Privacy Policy
Last updated: 29 September 2026 · Version 1.2
1. Introduction
Ste Aznag Cars ("we," "our," or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with Moroccan Law 09-08 on the Protection of Individuals with regard to the Processing of Personal Data and its implementing Decree No. 2-09-165.
Our Commitment: We are registered with the CNDP (Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel) and comply with all Moroccan data protection regulations.
2. Data Controller
Company Name: Ste Aznag Cars
ICE (Common Company Identifier): 001732961000040
RC: 5651 Agadir
Address: Boulevard des F.A.R., Galerie Yassine n°2, Agadir, Morocco
Phone: +212 660 180 709
Email: aznagcars@gmail.com
3. Personal Data We Collect
We collect the following categories of personal data:
3.1 Identity Information
- Full name (first name, last name)
- Date of birth
- Nationality
- Passport or national ID number
- Driver's license number and expiry date
- Photograph (from ID documents)
3.2 Contact Information
- Email address
- Phone number (mobile and landline)
- WhatsApp number
- Residential address
- Emergency contact details
3.3 Financial Information
- Credit card details (last 4 digits, expiry date, card type)
- Billing address
- Payment transaction history
- Bank pre-authorization records
Note: Full credit card numbers are not stored by us but are processed securely by our payment service providers.
3.4 Rental Information
- Booking and reservation details
- Vehicle selection and preferences
- Pickup and drop-off locations and dates
- Additional services requested (GPS, child seat, etc.)
- Rental agreement and contract details
- Inspection reports and vehicle condition records
3.5 Usage and Technical Data
- GPS location data (for equipped vehicles)
- Mileage and trip information
- Vehicle diagnostic data
- Website browsing activity and cookies
- IP address and device information
- Communication preferences
3.6 Incident and Compliance Data
- Accident and damage reports
- Police reports and insurance claims
- Traffic violations and fines
- Customer service communications
- Complaint records and dispute resolution
4. How We Collect Personal Data
We collect personal data through the following methods:
- Direct Collection: When you make a booking online, by phone, email, or WhatsApp
- At Pickup: When you present documents and sign the rental agreement
- During Rental: Through GPS tracking devices in vehicles (with your consent)
- Website: Through cookies, forms, and browsing activity
- Third Parties: From payment processors, credit card companies, insurance providers, and authorities (for fines or legal matters)
- Publicly Available Sources: If required for verification or fraud prevention
5. Legal Basis and Purposes of Processing
In accordance with Article 4 of Law 09-08, we process your personal data with your consent or, where the law allows it without consent, when processing is necessary for the following purposes:
5.1 Contract Performance
Processing necessary to fulfill our rental agreement with you:
- Managing bookings and reservations
- Providing rental services and vehicles
- Processing payments and refunds
- Managing security deposits
- Vehicle delivery and return
- Customer support and assistance
5.2 Legal Obligations
Processing required by Moroccan law:
- Tax and accounting requirements
- Reporting traffic violations to authorities
- Responding to legal requests and court orders
- Compliance with anti-money laundering regulations
- Maintaining rental records as required by law
- Insurance and liability documentation
5.3 Legitimate Interests
Processing necessary for our legitimate business interests:
- Fraud prevention and detection
- Debt collection and financial management
- Vehicle security and theft prevention through GPS tracking
- Fleet management and maintenance optimization
- Service quality improvement and customer satisfaction
- Website security and functionality
- Internal record keeping and business analytics
5.4 Consent
Processing based on your explicit consent:
- Marketing communications (email, SMS, WhatsApp)
- Special offers and promotions
- Customer satisfaction surveys
- Sharing testimonials or reviews
Note: You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
6. Data Sharing and Recipients
We may share your personal data with the following categories of recipients:
6.1 Service Providers
- Payment processors and banks
- IT hosting and cloud service providers
- Email and SMS service providers
- GPS tracking and telematics providers
- Accounting and legal advisors
All service providers are bound by strict data processing agreements and can only process data on our instructions.
6.2 Insurance Companies
In case of accidents, damage, or theft, we share relevant information with our insurance providers to process claims.
6.3 Authorities and Law Enforcement
- Moroccan police and gendarmerie
- Tax authorities
- Courts and judicial authorities
- Traffic enforcement agencies
- CNDP (data protection authority)
We only share data with authorities when legally required or to protect our rights and property.
6.4 Business Transfers
If we merge with, are acquired by, or sell assets to another company, your personal data may be transferred to the new entity, subject to the same privacy protections.
Important: We do not sell your personal data to third parties for marketing purposes.
