This document sets out what personal data xmarlin.com collects, what we do with it, who it is passed to and how to have it corrected or deleted. It covers Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data, and European regulation 2016/679 (GDPR) for visitors in the European Union.
1. Data controller
- Controller
- [[TO FILL: exact registered name and ICE of the data controller]]
- Address
- [[TO FILL: full postal address of the data controller]]
- Data protection contact
- [[TO FILL: dedicated email address for personal data requests]]
- CNDP declaration
- [[TO FILL: number and date of the CNDP declaration receipt under law 09-08, and the exact title of the declared processing]]
- Data protection officer
- [[TO FILL: name and contact details of a DPO, or an explicit statement that none is appointed]]
2. Data collected
Data you enter
- Full name
- Phone number, normalised to the international +212 format
- City
- Delivery address, and any landmark given on the phone
- Kit ordered, adult size, kid size, colourway, price in dirhams
No email address is asked for. No account is created. No banking data is collected, because payment is made in cash to the courier.
Order tracking data
- Order status, outcome of the confirmation call, date of confirmation
- Dispatch date, tracking number, delivery date, reason for refusal if any
Technical and advertising data
- Campaign parameters present in the page address: source, campaign and creative identifier
- Advertising click identifiers passed by Meta and TikTok
- Site audience measurement, without cookies and without any individual identifier
- [[TO FILL: state whether the IP address and user-agent are recorded server-side when the form is submitted, and for how long — to be confirmed with stream D once the Function is written]]
3. Purposes and legal bases
- Processing and delivering the order
- Performance of the contract, and of pre-contractual steps for the confirmation call.
- Calling or messaging on WhatsApp to confirm the order
- Performance of the contract. Without this step the order is not dispatched.
- Answering questions and handling an exchange
- Performance of the contract and our legitimate interest in providing customer service.
- Measuring how well the advertising works
- Consent for visitors in the European Union. The advertising pixels do not load before consent is given. [[TO FILL: basis chosen for visitors in Morocco, to be approved by counsel under law 09-08]]
- Accounting and tax obligations
- Legal obligation. [[TO FILL: statutory retention period for accounting records, to be confirmed by the accountant]]
4. Recipients and processors
- Cloudflare
- Site hosting, running the order form, cookie-free audience measurement.
- Supabase
- Order database. [[TO FILL: hosting region of the Supabase project]]
- Carrier
- Name, phone and address are passed on for delivery and to collect payment. [[CONFIRM WITH CARRIER: name of the carrier, and whether a written processing agreement covers the data passed to it]]
- Meta
- Pixel and Conversions API, for advertising measurement. WhatsApp Business for customer contact.
- TikTok
- Pixel and Events API, for advertising measurement.
The data is neither sold nor rented. No recipient other than those listed above receives order data.
5. Transfers outside Morocco
The providers above host or process data outside Moroccan territory.
[[TO FILL: legal basis for transfers outside Morocco, and the CNDP transfer authorisation if one is required for this processing. For visitors in the European Union, state the mechanism used for transfers outside the EU — standard contractual clauses or an adequacy decision. To be approved by counsel]]
6. Retention periods
- Delivered order
- [[TO FILL: how long a delivered order is kept]]
- Cancelled or unconfirmed order
- [[TO FILL: how long a cancelled or unanswered order is kept]]
- Accounting records
- [[TO FILL: statutory accounting retention period, confirmed by the accountant]]
7. Your rights
Visitors in Morocco — law 09-08
Law 09-08 gives a right of access, a right of rectification and a right to object, exercised with the data controller, as well as the right to refer a matter to the CNDP.
[[TO FILL: exact wording of the rights under law 09-08, response times and the documents needed to support a request, to be approved by counsel]]
Visitors in the European Union — GDPR
You have the right of access, rectification, erasure, restriction of processing, portability and objection, and the right to lodge a complaint with the supervisory authority of the country you live in.
How to exercise these rights
Write to [[TO FILL: dedicated email address for personal data requests]] or to [[TO FILL: full postal address for written requests]]. Answered within [[TO FILL: chosen response time, consistent with the applicable statutory limits]].
8. Cookies and trackers
Site audience measurement works without cookies. The Meta and TikTok advertising pixels do set trackers, and for visitors in the European Union they load only after consent. Declining stops neither browsing nor ordering.
[[TO FILL: final list of trackers set, their lifetime and their purpose, to be drawn up with stream D once the pixels are installed]]
9. Security
Traffic to and from the site is encrypted. Access to the order database is limited to the people who process orders.
[[TO FILL: named list of people with access to the order database, and the procedure followed in the event of a data breach]]
10. Minors
The site sells children's clothing, but orders are placed by adults. No data is collected directly from a minor, apart from the child's size, entered by the adult placing the order.
11. Changes
Any change to this policy is published on this page, with the date it was updated.