Privacy Policy

1. Preamble and Data Controller

The purpose of this Privacy Policy is to inform the users of the RentalMe platform (hereinafter the “Platform”) of the conditions under which their personal data is collected and processed, in accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data, promulgated by Dahir No. 1-09-15 of February 18, 2009, its implementing decree No. 2-09-165 of May 21, 2009, as well as the deliberations, decisions and standards of the National Commission for the Control of Personal Data Protection (CNDP).

The data controller is STE UNZIPTECH SARL, a limited liability company under Moroccan law, ICE No. 003976166000014, whose registered office is located at Office No. 23, 5th floor, Les Bureaux Alwaha, No. 10 Machraa Belksiri Street VN, Fez 30000, Morocco (hereinafter “Unziptech” or “we”).

The data processing carried out via the Platform has completed the prior formalities required by Articles 12 et seq. of Law No. 09-08 with the CNDP: declaration receipt / authorization No. ……………

2. Data Collected

In the context of the use of the Platform, Unziptech may collect the following categories of data, in a fair, lawful, and proportionate manner, in accordance with Article 3 of Law No. 09-08:

• Identification data: last name, first name, date of birth, postal address, email address, telephone number, profile photograph.
• Verification data: copy of identity documents (national ID card, passport, residence permit), driving license, and, for professional partners, company identification documents (trade register, ICE/IF identifiers, operating licenses).
• Account and transaction data: login credentials, history of listings, bookings, rentals, reviews, exchanges via the Platform's messaging system.
• Payment data: information strictly necessary for the processing of payments by our approved payment gateway providers (Unziptech does not store full bank card numbers).
• Technical and browsing data: IP address, session identifiers, connection logs, device and browser type, data collected through cookies and trackers.
• Location data: where applicable, and subject to the user's prior consent, geolocation data necessary for proximity search features or tracking agreed upon with partners.
• Data from a connection via a third-party account (Social Login): when the user chooses to register or log in using a third-party account (Google, Facebook, Apple or other), Unziptech receives from the provider concerned certain profile information (last name, first name, email address, profile photograph and any other information made public or expressly authorized by the user). This information is used only for the purposes described in this Policy. Unziptech does not control and is not responsible for the processing carried out by said providers, whose privacy policies the user is invited to consult.
• Data collected via the mobile application: (i) device permissions – the application may request access to certain device features (camera, storage, geolocation), which the user may grant, refuse or revoke at any time in their device settings. (ii) device data – device and application identifiers, model, manufacturer, operating system and version, system configuration, carrier or access provider, network, IP address. (iii) push notifications – subject to the user's agreement, sending of notifications relating to the account and bookings, which can be disabled at any time in the device settings. This data is primarily necessary for the security and proper functioning of the application, troubleshooting and our internal statistics.

The fields marked as mandatory at the time of collection are necessary for the provision of the services. Failing this, the user's request cannot be processed. Unziptech does not collect any so-called “sensitive” data within the meaning of Article 1-3 of Law No. 09-08 (racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data), except where legally required and, in such a case, in strict compliance with the prior authorization of the CNDP.

3. Purposes of Processing

Data is collected for specific, explicit and legitimate purposes, namely:

• the creation, management and security of user accounts.
• connecting clients and partners, managing listings, bookings and rentals.
• processing payments, deposits, service fees and payouts.
• verifying profiles, documents and assets, preventing and combating fraud.
• managing customer relations, support and complaints.
• sending information about the services and, subject to the user's prior consent in accordance with Article 10 of Law No. 09-08, marketing and promotional communications.
• compiling usage statistics and improving the Platform.
• complying with Unziptech's legal, accounting and tax obligations and managing disputes.

