Privacy policy
Updated on 5 October 2026
This text is a translation pending legal review. The French text is the reference.
Programme in preparation. No service is open to the public at this stage.
This policy describes what happens when you visit this site, then the processing planned for the Malak programme once it opens.
This site
- This site has no form, no account and no audience measurement tool.
- It shows no advertising and sets no advertising tracker.
- One technical cookie,
malak_locale, remembers the language you choose for one year. It does not identify you. - Your browser sends the technical information needed to display the pages. It is used neither to identify you nor to measure the audience.
The Malak programme
The processing described below is planned. It will start only after the prior authorisation required by Law No. 09-08 is obtained. No data is collected at this date.
Data controller
MALAK FINTECH, ICE 004073298000039, will be the data controller for the programme. A data protection officer will be appointed.
[To be completed by the project owner: contact details of the data protection officer]
Data processed
| Category | Data processed | Data never collected |
|---|---|---|
| Identification | First name, last name, phone, CIN number encrypted in a separate vault | Copy of the CIN, photograph, biometric data |
| Means of payment | Card token, last 4 digits, issuing bank | Full card number, expiry date, security code, PIN |
| Transactions | Amount, date and time, merchant ICE and activity code, channel and status, for eligible transactions only | Transactions outside the programme, account history, income |
| Payout | RIB or mobile payment identifier | Password or online banking credentials |
| Use of the app | Technical security logs, one-off and optional geolocation when filing a report | Continuous geolocation, address book, phone contents |
Legal bases
Processing will rest on your consent, within the meaning of Article 4 of Law No. 09-08, and, for the operations needed to pay rewards only, on the performance of your membership of the programme.
Disclosure of your payment data by your bank will rest on your express authorisation, given under Article 180 of Law No. 103-12, and on the contractual framework that text provides for. The planned texts will be shown to you in the app, before any consent.
Purposes
- awarding and paying rewards;
- preventing fraud;
- producing aggregated, anonymised statistics to evaluate the programme;
- if an agreement were concluded with the State, producing aggregated statements per merchant for the tax administration, with no data about you.
Ruled out are selling or renting data, assessing your creditworthiness, targeted advertising on behalf of third parties, and any disclosure of individual data to the tax administration.
Recipients
- the bank that will hold the programme account and your issuing bank, for payouts and checks;
- technical subcontractors, hosted in Morocco, who will act only on instructions.
Professional secrecy cannot be raised against the authorities the law designates, notably the judicial authority acting in criminal proceedings.
Health sector
A payment to a health professional can reveal information about your health. These payments therefore need a separate and optional consent. If you refuse it, the programme keeps working in the other sectors. This data will be encrypted at field level, open to a small number of authorised people and excluded from any individual analytical processing.
Retention periods
| Data | Period |
|---|---|
| Payments, under a pseudonym | 24 months, then irreversible anonymisation |
| Health sector payments | 13 months, then anonymisation |
| Settlement statements and execution reports | 10 years |
| Consent journal | Duration of the consent, then the limitation period that applies after its revocation |
| Account data after closure | Deleted within 3 months, subject to legal retention obligations |
Hosting and security
All data processed by the platform will be hosted in Morocco, backups and logs included. The platform will make no transfer of personal data abroad. Any change involving processing outside Morocco would remain subject to prior authorisation.
Data will be encrypted in transit and at rest. The platform will never store, process or transmit a card number. In the event of a data breach that puts you at risk, you will be informed.
Your rights
Articles 7 to 9 of Law No. 09-08 give you rights of access, rectification, erasure and objection. The app will give direct access to these rights: viewing and exporting your data, correcting it, deleting your account and revoking your consents.
Revocation will take one gesture, with no fee or justification, and your token will leave the filter list within 24 hours. Your consents will be reconfirmed every year, and the account will go dormant after 12 months of inactivity.
You will be able to write to the data protection officer and refer a matter to the national authority in charge of personal data protection.