7. International Data Transfers
Some of our service providers are located outside Morocco. Transfers of personal data abroad are carried out in accordance with Articles 43 and 44 of Law 09-08:
- Supabase (database) - France, European Union: a country recognized by the CNDP as providing sufficient protection (CNDP Deliberation No. 236-2015)
- Vercel (website hosting), Resend (email sending), Google (maps) - United States: transfers necessary for the performance of your rental contract and covered by contractual clauses with these providers, with the authorization of the CNDP where required
- Google (audience measurement, Google Analytics) - United States: transfer made only if you accept audience measurement cookies, on the basis of your consent, and covered by Google's contractual clauses, with the authorization of the CNDP where required
8. Data Retention
We retain your personal data only for as long as necessary for the purposes outlined in this policy and as required by law:
| Data Type | Retention Period |
|---|---|
| Rental contracts, invoices, and accounting records | 10 years (Law 9-88, Article 22; General Tax Code, Article 211) |
| Copies of ID documents and driver's licenses | Until the rental and any related claim or dispute is closed, then deleted |
| Accident and insurance claims | 10 years after claim resolution |
| Customer account data | 3 years after last activity |
| Marketing consent | 3 years from last consent or contact |
| GPS tracking data | 90 days after rental end |
| Website cookies | As specified in the Cookie Policy |
| Correspondence and complaints | 3 years after resolution |
After the retention period expires, we securely delete or anonymize your personal data unless longer retention is required by law or for the defense of legal claims.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration:
Technical Measures:
- SSL/TLS encryption for data transmission
- Encrypted storage of sensitive data
- Secure backup systems
- Firewall and intrusion detection systems
- Regular security audits and vulnerability assessments
- Access controls and authentication systems
Organizational Measures:
- Staff training on data protection
- Confidentiality agreements with employees and contractors
- Role-based access controls (only authorized personnel can access data)
- Data breach response procedures
- Regular privacy impact assessments
- Vendor security due diligence
In accordance with Article 23 of Law 09-08, our service providers that process data on our behalf are bound by written contracts requiring them to protect your data and act only on our instructions.
Data Breach: If a security incident is likely to affect your personal data, we are committed to informing you and the CNDP as soon as possible.
Please note that data sent over open networks such as the internet may circulate without guarantee of security and may be read or used by unauthorized third parties.
10. Your Data Protection Rights
Under Moroccan Law 09-08, you have the following rights regarding your personal data:
10.1 Right to Information - Article 5
When we collect your data, you are informed of who we are, why we collect it, who receives it, whether each answer is mandatory or optional, and what rights you have. This Privacy Policy and the notices on our forms serve this purpose.
10.2 Right of Access - Article 7
You can obtain, free of charge, confirmation of whether we process your data, the purposes of the processing, the categories of data and recipients, a copy of your data, and any available information about its origin.
10.3 Right to Rectification - Article 8
You can ask us to update, correct, erase, or block data that is inaccurate, incomplete, or processed in breach of the law. We make these changes free of charge within ten (10) clear days and inform any third parties to whom the data was disclosed.
Note: Some records, such as invoices and rental contracts, must be kept for the periods required by law (see Section 8).
10.4 Right to Object - Article 9
You can object, for legitimate reasons, to the processing of your data. You can also object at any time, free of charge and without giving a reason, to the use of your data for marketing. This right does not apply where processing is required by law.
10.5 Direct Marketing - Article 10
We only send you marketing messages by email, SMS, or WhatsApp with your prior consent. Every message lets you unsubscribe easily.
10.6 No Automated Decisions - Article 11
No decision with legal effects on you is taken solely on the basis of automated processing of your data.
10.7 Right to Lodge a Complaint - Article 28
You can file a complaint with the CNDP if you believe your rights have not been respected (see Section 11).
How to Exercise Your Rights:
To exercise any of these rights, please contact us at:
- Email: aznagcars@gmail.com
- Phone: +212 660 180 709
- Mail: Ste Aznag Cars, Data Protection, Boulevard des F.A.R., Galerie Yassine n°2, Agadir, Morocco
We answer access requests without delay and carry out rectifications within ten (10) clear days. We may ask you to prove your identity before processing your request to protect your privacy.
11. Supervisory Authority
If you are not satisfied with our response or believe we have violated your data protection rights, you have the right to lodge a complaint with the Moroccan data protection authority:
CNDP - Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel
Address: Avenue Al Arz, Secteur 4, M1, Hay Riad, Rabat, Morocco
Phone: +212 537 57 11 24
Fax: +212 537 57 21 41
Email: contact@cndp.ma
Website: www.cndp.ma
12. Cookies and Tracking Technologies
Our website uses the cookies needed for it to work, cookies set by the embedded Google Maps and, only if you accept them, audience measurement cookies (Google Analytics, Microsoft Clarity). For detailed information about our cookie practices, please see our Cookie Policy.
We do not use advertising cookies. You can accept or decline audience measurement cookies at any time through the "Cookie settings" link at the bottom of every page, and control cookies through your browser settings.
13. Children's Privacy
Our services are not intended for individuals under 21 years of age (the minimum rental age). We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it promptly.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
- Posting the updated policy on our website with a new "Last updated" date
- Sending you an email notification (if you have an account with us)
- Displaying a prominent notice on our website or during the booking process
Your continued use of our services after the effective date constitutes acceptance of the updated policy.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:
Data Protection Contact:
Email: aznagcars@gmail.com
Phone: +212 660 180 709
Mail: Ste Aznag Cars, Data Protection
Boulevard des F.A.R., Galerie Yassine n°2
Agadir, Morocco
This Privacy Policy complies with Moroccan Law 09-08 on the Protection of Personal Data and is registered with the CNDP.
In case of discrepancy between language versions, the French version prevails.