4. Legal Bases for Processing

Processing is based, as the case may be, on: (i) the consent of the data subject, expressed in accordance with Article 4 of Law No. 09-08. (ii) the performance of the contract binding the user to Unziptech (Terms of Use, subscription) or pre-contractual measures. (iii) compliance with a legal obligation to which Unziptech is subject. or (iv) the pursuit of the legitimate interest of Unziptech, in compliance with the rights and interests of the data subjects.

5. Recipients of the Data

The data is intended for the authorized departments of Unziptech and, strictly within the limits of their duties and the aforementioned purposes:

• for partners and clients involved in a booking (communication of the information strictly necessary for the conclusion and performance of the rental contract).
• for Unziptech's technical providers and subcontractors (hosting, payment, email and SMS sending, support), which act on Unziptech's instructions and provide sufficient guarantees within the meaning of Article 23 of Law No. 09-08.
• for administrative or judicial authorities legally entitled to access them.
• in the event of a corporate transaction: in the context of, or during the negotiation of, any merger, asset sale, financing, restructuring or acquisition of all or part of Unziptech's business, the data may be transferred to the acquirer or its advisors, under a confidentiality undertaking, in compliance with Law No. 09-08 and after completion of the required formalities with the CNDP.

The data is not sold or rented to third parties for commercial purposes without the prior and express consent of the data subject.

6. Third-Party Services Integrated into the Platform

6.1. Google Application Programming Interfaces (Google API)

Unziptech's use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements: data obtained via Google APIs is used only to provide or improve user-facing features within the Platform, is neither transferred nor used for advertising purposes, and is accessible to natural persons only with the user's consent or for security or legal compliance reasons.

6.2. Google Maps Platform

The Platform integrates certain Google Maps Platform APIs (in particular the Google Maps API and Places API) for the purposes of map display, locating assets and proximity search. In this context, certain data (such as the IP address or location queries) may be communicated to Google, which acts according to its own terms and its own privacy policy, which the user is invited to consult (policies.google.com).

6.3. Audience Measurement (Google Analytics or equivalent)

Unziptech may use an audience measurement tool such as Google Analytics in order to analyze the use of the Platform and improve its services. The data thus processed is pseudonymized to the extent possible. The user may object to this audience measurement: (i) via the Platform's cookie management module. (ii) by means of the opt-out add-on provided by Google (tools.google.com/dlpage/gaoptout). or (iii) via Google's ad personalization settings. If Google Analytics advertising features are used, they will only be activated subject to the user's prior consent.

6.4. Payment Providers

Payments made via the Platform are processed by payment service providers approved in Morocco, namely: CMI, Payzone, Cashplus or another selected provider. Payment data (card numbers, security code) is collected and stored exclusively by these providers, within the framework of their own privacy policies, accessible on their respective websites. Unziptech does not store full bank card numbers.

7. Transfer of Data Abroad

When data is transferred to a foreign country, in particular in connection with the hosting of the Platform, this transfer is carried out in compliance with Articles 43 and 44 of Law No. 09-08: either to a State ensuring a sufficient level of privacy protection recognized by the CNDP, or after prior authorization from the CNDP and the implementation of appropriate safeguards (contractual data protection commitments concluded with the recipients).

8. Retention Periods

In accordance with Article 3 of Law No. 09-08, data is kept in a form allowing the identification of the data subjects for a period not exceeding that necessary for the purposes for which it is processed, namely, as an indication:

• account data: for the entire duration of the account, then archived for the applicable legal limitation period.
• contractual, transactional and accounting data: ten (10) years in accordance with the accounting obligations of the Commercial Code and Law No. 9-88 on the accounting obligations of traders.
• identity verification documents: for the period necessary for verification and then for the management of any disputes.
• connection logs and technical data: a period in line with the applicable standards, not exceeding twelve (12) months unless otherwise required by law.
• prospecting data: three (3) years from the last contact initiated by the data subject, unless consent is withdrawn earlier.

At the end of these periods, the data is deleted or irreversibly anonymized.

