed by our Terms of Use, which you accept.

Securing transactions and the verified flow (verified handover, escrow where operational, order tracking): legal basis = performance of the contract and Damjitech's legitimate interest in ensuring the reliability and security of the platform.

Identity verification (KYC), fraud prevention, anti-theft measures, content moderation, visibility and risk scoring: legal basis = legal obligation and Damjitech's legitimate interest in protecting users, preserving the integrity of the service and preventing unlawful use, while respecting your fundamental rights.

Processing of the biometric selfie, “nearby” geolocation, web push notifications and promotional communications: legal basis = your free, specific, informed consent, revocable at any time.

Accounting and tax retention and dispute management: legal basis = legal obligation and legitimate interest in establishing and retaining proof in the event of a claim, in accordance with section 12.

Service improvement, internal audience measurement and statistics: legal basis = legitimate interest; these processing operations are carried out as far as possible on aggregated or anonymised data (see section 15).

We do not reuse your data for purposes incompatible with those stated without a new legal basis and, where applicable, without completing the required CNDP formalities.

Personalisation of discovery and recommendations (for example the "for you" suggestions, recent and saved searches, favourites and recently viewed items): legal basis = Damjitech's legitimate interest in presenting you with relevant content, facilitating your browsing and improving the service experience, excluding any third-party advertising tracker. You may object to this processing on legitimate grounds under the conditions of the section relating to your rights.

Processing of financial and payment data, issuance of supporting documents and management of withdrawals: legal basis = performance of the contract and legal obligations, in particular accounting and tax obligations. These processing operations are only carried out when the payment features are activated.

Combating the creation of fraudulent multiple accounts and the re-registration of excluded persons (derived identity fingerprints): legal basis = Damjitech's legitimate interest in enforcing exclusions and protecting users against fraud and impersonation.

Management of notification subscriptions and device tokens: legal basis = your consent for notifications, and performance of the contract for service communications.

The device's IMEI number is processed for security purposes: verification of the device by a technician and combating theft (search by encrypted hash and blacklist). It is stored encrypted in a dedicated vault, is never displayed in plain text and is accessible only to the strictly necessary verification and security processing operations.

The biometric selfie collected during identity verification is processed under a strengthened regime. In accordance with Articles 12 and 21 of Law 09-08 and CNDP Deliberation No. 478-2013 relating to biometric processing, this processing is based on your specific consent, distinct from the general acceptance of the Terms and revocable, and falls under the prior-authorization regime of the CNDP, whose formalities Damjitech completes. The selfie is used for the sole purpose of confirming your identity and preventing impersonation, and is then deleted or anonymised under the conditions of section 6.

Access to this sensitive data is restricted, logged and audited: only authorised persons holding the dedicated identity-verification capability may access it, and only for the purpose of anti-fraud control and combating impersonation. All access is traced and may be subject to an internal audit.

When you request verification of your identity, your official document and your live-captured biometric selfie are deposited in a private storage area, access to which is restricted to authorised persons only and systematically logged.

This data is used exclusively to verify that you are indeed the person declared and to prevent fraud and identity theft. It is never made public or shared for commercial purposes.

KYC retention: we undertake to delete or anonymise the identity documents and the biometric selfie no later than 90 days after the final decision on your request (approval or rejection), and in any event no later than the definitive deletion of your account. This period may be adjusted in accordance with the requirements of the CNDP. The decision metadata (date, outcome) may be retained as proof of the control carried out.

You warrant that the data you provide (identity, contact details, listings, photos, descriptions, declared condition of the device) is accurate, up to date and lawful, and that you hold the necessary rights over the content you publish, in particular the photographs.

Damjitech may not be held liable for the consequences arising from inaccurate, misleading, incomplete or unlawful information that you have provided, nor from the use of your account by a third party due to a failure to protect your credentials. You undertake to hold Damjitech harmless, within the limits permitted by law, against third-party claims arising from content you have published or from a breach on your part.

