Privacy policy

§1 Who we are

Map Syndicat is a classifieds platform for Morocco: property for sale and rent, cars, pharmacies de garde, restaurants and discoveries.

The data controller is [CONTROLLER NAME — OWNER TO SUPPLY], [CONTROLLER POSTAL ADDRESS — OWNER TO SUPPLY]. Registration number: [REGISTRATION NUMBER — OWNER TO SUPPLY IF APPLICABLE].

Our EU representative, where one is required, is [EU REPRESENTATIVE — OWNER/LAWYER TO SUPPLY].

For any question about this policy, contact us at contact@mapsyndicat.com (see §13).

§2 Data we collect

We collect data in three groups:

We do not intentionally collect sensitive data, such as health data, religious or political beliefs, or biometric data. Please do not include sensitive information in listings, reviews, discoveries or messages to us.

• (a) Data you give us — account data: your name, email address and phone number when you create an account, post a listing, or contact us.
• Listing content: the title, price, description, photos and location you provide when you post a listing.
• Lead form data: your name and phone number when you use a lead form to contact a seller (see §5 and §6).
• Reviews, discoveries and wishlist items you create while signed in.
• Messages you send us, including emails to contact@mapsyndicat.com.
• (b) Data collected automatically: your searches, page views, analytics events, browser and device information, IP address, approximate location, and error logs.
• Cookie identifiers, as described in §4. No analytics or advertising cookies are set before you give consent.
• (c) Data from public sources: aggregated listings collected from public sources, limited to the title, price, description, photos, approximate location and source link of the original public listing.

§3 Listings and your contact details — read this before posting

• When you post a listing, it is public: anyone visiting the site can see its title, price, description, photos and approximate location.
• Your name and phone number on a listing are visible to signed-in users.
• Think before you post: do not include information you do not want to be public.
• You can delete a listing at any time from your dashboard.
• Aggregated listings — listings we collect from public sources — are shown as a card with a link to the original source only. We do not publish the seller's contact details for aggregated listings.
• To ask for the removal (takedown) of an aggregated listing, email contact@mapsyndicat.com with the listing link. See §9 for how to make a request.

§4 Cookies and similar technologies

Cookies are small files stored on your device that help the site work and help us understand how it is used. We use three categories:

We do not set analytics or advertising cookies before you give consent through the cookie banner.

You can change your choice at any time via the “Cookie settings” link in the site footer.

• Strictly necessary cookies: needed for the site to work, including sign-in, security, and remembering your language. These do not require consent.
• Analytics cookies: help us understand which pages and features are used, so we can improve the service. These are set only after you accept them.
• Advertising cookies: used to show and measure advertisements, including Google AdSense when it is live. These are set only after you accept them.

§5 Why we use data and the legal basis

We use your data only for the purposes below. The legal basis for each purpose is shown under the GDPR, Article 6.

Where we rely on your consent, you can withdraw it at any time (see §9). Withdrawing consent does not affect use already made while consent was in place.

• Account email and one-time code (OTP) sign-in: to provide your account. Legal basis: contract, GDPR Article 6(1)(b).
• A listing you post: to display it on the platform, as you chose by publishing it. Legal basis: contract and your publication choice, GDPR Article 6(1)(b).
• Lead form: to pass your enquiry to the seller. Legal basis: consent, GDPR Article 6(1)(a). By submitting the form you agree that your name and phone number go to the seller via WhatsApp (see §6).
• Reviews, discoveries and wishlist: to provide these account features and to display your public contributions. Legal basis: contract for the account features, GDPR Article 6(1)(b), and consent for public display, GDPR Article 6(1)(a).
• Analytics: to understand use of the site and improve it. Legal basis: consent via the cookie banner, GDPR Article 6(1)(a).
• Aggregated public listings: to show listings that are already public. Legal basis: legitimate interest, GDPR Article 6(1)(f). Balancing measures: takedown on request (see §3 and §9) and automatic deletion 3 days after a listing was last seen (see §8).
• Contact emails: to answer your questions and requests. Legal basis: contract and legitimate interest, GDPR Article 6(1)(b) and 6(1)(f).
• Security logs: to keep the platform safe and prevent abuse. Legal basis: legitimate interest, GDPR Article 6(1)(f).

