Privacy policy

Data controller

SAMARA INVESTE MAROC, single-member limited liability company, Casablanca trade register No. 676421, 16 Boulevard des FAR, Rue Jilali Al Oraibi, 8th floor, No. 18, Casablanca, Morocco.

Phone: +212 6 64 12 68 17. Email: siminvestkarim@gmail.com.

Data processed

• Contact form: name, company, email, phone, country, subject, message, website language.
• Training request: training course requested, company, name, email, phone, country, number of participants, preferred format and period, message, website language.
• Invoice payment: payer type, company name, tax identifier or trade register number (business payers), contact name, email, phone, country, address, invoice or quote number, purpose, amount, currency, payment status and history, gateway transaction reference, dates and version of the general terms accepted, date of the attestation of card ownership and lawful origin of funds, website language, supporting document if you attach one (invoice, quote or purchase order).
• Payment by link: the details shown come from the invoice or quote issued by SAMARA INVESTE MAROC.
• Payment gateway: we receive the result of the operation and its reference. We never receive your full card number or its security code: they are entered and processed only on the secure page of the gateway.
• Technical data: a fingerprint of your IP address. This is pseudonymisation: the fingerprint remains personal data and is not anonymous. It is stored with your message, your training request or your payment. For payments, we also store your browser's technical identifier (user agent: browser, version, operating system), limited to 250 characters. The technical logs of the server hosting the website also record your full IP address.

On our forms, fields marked with an asterisk (*) are mandatory, as are the acceptance boxes on the payment form. Without this information, we cannot process your request or your payment. The other fields are optional. Our forms do not ask for any sensitive data or any identity document.

Purposes and legal bases

• Handling your quote and training requests, your orders and the resulting invoices. If you are the customer yourself, the basis is the performance of the contract or of pre-contractual steps taken at your request. If you act on behalf of a company, the basis is the legitimate interest of SAMARA INVESTE MAROC in answering requests and managing its relationship with its business customers.
• Replying to your messages: the company's legitimate interest in answering people who contact it. If your message concerns a quote, the basis is the performance of pre-contractual steps taken at your request.
• Processing payments: performance of the contract. Securing payments and preventing fraud (payer attestation, IP address fingerprint, browser identifier): the company's legitimate interest in protecting its receipts.
• Keeping evidence of the acceptance of the terms and of the payer's attestations: the company's legitimate interest in being able to prove these commitments.
• Protecting the website and its forms against abusive submissions (IP address fingerprint, technical logs): the company's legitimate interest in protecting its website and its users.
• Keeping accounts and supporting documents: legal obligation under Moroccan law. For people protected by the GDPR or by the Saudi personal data protection law, this processing is based on the company's legitimate interest in complying with the accounting and tax obligations of its country of establishment.

Your data is not further processed in a manner incompatible with these purposes. It is not used for marketing.

Recipients

Your data is processed by authorised staff of SAMARA INVESTE MAROC, within the limits of their duties. It is also disclosed, as relevant:

• to the institution that collects card payments on our behalf (acquiring bank) and to its technical payment provider, for card payments;

Administrative and judicial authorities may obtain it where the law so provides. Your data is never sold or rented.

Retention periods

• Invoices, accounting records and supporting documents for completed payments (reference, amount, currency, payer identity, dates and version of the terms accepted, date of the attestation): ten years, the retention period for accounting records under Moroccan law (Article 211 of the General Tax Code).
• Declined, cancelled or expired payment attempts, and payment requests that have expired, been cancelled or remained in draft: 13 months from the attempt or from the creation of the request, then deleted or anonymised.
• IP address fingerprint and browser identifier: 12 months from recording, then erased.
• Contact messages and training requests with no business follow-up: 2 years after the last exchange, then deleted.
• Contact messages and training requests followed by an order: 10 years.
• Technical logs: 12 months at most.

An automatic daily deletion applies these periods to unsuccessful payment attempts and to payment requests that have expired, been cancelled or remained in draft, to IP address fingerprints and browser identifiers, and to contact messages and training requests.

Right to object

You may object, on legitimate grounds, to the processing of your data, in particular where it is based on the legitimate interest of SAMARA INVESTE MAROC, except where the processing is required by law. You may also object, free of charge and without giving reasons, to its use for marketing. This right is exercised as explained below.

Your rights

You may access your data free of charge and ask for it to be corrected, updated, erased or blocked, and for its processing to be restricted. Where processing is based on your consent or on a contract, you may also receive the data you provided to us in a structured, commonly used format. These rights have limits: for example, we must keep invoices and accounting records for the period set by law.

To exercise your rights, including the right to object, write to siminvestkarim@gmail.com or to the registered office. A request sent from the email address you have already given us is usually enough. If we have reasonable doubts about your identity, we ask you for additional information, and for a copy of an identity document only if no other means can resolve the doubt. You may then hide the document number.

We reply without delay to access requests and objections. If your data is inaccurate, incomplete or processed unlawfully, we correct, erase or block it within ten clear days. For people protected by the GDPR or by the Saudi personal data protection law, we reply within one month at the latest, and no later than thirty days; this period may be extended under the conditions laid down by those laws, in which case we will tell you before the first period ends, with the reasons.

You may lodge a complaint with the Moroccan data protection authority (Commission nationale de contrôle de la protection des données à caractère personnel, CNDP, www.cndp.ma) or with the data protection authority of your country. In the European Union, this is the authority of the Member State of your habitual residence, place of work or place of the alleged infringement.

Cookies and local storage

The website sets no advertising, analytics or social media cookies and loads no resources from third-party sites. It stores on your device:

• theme (browser local storage, not a cookie): remembers your light or dark display choice, only if you click the theme button. It also records the date of that choice; after 180 days, it is no longer used and is erased on your next visit.
• payload-token (cookie): administration area session, for authorised staff only. It expires after two hours.

These items are used only to run the website or to store a setting you choose. They are not shared with any third party.

Security

The website is served over HTTPS only. Administration passwords are stored in hashed form; an account is locked for fifteen minutes after five failed login attempts, and sessions expire after two hours. Access to data is limited to authorised people according to their role. Your IP address is kept in our database only as a fingerprint. Card payments go exclusively through the secure page of the payment gateway.

Data sent over the Internet, an open network, may travel without full security guarantees and be read or used by unauthorised third parties. Our forms use an encrypted connection. If you email us directly, do not attach sensitive documents.

Updates

This policy may change. The date of the version in force is shown at the top of the page.