You are responsible for keeping your data up to date. You may correct it at any time from your account settings or by contacting us.

Your data is accessible only to the persons and service providers who need it for the purposes described, under contractual undertakings of confidentiality and security (Articles 23 to 25 of Law 09-08). We only share the data strictly necessary for each recipient.

Hosting and infrastructure: Supabase (database, authentication, file storage) and Vercel (application hosting and delivery), which technically process all the data necessary for the functioning of the platform.

Sending of emails and authentication SMS: a transactional email provider (for example Resend) and, where applicable, an SMS-sending provider (for example Twilio), which receive the email address or phone number and the content of the message or code.

Login via a third-party service: when you choose to log in with Google, Apple or Facebook, these identity providers authenticate you and transmit to us minimal account data (identifier, email address, name).

Automated identity verification: when this feature is activated, a specialised provider (for example Didit) may receive your identity document and your selfie for verification purposes only. As long as this feature is not activated, verification is carried out manually by our authorised staff.

Automatic assistance features (AI): Anthropic (Claude) for features relying on image analysis, and a text-processing provider (for example DeepSeek, Groq or OpenRouter) for text features. For writing assistance and chat assistance, the text transmitted is first stripped of contact details; the translation feature, however, transmits the text exactly as you entered it (message or listing description): therefore do not include in it any information that you do not wish to be processed by these providers. These features are disabled by default and transmit no data until they are activated.

Protection against bots and abuse: an anti-bot verification service (for example Cloudflare Turnstile), when activated, may receive technical signals and your IP address in order to distinguish a human user from an automated program.

Notifications: the push-notification delivery services (browser push services for the web; Firebase Cloud Messaging and Apple's notification service for the native application, when activated) receive a subscription token and the content of the notification.

Authorised payment service providers: when online payments are activated, the payment institution or gateway chosen (for example CMI, CashPlus, Wafacash, Orange Money, inwi money, CIH) processes the payment; these Moroccan providers process payment data in Morocco.

Logistics partners and carriers: as part of verified shipping, when activated, from the delivery address.

Technicians and verification points: independent service providers (auto-entrepreneurs, Law 114-13) carrying out the inspection of the device.

Technical incident monitoring: an error-logging service (for example Sentry), when activated, may receive technical information about incidents, without identifying personal data.

Product analytics and audience measurement: PostHog, whose data is hosted in the European Union (Frankfurt), receives the structured usage events described in section 31. The requests pass through our own domain, your IP address is discarded on receipt, page content is not captured automatically and no screen recording is carried out.

App stores: Apple App Store and Google Play, for the distribution of the application.

Public and judicial authorities: under the conditions set out in section 9.

We do not sell your personal data to third parties and we do not rent it for advertising purposes.

Some of these providers are located outside Morocco; the corresponding international transfers are governed by section 10, while the aforementioned Moroccan payment providers process the data in Morocco.

We may update the list of our processors and service providers, in particular to replace a provider with an equivalent one offering at least comparable guarantees of confidentiality and security. The list of categories of recipients set out in this section is kept up to date; such a change, provided it does not broaden the described purposes, does not constitute a substantial amendment of this policy. Any international transfers remain subject to CNDP authorisations.

We may be required to disclose certain of your data to administrative, judicial, police, customs, tax authorities or to the CNDP, where the law so requires or in response to a requisition, a court decision or a legally founded request, in particular in the context of combating theft (IMEI searches), fraud or money laundering.

Such disclosures, where legally justified, do not constitute a breach of this policy and do not engage Damjitech's liability. We limit the disclosure to the data strictly required by the request.

Where the law permits, we may inform you of such a request; we refrain from doing so where the communication of information is prohibited or liable to compromise an investigation.