§6 Who we share data with

We do not sell your personal data.

We share data only with the service providers (processors) below, which process data on our instructions to run the platform:

When AdSense is live, Google and its advertising partners may receive cookie identifiers, page views and approximate location to serve and measure advertisements, but only if you have accepted advertising cookies (see §4). This is not a sale of your personal data.

§7 International transfers

Our hosting and database are located outside Morocco. Hosting regions: [HOSTING REGIONS — TO BE CONFIRMED].

When personal data is transferred to the European Union or elsewhere, we rely on transfer mechanisms [TRANSFER MECHANISMS — TO BE CONFIRMED].

Transfers out of Morocco are made in accordance with Law 09-08, Articles 43–44, with CNDP authorisation where required. CNDP authorisation status: [CNDP AUTHORISATION STATUS — TO BE FILED/CONFIRMED].

§8 How long we keep data

When a retention period ends, we delete or anonymise the data. Anonymised analytics that no longer identifies you may remain (see §9).

• Listings you post: 30-day listing life. You can delete a listing at any time from your dashboard.
• Aggregated listings: automatically deleted 3 days after last seen.
• Analytics data: 14 months (proposed).
• Contact emails: 12 months (proposed).
• Dormant accounts: deleted after 12 months of inactivity (proposed).
• Security logs: kept only as long as needed to investigate and prevent abuse.

§9 Your rights and how to exercise them

To exercise any of your rights, email contact@mapsyndicat.com with the subject “Privacy request”.

We verify requests using your account email, so please write from the email address linked to your account.

We reply within one month for GDPR requests and within 45 days for California requests.

Deleting your account removes your listings, reviews and profile. Anonymised analytics that no longer identifies you may remain.

California notice: the categories of personal data we collect are identifiers (name, email address, phone number), account and listing content, internet activity (page views, searches, analytics events) and approximate location. The purposes are those listed in §5.

We do not sell your personal data. The “Do Not Sell or Share My Personal Information” link in the footer lets you opt out of any sharing of cookie identifiers with advertising partners as described in §6; opting out stops advertising cookies from being set for you. We also honour Global Privacy Control (GPC) signals as an opt-out of sale or sharing.

• Access: ask what personal data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: ask us to delete your personal data, including by deleting your account.
• Objection: object to processing based on legitimate interest, including aggregated listings (see §3 for takedown).
• Withdrawal of consent: withdraw consent for analytics cookies, advertising cookies, or public display of your contributions at any time.
• California rights: the right to know what we collect and why, to delete your personal data, to correct inaccurate data, and to opt out of sale or sharing. We will not discriminate against you for exercising any of these rights.

§10 Morocco — Law 09-08 and the CNDP

Under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, you have the rights to be informed, to access your data, to rectify it, to erase it, and to object to its processing.

You can exercise these rights by emailing contact@mapsyndicat.com with the subject “Privacy request” (see §9).

You can also complain to the CNDP, the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel, Hay Riad, Rabat.

CNDP declaration status: [CNDP DECLARATION STATUS — TO BE FILED/CONFIRMED]. CNDP authorisation status: [CNDP AUTHORISATION STATUS — TO BE FILED/CONFIRMED].

§11 Children

Our service is not directed at children under 16, and we do not knowingly collect personal data from children under 16.

If you are a parent or guardian and believe your child has provided us with personal data, email contact@mapsyndicat.com and we will delete it.

§12 Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date above.

For material changes, we will give notice before the changes take effect, so you can review them.

§13 Contact

For any question about this policy or your personal data, contact us at contact@mapsyndicat.com.

General questions: we aim to reply within 24–48 hours. Formal privacy requests: within one month (GDPR) or 45 days (California), as described in §9.