Transparency
Privacy policy
How marketing site and portal processing works, who is controller, and data subject rights.
Privacy cockpit
Privacy should reassure families, protect the institution, and demonstrate serious digital governance.
To win trust in Morocco, a premium privacy policy should make roles, purposes, CNDP rights, and platform protections clear across admissions, academics, and finance.
What a strong policy should prove
Framework
CNDP · Law 09-08
Rights
Access · rectification · objection
Model
Institution controller · SaaS processor
Oversight
Audit · security · retention
CNDP framework (Law 09-08)
National Commission for the Control of Personal Data Protection
Per Law 09-08 on the protection of individuals with regard to personal data processing, you have rights of access, rectification, and opposition. Admissions and tuition-related processing are recorded in the institution's processing register; subprocessors (hosting, e-mail tools, payment gateways) are covered by contractual clauses and, where required, CNDP authorisation.
Data controller
The institution operating this platform (the Institution) is the data controller under Law 09-08. The platform provider (educati) acts as a processor under contractual terms aligned with CNDP requirements.
The Institution
Determines the purposes and means of processing
educati (SaaS platform)
Processes data on behalf of the Institution
Data we collect
We collect personal data needed to administer higher education and student services:
| Category | Data | Legal basis |
|---|---|---|
| Identity | Name, CIN or passport, date of birth, nationality, photos | Contract and legal obligation |
| Contact | Email, phone, address, emergency contacts | Contract |
| Academic | Enrolment, grades, attendance, transcripts | Contract and legitimate interest |
| Financial | Tuition payments, invoices, instalments | Contract and legal obligation |
| Prospects | Name, email, phone, program interest | Consent |
| Platform usage | Login times, IP address, device | Legitimate interest |
| Cookies | Session, language preference, analytics with consent | Consent for analytics |
Processing purposes
- Admissions management
Processing applications, assessing files, issuing acceptance letters, and managing the CRM pipeline.
- Academic administration
Student registration, course enrolment, attendance, grading, and certificate issuance.
- Financial management
Tuition billing, instalments, payments (CMI, bank transfer, CashPlus), and invoices.
- Communication
Institutional notifications, academic announcements, and admissions follow-up by email, SMS, or WhatsApp.
- Platform operation
Authentication, sessions, security monitoring, and technical support.
- Regulatory compliance
Academic record retention, CNSS internship declarations, and ministry reporting.
- Analytics and improvement
Aggregated anonymous usage statistics to improve the platform, without individual profiling.
Data sharing and processors
Personal data may be shared with the following recipient categories under contractual safeguards:
| Recipient | Purpose | Location |
|---|---|---|
| Hosting provider | Infrastructure and data storage | Morocco / EU |
| Email service | Transactional messages and notifications | EU / US (standard contractual clauses) |
| Payment gateway (CMI) | Online card payments | Morocco |
| SMS provider | Verification codes and alerts | Morocco |
| Ministry (MESRSFC) | Degree registration and regulatory reporting | Morocco |
| CNSS | Internship declarations | Morocco |
Transfers outside Morocco are covered, where applicable, by standard contractual clauses or CNDP adequacy decisions.
Data retention
| Data type | Retention period | Legal basis |
|---|---|---|
| Academic records | Permanent for degrees | Legal obligation |
| Attendance records | 5 years after graduation | Regulatory |
| Financial records | 10 years | Commercial and tax law |
| Prospect data | 24 months after last contact | Consent or legitimate interest |
| Portal access logs | 12 months | Security |
| Analytics cookies | 13 months maximum | Consent |
Your rights (Law 09-08)
Moroccan Law 09-08 gives you the following rights over your personal data:
Right of access
Request a copy of the personal data the Institution holds about you.
Right of rectification
Correct inaccurate or incomplete personal data.
Right to object
Object to processing for legitimate reasons, except contractual obligations.
Right to erasure
Request deletion of data no longer needed, subject to legal retention duties.
To exercise your rights, contact the Data Protection Officer at dpo@institution.ma. Requests are handled within 30 calendar days. You may also complain to the CNDP.
Security measures
- Data encrypted in transit (TLS 1.3) and at rest (AES-256).
- Tenant isolation: each institution's data is logically separated.
- Role-based access: students, instructors, and administrators have distinct permissions.
- Regular security audits and penetration tests.
- Automated backups with point-in-time recovery.
- DDoS protection and a web application firewall (WAF).
- Sessions secured with HttpOnly cookies and CSRF protection.
Cookies & trackers
Technical cookies may be used for session, language, and consent. Analytics cookies are only enabled after consent via the banner.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| educati-locale | Essential | Language preference | 1 year |
| next-auth.session-token | Essential | Authentication | Session |
| __educati_csrf | Essential | CSRF protection | Session |
| theme | Essential | Light or dark theme preference | 1 year |
| Analytics, if enabled | Optional | Anonymous usage statistics | 13 months |
Privacy & personal data
- Portal accounts, academic content, and leads are logically isolated per institution id (multi-tenant).
- Public forms (e.g. information requests) collect the minimum needed to respond; admins can export CSV for your internal CRM.
- Cookies in this demo are technical (session, language, theme) — document purposes and retention in production.
- Payments (CMI, Payzone, Binga, etc.) follow your bank and policy; educati does not store card numbers by default.
Morocco's framework notably includes Law 09-08 on the protection of individuals with regard to the processing of personal data. Data subjects have rights (access, rectification, opposition, etc.) whose procedures belong to your organisation and your legal notices.
Official authority: Morocco's data protection authority (CNDP)
Data Protection Officer
dpo@institution.ma
For access, correction, erasure, or objection requests. Target response time: 30 days under the CNDP framework.
Data minimization principles
Choosing a program without visiting the campus is like buying an apartment from a photo. We organize structured visits so you can ask the right people the right questions.
- Data minimization for admissions and CRM workflows.
- Retention aligned to legitimate institutional needs.
- CNPD-aligned practices for Moroccan personal data context.
Rights and data control
Alumni are not statistics — they are verifiable career paths. We share concrete trajectory examples from our programs.
FAQ
If you are ready, we will meet you with specifics—not slogans.
Send a short note with your city, program interest, and preferred contact channel. We route you to the right advisor and share the next two steps immediately.