Transparency
Privacy policy
How marketing site and portal processing works, who is controller, and data subject rights.
Privacy cockpit
Privacy should reassure families, protect the institution, and demonstrate serious digital governance.
To win trust in Morocco, a premium privacy policy should make roles, purposes, CNDP rights, and platform protections clear across admissions, academics, and finance.
What a strong policy should prove
Framework
CNDP · Law 09-08
Rights
Access · rectification · objection
Model
Institution controller · SaaS processor
Oversight
Audit · security · retention
CNDP framework (Law 09-08)
Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel
Per Law 09-08 on the protection of individuals with regard to personal data processing, you have rights of access, rectification, and opposition. Admissions and tuition-related processing are recorded in the institution's processing register; subprocessors (hosting, e-mail tools, payment gateways) are covered by contractual clauses and, where required, CNDP authorisation.
Data controller
The institution operating this platform (hereafter "the Institution") is the data controller within the meaning of Law 09-08. The platform provider (educati) acts as a data processor (sous-traitant) under contractual clauses aligned with CNDP requirements.
The Institution
Determines purposes and means of processing
educati (SaaS platform)
Processes data on behalf of the Institution
Data we collect
We collect personal data necessary for higher education administration and student services:
| Category | Data | Legal basis |
|---|---|---|
| Identity | Name, CIN/passport, date of birth, nationality, photos | Contract + Legal obligation |
| Contact | Email, phone, address, emergency contacts | Contract |
| Academic | Enrolment, grades, attendance, transcripts | Contract + Legitimate interest |
| Financial | Tuition payments, invoices, instalments | Contract + Legal obligation |
| Leads / Prospects | Name, email, phone, programme interest | Consent |
| Platform usage | Login timestamps, IP, device info | Legitimate interest |
| Cookies | Session, language preference, analytics (with consent) | Consent (analytics) |
Processing purposes
- Admissions management
Processing applications, evaluating dossiers, issuing acceptance letters, and managing the CRM pipeline.
- Academic administration
Student registration, course enrolment, attendance tracking, grading, and certificate issuance.
- Financial management
Tuition billing, instalment tracking, payment processing (CMI, bank wire, CashPlus), and invoice generation.
- Communication
Institutional notifications, academic announcements, and admissions follow-up via email, SMS, or WhatsApp.
- Platform operation
Authentication, session management, security monitoring, and technical support.
- Regulatory compliance
Academic record retention, CNSS internship declarations, and Ministry reporting requirements.
- Analytics & improvement
Aggregated, anonymised usage statistics to improve platform features and user experience. No individual profiling.
Data sharing & sub-processors
Personal data may be shared with the following categories of recipients, under contractual clauses:
| Recipient | Purpose | Location |
|---|---|---|
| Hosting provider | Infrastructure, database storage | Morocco / EU |
| Email service | Transactional emails, notifications | EU / US (SCC) |
| Payment gateway (CMI) | Online card payments | Morocco |
| SMS provider | Verification codes, alerts | Morocco |
| Ministry (MESRSFC) | Degree registration, regulatory reporting | Morocco |
| CNSS | Internship declarations | Morocco |
Transfers outside Morocco are covered by Standard Contractual Clauses (SCC) or CNDP adequacy decisions where applicable.
Data retention
| Data type | Retention period | Legal basis |
|---|---|---|
| Academic records | Permanent (degrees) | Legal obligation |
| Attendance records | 5 years after graduation | Regulatory |
| Financial records | 10 years | Commercial law + tax |
| Lead / prospect data | 24 months after last contact | Consent / Legitimate interest |
| Portal access logs | 12 months | Security |
| Cookies (analytics) | 13 months maximum | Consent |
Your rights (Law 09-08)
Under Moroccan Law 09-08, you have the following rights regarding your personal data:
Right of access
Request a copy of all personal data the Institution holds about you.
Right of rectification
Correct inaccurate or incomplete personal data.
Right of opposition
Object to processing for legitimate reasons. Does not apply to contractual obligations.
Right of erasure
Request deletion of personal data when no longer necessary. Subject to legal retention obligations.
To exercise your rights, contact the Data Protection Officer at [email protected]. Requests are processed within 30 calendar days. You may also lodge a complaint with the CNDP.
Security measures
- Data encrypted in transit (TLS 1.3) and at rest (AES-256).
- Multi-tenant isolation: each institution's data is logically separated. No cross-institution data leakage.
- Role-based access control: students, instructors, and admins have distinct permission sets.
- Regular security audits and penetration testing.
- Automated backups with point-in-time recovery.
- DDoS protection and Web Application Firewall (WAF).
- Session management with secure, HttpOnly cookies and CSRF protection.
Cookies & trackers
Technical cookies may be used for session, language, and consent. Analytics cookies are only enabled after consent via the banner.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| educati-locale | Essential | Language preference | 1 year |
| next-auth.session-token | Essential | User authentication | Session |
| __educati_csrf | Essential | CSRF protection | Session |
| theme | Essential | Dark/light mode preference | 1 year |
| Analytics (if enabled) | Optional | Anonymised usage statistics | 13 months |
Privacy & personal data
- Portal accounts, academic content, and leads are logically isolated per institution id (multi-tenant).
- Public forms (e.g. information requests) collect the minimum needed to respond; admins can export CSV for your internal CRM.
- Cookies in this demo are technical (session, language, theme) — document purposes and retention in production.
- Payments (CMI, Payzone, Binga, etc.) follow your bank and policy; educati does not store card numbers by default.
Morocco's framework notably includes Law 09-08 on the protection of individuals with regard to the processing of personal data. Data subjects have rights (access, rectification, opposition, etc.) whose procedures belong to your organisation and your legal notices.
Official authority: Morocco's data protection authority (CNDP)
Data Protection Officer
[email protected]
For access, rectification, erasure, or opposition requests. Response target: 30 days under the CNDP framework.
Data minimization principles
Choosing a program without visiting the campus is like buying an apartment from a photo. We organize structured visits so you can ask the right people the right questions.
- Data minimization for admissions and CRM workflows.
- Retention aligned to legitimate institutional needs.
- CNPD-aligned practices for Moroccan personal data context.
Rights and data control
Alumni are not statistics — they are verifiable career paths. We share concrete trajectory examples from our programs.
FAQ
If you are ready, we will meet you with specifics—not slogans.
Send a short note with your city, program interest, and preferred contact channel. We route you to the right advisor and share the next two steps immediately.