Our application infrastructure is hosted by Vercel Inc. (Vercel Cloud) and our database, storage and authentication infrastructure is provided by Supabase Inc. (Supabase Cloud). Other providers — email and SMS sending, identity providers for social login, automatic assistance features, anti-bot service, notification delivery, incident monitoring, product analytics — may, when activated, process or store data outside Moroccan territory, in particular in the European Union and/or the United States depending on the cloud region configured and their own subprocessors. These operations constitute an international transfer of data within the meaning of Articles 43 and 44 of Law 09-08. Conversely, the Moroccan payment providers process payment data in Morocco. For product analytics, the European region (Frankfurt) was selected at configuration and can no longer be changed thereafter: that data is not transferred to the United States.

In accordance with Law 09-08, this transfer is subject to the prior authorisation of the CNDP, regardless of its internal legal basis. It is only carried out after obtaining that authorisation and under the conditions it sets, taking into account the level of protection ensured in the destination country.

We limit the data transferred to what is strictly necessary and govern these transfers by appropriate contractual undertakings. In particular, the writing-assistance features transmit to the AI providers only text stripped of contact details; the on-demand translation feature transmits the text of the message exactly as you entered it, of which you are informed before using it.

We retain your data for the period necessary for the purposes for which it was collected, in accordance with the proportionality requirement of Article 3 of Law 09-08, and then we delete it or anonymise it irreversibly.

Account and profile data: for the entire period during which the account exists. When you request deletion, your public profile is immediately anonymised; the definitive deletion of the associated data then takes place in accordance with the process described in section 20, subject to legal retention obligations.

KYC data (document and biometric selfie): deleted or anonymised no later than 90 days after the final decision, and in any event no later than the definitive deletion of the account.

Messages and communications: retained for the period necessary for the follow-up of transactions and the limitation period for disputes, and at the latest for the period during which the account exists, subject to the items retained as proof.

Encrypted IMEI and anti-fraud / anti-theft signals: retained for as long as necessary to combat theft and fraud, then deleted or anonymised.

Order and payment data and records necessary as evidence (in particular verification reports, time-stamped photos, numbered seals, logs): retained for 10 years, in accordance with the obligations to retain accounting documents and correspondence (Articles 22 and 26 of the Code of Commerce) and tax records (Article 211 of the General Tax Code). This period also covers the limitation period for disputes (5 years in commercial matters, Article 5 of the Code of Commerce; 15 years under ordinary law, Article 387 of the DOC (Dahir of Obligations and Contracts)), at the end of which the data are deleted or anonymized.

Inactive accounts. In order to respect the principle of proportionality (Article 3 of Law 09-08), an account that has remained inactive — with no login or activity — for a prolonged period [for example thirty-six (36) months] may be anonymised or deleted, after prior notice sent, where possible, to the contact address associated with the account. Data that must be retained under legal or evidential obligations are kept until the end of the applicable periods.

In order to protect users and to be able to establish the reality of transactions, verifications and consents, we retain, on the basis of our legal obligation and our legitimate interest in proof, certain data for the applicable limitation periods, even after a deletion request relating to other data.

The following are retained on this basis in particular: connection and action logs, timestamps, verification reports, timestamped photographs, numbered seals, proof of acceptance of the Terms and consents, as well as order and payment data.

In accordance with Law No. 53-05 on the electronic exchange of legal data, the electronic writings, logs and evidence retained by Damjitech under conditions capable of guaranteeing their integrity have probative value between the parties. You acknowledge this probative value, without prejudice to your right to provide evidence to the contrary.

We implement technical and organizational measures intended to protect your data, in accordance with Articles 23 to 26 of Law 09-08: encryption of the IMEI in a dedicated vault, private storage areas with restricted and audited access for KYC, strengthened measures for sensitive data (Article 24), separation of private data (phone, email) from public data, access control at the database level, logging, contractual oversight of subcontractors (Article 25) and the obligation of professional secrecy of staff and service providers (Article 26).

