Privacy policy

Last updated: 23 July 2026 — version 1.1

Courtesy translation. This page is an English translation provided for convenience. Only the French version is legally binding; in the event of any discrepancy, the French text prevails.

This page describes exactly what data the qualification workspace processes — and what it does not.

Data controller

NextData SARL (see the legal notice) for the data relating to your subscription. Contact: contact@nextdata.ma.

For the data of your own contacts that you enter into the workspace, you are the data controller and we act as processor, on your instructions alone.

CNDP declaration: in progress. The processing is being declared to the Moroccan National Commission for the Control of Personal Data Protection; the receipt number will be published here as soon as it is issued.

Data processed

Data	Source	Where	Retention
E-mail address, receipt number, product, plan, dates	Sent by JVZoo at purchase	A file on our server (France)	Duration of the subscription + accounting obligations
Content of qualification conversations	Entered by you	Volatile memory only	1 hour of inactivity, and lost on every restart
Name, e-mail and time slot of an appointment	Entered by you	Sent by e-mail (ICS invitation)	Not retained by the service

Conversations are never written to disk. They live in memory for the duration of the exchange, then disappear. We therefore cannot read them back, restore them, or exploit them.

What we do not process

No banking data. Payment is collected by JVZoo; we see neither your card nor your payment details.
Nothing is sent to a third-party AI service. The qualification workspace runs on a deterministic script, with no call to a language model. Nothing you enter leaves our infrastructure, apart from the calendar invitation you trigger yourself.
No advertising trackers and no analytics cookies in this workspace.

Legal basis for processing

If you are located in the European Union, Regulation (EU) 2016/679 (GDPR) applies in addition to Moroccan law 09-08. Each processing operation rests on the following legal basis:

Processing	Legal basis
Opening the subscription, delivering and maintaining the access link	Performance of the contract (Art. 6(1)(b))
Sending the calendar invitation you trigger	Performance of the contract (Art. 6(1)(b))
Retention of receipts and accounting records	Legal obligation (Art. 6(1)(c))
Security of the service: signature verification, payment ledger	Legitimate interest (Art. 6(1)(f))

No data is used for prospecting or profiling. No solely automated decision producing legal effects concerning you is taken.

Processing on your behalf

For the data of your contacts that you enter into the workspace, you are the controller and we act as processor within the meaning of Article 28 GDPR. On that basis we undertake to:

process that data only on your documented instructions;
bind every person with access to it by a duty of confidentiality;
apply the security measures described below;
use only the sub-processors listed below, and inform you of any change affecting them;
assist you in handling data subject requests and in the event of a personal data breach;
delete that data at the end of the service — for conversations, deletion is immediate and structural: they are never written to disk.

A written data processing agreement reflecting these commitments can be entered into on request at contact@nextdata.ma.

Recipients

JVZoo — payment collection and notification.
OVH SAS (France) — hosting of the service.
Our mail server — delivery of the access link and of calendar invitations.

No data is sold, rented or transferred for advertising purposes.

Location and transfers

Data is hosted in France (OVH, Roubaix), therefore within the European Union. This transfer outside Morocco is necessary to provide the service you subscribe to.

As NextData SARL is established in Morocco, the technical administration of the service (operation, maintenance, support) is carried out from Morocco. For data covered by the GDPR this constitutes a transfer to a third country: Morocco is not the subject of an adequacy decision by the European Commission.

Safeguards for this transfer: currently being put in place. The Standard Contractual Clauses adopted by the European Commission will be entered into and their adoption reported here. We would rather say so than let you assume a safeguard already exists. In the meantime the data itself remains located in the European Union, and conversations never leave the memory of the French server.

Your rights

Under law 09-08 and, if you are located in the European Union, under the GDPR, you have the following rights:

Access — obtain a copy of the data concerning you;
Rectification — correct inaccurate data;
Erasure — obtain deletion of your data, subject to the records accounting law requires us to keep;
Restriction — freeze a processing operation while a dispute is resolved;
Objection — object to processing based on our legitimate interest;
Portability — receive the data you provided to us in a structured, machine-readable format;
Complaint — lodge a complaint with a supervisory authority (see below).

Write to contact@nextdata.ma from the address used for the purchase. We reply within one month at the latest, and in practice well before; that period may be extended by two months for a complex request, in which case we inform you and state the reason.

Complaints. You may lodge a complaint with the CNDP (Morocco) or, if you reside in the European Union, with the supervisory authority of your Member State of residence, place of work, or of the place of the alleged infringement.

Deleting your account closes your access. Information required to substantiate transactions for accounting purposes is kept for the legal retention period.

Security

The service is served over HTTPS only. The access link is cryptographically signed and verified on every request. Payment notifications are authenticated by signature; an unsigned notification is rejected.