Privacy Policy

1. Introduction

BOXSPOT SARL attaches essential importance to the protection of personal data and respect for user privacy. This Privacy Policy clearly and thoroughly explains the nature of the information collected, its purposes, users’ rights, and the security measures implemented in accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data.

2. Data controller

The data controller is: BOXSPOT SARL

Avenue Moulay Ismail, Résidence Moulay Ismail No. 22, 5th floor, No. 19 – Tangier, Morocco

📧 privacy@boxspot.ma • 📞 +212 668 984 050

3. Data collected

3.1. Data provided directly by the user

Name, first name (optional depending on the form), email address, phone number, login credentials (user account).

3.2. Automatically generated data

IP address, browser type, login logs, reservation data (QR code, timestamped photo, date and place of deposit), technical payment data (Payzone transaction, timestamp, order ID).

3.3. Data from cookies and trackers

When browsing BoxSpot.ma, cookies may be placed to ensure the proper functioning of the site, measure audience and performance (Google Analytics), and optimize marketing campaigns (Meta Pixel). Non-essential cookies are subject to the user’s prior consent via a banner.

4. Purposes of processing

Personal data is processed to: 1) Provide and manage booking services; 2) Enable billing and secure payment via Payzone; 3) Ensure communication between Client and Partner; 4) Prevent fraud and secure transactions; 5) Manage claims, incidents, and customer support; 6) Analyze site performance and improve user experience; 7) Comply with Moroccan legal and regulatory obligations.

5. Legal basis for processing

In accordance with Article 5 of Law No. 09-08, processing is based on the following legal grounds: • Contract performance: management of reservations, payments, and deposits; • Legitimate interest of BoxSpot: security, fraud prevention, service optimization; • Explicit user consent for non-essential cookies and marketing communications; • Legal obligations regarding accounting retention and transaction security.

6. Hosting and security

Data is hosted on a private cloud infrastructure located exclusively in Morocco. Technical and organizational security measures are implemented: encrypted communications (HTTPS/SSL/TLS), logging and access control, regular backups, strict access limitation to authorized personnel only, and periodic security audits.

7. Retention period

Personal data is kept for the period strictly necessary for its purpose: • Client data: 24 months after the last account activity; • Reservation data and evidence (QR, photo, logs): 5 years for evidentiary and accounting compliance purposes; • Analytics and marketing cookies: maximum duration of 13 months; • Technical logs: as long as their operational usefulness justifies. After these periods, data is securely deleted or anonymized.

8. Data recipients

Data is only accessible to: BOXSPOT SARL and its authorized staff, commercial Partners with whom a reservation is made, the payment provider Payzone Morocco, BoxSpot’s cloud host, and Moroccan judicial or administrative authorities upon legal requisition. No data is transferred outside Moroccan territory.

9. User rights

In accordance with Articles 7 to 9 of Law No. 09-08, every user has the following rights: right of access to their personal data, right to rectification in case of error or incompleteness, right to object on legitimate grounds, and right to deletion when retention is no longer necessary.

Any request can be sent to privacy@boxspot.ma with a copy of a valid ID. BoxSpot undertakes to respond within a maximum of 30 days from receipt.

10. Processors and joint controllers

BoxSpot uses technical service providers and partners to manage the service (host, Payzone, analytics tools). Each acts under BoxSpot’s responsibility and instructions, subject to contractual confidentiality and compliance with Law 09-08.

11. Cookies and consent

On the first visit to the site, a banner informs the user of the presence of cookies. They can accept all cookies, refuse non-essential cookies, or configure their choices at any time via the dedicated module. Lack of consent for analytics or advertising cookies does not affect access to the service.

12. Payment security

Financial transactions are processed entirely by Payzone Morocco, an entity authorized by Bank Al-Maghrib. BoxSpot neither collects nor retains any banking data. Payments are secured by encryption and strong customer authentication.

13. Policy changes

BoxSpot reserves the right to modify this Privacy Policy at any time. The applicable version is the one published on the site at the date of use. Any substantive change will be notified by email or via the site.

14. Governing law and remedies

This Policy is governed by Moroccan law. In case of dispute, exclusive jurisdiction is granted to the courts of Tangier, without prejudice to legal remedies before the National Commission for the Control of Personal Data Protection (CNDP).