This security obligation is an obligation of means: since no transmission or storage of data can be guaranteed entirely infallible, Damjitech cannot be held liable for an incident resulting from an external cause, an event of force majeure, the act of a third party unconnected with the performance of the service, or a failure on your part to protect your credentials. Damjitech nevertheless remains responsible for its processors acting on its instructions, under the conditions of Article 25 of Law 09-08.

You are responsible for the confidentiality of your login credentials and undertake to notify us without delay of any unauthorised use of your account. We recommend that you use a robust authentication method.

Within the limits permitted by Moroccan law, Damjitech's liability in respect of the processing of your data is limited to direct, certain and foreseeable damage, and is capped under the conditions set out in our Terms of Use. In particular, indirect or intangible damage (loss of opportunity, loss of recoverable data, commercial loss) is excluded.

These limitations do not apply in the event of Damjitech's gross negligence or wilful misconduct, nor to personal injury, nor to non-material harm resulting from an infringement of privacy or of personal data, in particular sensitive data, attributable to Damjitech, nor to the public-order rights afforded to data subjects by Law 09-08, including the right to compensation, which remain fully applicable. In particular, the liability cap may not deprive the data subject of effective compensation for the harm resulting from such an infringement where it is attributable to Damjitech. Any clause deemed unwritten does not affect the validity of the other provisions.

Damjitech is not responsible for processing carried out autonomously by third parties (another user, payment service provider, public authority) outside its instructions.

We may aggregate and anonymise data irreversibly, so that it no longer allows you to be identified. Once anonymised, this data no longer constitutes personal data within the meaning of Law 09-08.

Damjitech may retain and use this aggregated or anonymised data without time limit for the purposes of service improvement, market analysis, statistics, research and development, including for commercial purposes, without this affecting your rights.

To ensure the functioning of the service, we use strictly necessary cookies and local storage: authentication session cookies, a trusted-device recognition cookie (for password login), a language cookie, a referral-attribution cookie and a visitor identifier intended solely for internal audience measurement. We also store on your device, via local storage, preference and usage items (language, favourites, recently viewed items, comparison items, listing or message drafts, location choice, display and notification preferences).

We do not use any third-party advertising tracker, we do not carry out advertising profiling and we do not track your browsing on other websites. The audience measurement described in section 31 does, however, rely on a product analytics provider (PostHog) whose data is hosted in the European Union: the corresponding requests are sent from our own domain, no advertising script is loaded, page content is not captured automatically and your screen is never recorded.

Push notifications are only enabled with your consent, which you may withdraw at any time from your device or browser settings. Disabling the strictly necessary cookies and storage may prevent the platform from functioning properly.

The messages exchanged through the platform's messaging are retained to ensure the follow-up of transactions, dispute resolution and security, for the durations indicated in sections 11 and 12.

The platform automatically detects the presence of contact details (phone, email, social networks) in messages for fraud prevention and protection of the verified flow. This detection does not block your message: it is transmitted, accompanied by a security warning, and the detection constitutes only an internal moderation signal. This feature relies on Damjitech's legitimate interest in preventing fraud and circumvention of the secure flow.

Circumventing the verified flow deprives you of the protections described in our Terms of Use; Damjitech is not responsible for the consequences of an exchange or transaction carried out outside the platform.

To ensure the quality of the catalogue and the security of the platform, we apply partially automated processing: a visibility ranking of listings, a reputation and risk scoring, assisted content moderation, as well as mechanisms for detecting fraud and suspicious listings (for example detection of risky wording, duplicate IMEIs or duplicate photos). These processing operations rely on our legitimate interest in offering a reliable catalogue and a safe environment.

The ranking and visibility of listings fall within an editorial and commercial choice of Damjitech; they do not produce a legal effect on you and may not be challenged solely on the basis of the position obtained.

Measures producing a real effect on you (for example the removal of a listing or the restriction of an account) are not taken solely on the basis of automated processing: they are subject to human intervention by our teams. You may request explanations regarding a decision concerning you and request a review by a person, by writing to us at contact@damjitech.com.

