Your data, banking secrecy and your rights

Programme in preparation. No service is open to the public at this stage. This site collects no personal data: it has no form and no audience measurement tool.

A programme built on your payments only makes sense if its rules on data are clear from the start. Here is what is planned, what is ruled out and what you will be able to demand. No data will be collected before the prior authorisation required by Law No. 09-08 is obtained, including for a supervised pilot.

Two consents, on two screens

Your payment data is covered by banking professional secrecy, under Article 180 of Law No. 103-12. Your personal data is protected by Law No. 09-08. The programme will therefore ask for two separate authorisations, each on its own screen, with an unticked box and its own confirm button. Nothing will be accepted implicitly, and nothing will be buried in general terms.

Health payments will call for a third consent, separate and optional. If you refused it, the programme would keep working in every other sector. The planned texts will be shown to you in the app, before any consent.

What the platform would receive

For each eligible payment, seven items only:

• a card token, which replaces your card number;
• the amount;
• the date and time;
• the merchant's ICE;
• its activity code;
• the channel, card or QR;
• the status of the transaction.

On top of these would come the details of your account: first name, last name, phone number, CIN number encrypted and kept apart, and the references of the account designated for your payouts. Geolocation would be used only when you file a report on the map, and only if you agree.

What it will never see

• your full card number, its expiry date, its security code or your PIN;
• the history of your bank accounts and your income;
• your payments outside eligible merchants;
• your address book or your continuous location;
• a copy of your CIN, your photograph or your biometric data.

Your card will be linked on a page hosted by the tokenisation service, not on a Malak page.

Why a token

The token will be a random identifier, specific to the platform. It will not be possible to trace it back to your card number without the secure vault of the tokenisation service, which the platform will not be able to reach. When you link the card, your bank will confirm your consent through its strong authentication, then check that the CIN you declared matches its file. It will answer only yes or no, without passing on your CIN number.

Banking secrecy also binds the platform

MALAK FINTECH will itself be bound by professional secrecy for the information it receives, and must keep it confidential. This secrecy has limits set by law: it cannot be raised against the authorities the law designates, notably the judicial authority acting in criminal proceedings.

Planned uses, and those ruled out

Your data would be used to award and pay your rewards, to prevent fraud and to produce aggregated, anonymised statistics. If an agreement were concluded with the State, aggregated statements per merchant could also be produced for the tax administration. They would contain no data about you.

Ruled out will be selling or renting data, assessing your creditworthiness, targeted advertising on behalf of third parties, and any disclosure of individual data to the tax administration.

For how long

Your rights

Law No. 09-08, in its Articles 7 to 9, gives you rights of access, rectification, erasure and objection. The app plans direct access to these rights: viewing and exporting your data, correcting it, deleting your account, revoking your consents. Revocation will take one gesture, with no fee or justification, and your token will leave the filter list within 24 hours.

A data protection officer will be appointed. You will also be able to refer a matter to the national authority in charge of personal data protection.

Where your data would be

All data processed by the platform would be hosted in Morocco, backups and logs included, with encryption in transit and at rest. The platform would make no transfer of personal data abroad. Any change involving processing outside Morocco would remain subject to prior authorisation.