9. Rights of Data Subjects

In accordance with Articles 7, 8 and 9 of Law No. 09-08, every data subject has the following rights:

• Right of access (Article 7): to obtain from Unziptech confirmation as to whether or not data concerning them is being processed, as well as the communication of said data in an intelligible form.
• Right of rectification (Article 8): to obtain the updating, rectification, blocking or erasure of data that is inaccurate, incomplete, ambiguous or outdated, or whose collection, use, communication or storage is prohibited.
• Right to object (Article 9): to object, on legitimate grounds, to the processing of their data, and to object, free of charge and without justification, to their data being used for marketing and promotional communications purposes.
• Withdrawal of consent: where the processing is based on consent, the data subject may withdraw it at any time, without this withdrawal affecting the lawfulness of the processing carried out previously or of the processing based on another legal basis.
• Unsubscribing from commercial communications: the user may unsubscribe at any time from prospecting communications by clicking on the unsubscribe link in each message or by contacting Unziptech. They will nevertheless continue to receive the service messages strictly necessary for the management of their account and bookings.
• Viewing, updating and deleting the account: the user may view and update their account information directly from their personal space, or request the closure of their account. In the event of closure, the account and the data are deleted from the active databases, subject to the data whose retention remains necessary for fraud prevention, dispute management, compliance with Unziptech's legal obligations or the defense against legal claims, for the periods indicated in Section 8.

These rights are exercised with Unziptech, upon proof of identity, by email at [email protected] or by post to the registered office address indicated in Section 1. Unziptech undertakes to respond as soon as possible and at the latest within the time limits prescribed by the applicable regulations.

Any data subject may also lodge a complaint with the National Commission for the Control of Personal Data Protection (CNDP) – Avenue Al Arz, Sector 4, M1, Hay Riad, Rabat, Morocco – www.cndp.ma.

10. Data Security

In accordance with Articles 23 and 24 of Law No. 09-08, Unziptech implements the appropriate technical and organizational measures to protect data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, in particular: encryption of communications (TLS/HTTPS protocol), access and authorization control, logging, regular backups, staff awareness and confidentiality clauses imposed on subcontractors. These measures are also in line with the requirements of Law No. 05-20 on cybersecurity.

11. Cookies, Trackers and “Do-Not-Track” Signals

The Platform uses cookies and trackers for the following purposes: (i) the technical operation and security of the Platform (strictly necessary cookies). (ii) audience measurement and service improvement. and (iii) where applicable, content personalization. With the exception of strictly necessary cookies, the placing of cookies is subject to the user's prior consent, obtained by means of an information banner on the first visit. The user may at any time configure or withdraw their consent via the cookie management module or their browser settings, it being specified that refusing certain cookies may degrade the user experience.

“Do-Not-Track” (DNT) signals: some browsers and operating systems include a “Do-Not-Track” feature allowing users to signal a preference not to have their online browsing tracked. In the absence, to date, of a uniform and finalized technical standard for recognizing and implementing these signals, the Platform does not currently respond to them. Should such a standard be adopted and become binding on Unziptech, the user would be informed in a revised version of this Policy.

12. Minors

The Platform is intended exclusively for adults with full legal capacity. Unziptech does not knowingly collect data relating to minors. Any legal representative who becomes aware of the collection of data relating to a minor may request its deletion at [email protected].

13. Changes to this Policy

Unziptech reserves the right to modify this Privacy Policy at any time, in particular to take into account legal, regulatory or technical developments, as well as the recommendations of the CNDP. Any substantial modification will be brought to the attention of the users by any appropriate means. The applicable version is the one in force on the day the Platform is used.

14. Contact

For any question relating to this Policy or to the processing of your data:

• Email: [email protected]
• Phone: +212 660-010706
• Mail: STE UNZIPTECH SARL, Office No. 23, 5th floor, Les Bureaux Alwaha, No. 10 Machraa Belksiri Street VN, Fez 30000, Morocco.