We also compute, for security and anti-fraud purposes, technical fingerprints enabling the detection of duplicate photographs between different sellers, IMEI duplicates or reports, as well as the re-registration of a previously excluded person (fingerprints derived from identity data, without retaining the latter in plain text). These mechanisms produce internal signals; any measure producing a real effect on you is subject to human intervention, under the conditions of this article.

The “nearby” feature uses your approximate location, only if you enable it, to offer you geographically nearby listings. Your consent is required and revocable at any time from your device or application settings.

This location is stored locally on your device in order to retain your display preference. It is transmitted to our servers transiently, only for the time needed to filter and order search results, and is not retained durably on Damjitech's side after the search has been performed.

In accordance with Law 09-08, you have a right of access to your data (Article 7), a right of rectification, updating, erasure or blocking (Article 8), a right to object on legitimate grounds, including to commercial solicitation and free of charge (Article 9), a right to deletion or anonymization, as well as the right to withdraw at any time your consent to the processing operations that depend on it.

You may exercise some of these rights directly from your account settings (profile modification, address management, export of your data, account deletion). For any other request, write to us at contact@damjitech.com.

In order to protect your data against fraudulent requests, we may ask you to prove your identity before acting on a request to exercise rights. We respond within the time limits provided for by law.

Where a request is manifestly unfounded, excessive or repetitive, we may, within the limits permitted by law, refuse to act on it or make its processing subject to the payment of reasonable fees corresponding to the costs incurred; we then state the reasons for our decision.

Account deletion: when you request it, your public profile is immediately anonymised and your listings are removed. The definitive deletion of the account and associated data (phone, email, messages, addresses) is then carried out, subject to legal retention obligations (accounting and tax obligations, anti-fraud measures, proof in the event of a dispute described in section 12).

The withdrawal of consent (push notifications, geolocation, biometric selfie) does not affect the lawfulness of the processing carried out before that withdrawal. Certain data may be retained despite a deletion request where the law so requires or on the basis of the legitimate interest in proof.

In the event of a persistent disagreement, you have the right to refer the matter to the CNDP (see section 25).

Ratings, reviews and reputation signals concerning you come from other users or result from use of the service and contribute to the integrity and reliability of the platform. As such, they may be retained and continue to be used, where appropriate in a form dissociated from your public identity, notwithstanding a deletion request relating to your other data, the review being the expression of a third party and its retention falling within our legitimate interest in preserving trust between users, without prejudice to your right to object on legitimate grounds under the conditions of this section.

The right of access and the ability to export are exercised within the limits set by law: they concern only the personal data relating to you and cannot extend to data relating to third parties, to information covered by a legally protected secret, or to elements whose disclosure would compromise the security of the platform or the effectiveness of our fraud-prevention and anti-theft mechanisms, in particular the detailed logic of our detection and risk-scoring mechanisms. In these cases, we provide you with the information that can be disclosed without prejudice to those rights and interests.

We send you communications related to the functioning of the service (messages, offers, order tracking, security, appointment reminders) on the basis of the performance of the contract and our legitimate interest; these communications are necessary for the use of the service.

Promotional communications and web push notifications are only sent with your consent, which you may withdraw at any time from your account, device or browser settings, without this affecting service communications.

The Damjitech platform is intended for adults. By creating an account and using the service, you declare that you have the legal age required to enter into a contract.

We do not knowingly collect data concerning minors. If we become aware that an account has been created by a minor or that a minor has transmitted data to us, we may suspend or delete the account concerned and proceed to delete the data. If you believe that a minor has transmitted data to us, contact us at contact@damjitech.com.

In the event of a personal data breach likely to give rise to a risk to your rights, we take the appropriate measures to remedy it and carry out, where applicable, the notifications required by law and by the CNDP, under the applicable conditions and time limits.

Any information communicated to you on this basis is intended to enable you to take the appropriate measures; it does not constitute an acknowledgement of liability on the part of Damjitech, which is assessed in light of its legal obligations.

The processing operations described in this policy are subject to the formalities provided for by Law 09-08 before the CNDP: prior declaration of the processing operations (Articles 12 and 13; a receipt is issued, in principle, within twenty-four hours allowing processing to begin, Article 19) and prior authorization for processing operations subject to a strengthened regime — the biometric KYC selfie (Articles 12 and 21 and CNDP Deliberation No. 478-2013) and the international transfer of data (Articles 43 and 44).

The processing of the biometric selfie is based on your specific consent and falls under the prior-authorization regime of the CNDP; the international transfers necessary for the functioning of the service (hosting and providers located outside Morocco) fall under the regime of Articles 43 and 44. Damjitech completes the corresponding formalities before the CNDP and limits the data concerned to what is strictly necessary.

Declaration receipt reference and CNDP authorization number(s): to be completed once the formalities are done.

For any complaint relating to the processing of your data, we invite you to contact us first at contact@damjitech.com: we endeavour to provide a response within a reasonable time.

This prior amicable step does not deprive you of your right to refer the matter to the CNDP at any time or to exercise the remedies provided for by law.

We may amend this Privacy Policy in order to reflect changes to our service or to the regulations. The date of the last update appears at the top of the document.

In the event of a substantial amendment, we will inform you by an appropriate means and, where required, obtain your acceptance or your consent. Continued use of the service after a non-substantial amendment constitutes acknowledgement of the version in force.

This policy is governed by Moroccan law, in particular Law 09-08 and its implementing texts.

Any dispute relating to its interpretation or performance falls within the jurisdiction of the competent Moroccan courts, without prejudice to the mandatory consumer-protection provisions and the right to refer the matter to the CNDP.

For any question relating to this policy or to the processing of your personal data, and for the exercise of your rights, contact us at contact@damjitech.com.

Data controller: Rayan Mamouni, Entrepreneur individuel — auto-entrepreneur (immatriculation en cours).

As part of the development of its business, Damjitech may carry out a restructuring, merger, contribution, total or partial transfer of assets, transfer of goodwill or change of control. In such a case, the personal data processed within the platform form part of the assets that may be transferred to the acquirer or beneficiary entity, which then becomes the data controller in place of Damjitech and remains bound to comply with this policy and with Law 09-08. We will inform you of such a transfer by an appropriate means where the law so requires, and the beneficiary will, where applicable, complete the formalities required with the CNDP. Your rights over your data remain unchanged and enforceable against the beneficiary.

When the payment, escrow, wallet or withdrawal features are activated, we process the data necessary for their execution: payment method, amount, fees, transaction status and references, supporting documents and vouchers, bank or withdrawal details that you register, and withdrawal requests. These processing operations are based on the performance of the contract and on our accounting and tax obligations.

The details of payment instruments (card number, bank authentication data) are entered and processed directly by the authorised payment service providers, on their own secure systems; Damjitech does not retain this data. The Moroccan payment providers process this data in Morocco.

At launch, no online payment is processed: transactions are settled in person, and financial data is only collected when you voluntarily register details, for example with a view to a future withdrawal. Payment data and the associated items of proof are retained under the conditions of section 11.

We measure the use of the platform in order to improve its functioning and security. This measurement is minimised: it relies on a visitor and visit identifier, on the classification of the acquisition source and on structured usage events that we define one by one (for example opening a page, a search with its filters, viewing a listing, a step in the journey), excluding any third-party advertising tracker. These events are recorded in our own infrastructure and transmitted to our product analytics provider, PostHog, hosted in the European Union (section 8). Automatic capture of page content and session recording are disabled.

Neither in these audience logs nor at that provider do we retain the raw text of your searches, your IP address or your browser identifier: page addresses are transmitted without their query parameters, your IP address is discarded on receipt, and the originating site is retained only in the form of its domain name. This measurement is based on our legitimate interest in understanding and improving the use of the service. You may object to it on legitimate grounds under the conditions of section 20.