Short version: we collect what an order needs and nothing else, we do not sell it, and you can have a copy or have it deleted by sending one message. The long version is below, because that is what a privacy policy is for.
What we collect, and why
| What | Why | How long |
|---|---|---|
| Name, delivery address | To pack the order and print the label | With the order record, for as long as Morocco requires a seller to keep the record of a sale |
| Telephone number | Required. On Cash on delivery the courier telephones before arriving, and a parcel with an unreachable number on it is not delivered | With the order record |
| Email address | Order confirmation, dispatch confirmation, tracking, and answering you when you write | With the order record |
| Size and colour ordered | To pick the right garment and to handle an exchange without asking you to prove what you bought | With the order record |
| Bank details, only if you ask for a refund by transfer | To send the refund. Cash on delivery leaves no card to reverse, so there is nothing else to send it to | Used for that transfer and then deleted. Never collected before you ask for one |
| Card details | None. This shop is paid in cash at the door. Where a card option is ever enabled at checkout, Shopify's own checkout processes it and we are told only that it worked | Not held by us at all |
| Aggregate usage data | Which pages get used, so we can fix the ones that do not | Aggregate, and not linked to your order record |
We do not ask for a date of birth, a gender, an income bracket, a national identity number or anything else a shop does not need to send a parcel. If a field is not on the checkout, we are not collecting it.
Who else touches it
- Shopify — the platform this store runs on. It processes and stores the order data on our behalf.
- Amana (Barid Al-Maghrib) and CTM Messagerie — the couriers. They receive your name, address, telephone number and the amount to collect. That is the whole list of what they get, and it is what a cash-on-delivery handover requires.
- Our email provider — order and dispatch confirmations, and marketing email if you asked for it.
That is the complete list. We do not sell your data, we do not rent it and we do not trade it for advertising reach. There is no data broker in this chain, and there is no advertising pixel firing your order details at one.
Under loi n° 09-08 on the protection of individuals with regard to the processing of personal data, you have the right to be told what we hold about you, to see it, to have it corrected or erased if it is wrong or out of date, and to object to us using it — including for marketing. Email and we will action it free of charge.
Where we rely on your consent — marketing messages, non-essential cookies — you can withdraw it at any time, and withdrawing it is as easy as giving it.
Cash on delivery means your name, your address and your telephone number are handed to the courier bringing the parcel, because that is the only way a parcel gets delivered and paid for. They get what the delivery needs and nothing else, and they are not permitted to use it for anything but the delivery.
Cookies
Essential cookies keep your cart and your session working; without them the checkout does not function, so they cannot be switched off. Analytics cookies tell us which pages are used and are set only with your consent. We do not run third-party advertising cookies on this store.
Your browser can block or clear any of them at any time. Blocking the essential ones will break the cart, which is a description rather than a threat.
Marketing
You get marketing email only if you asked for it. Every message carries a working unsubscribe link, unsubscribing takes effect immediately rather than "within ten days", and it does not touch the transactional messages about an order you have actually placed — you will still be told when your parcel ships whether or not you want our emails.
If you message us on WhatsApp or on Instagram, that conversation lives on that platform under that platform's own terms, not ours. We use it to answer you and we do not move it into a marketing list.
Children
This store is not intended for children and we do not knowingly collect their data. If you believe a child has given us personal information, tell us and we will delete it.
Security
The site runs over HTTPS end to end. No card data reaches our systems, because on cash on delivery none is created. Access to order records is limited to the people who pack and support orders. If a breach ever occurs that puts your data at risk we will tell you directly and promptly, rather than burying it in a policy update.
Complaints and the regulator
If you think we have handled your personal data badly, tell us first — — and we will investigate and reply within 30 days.
If you are not satisfied with that reply, you have the right to complain to Morocco's data-protection authority, the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), which supervises the processing of personal data under loi n° 09-08. You do not need our permission and you do not need to come to us first, although it usually settles things faster.
Commission Nationale de contrôle de la protection des Données à caractère Personnel · cndp.ma · Rabat
Changes to this policy
If this policy changes materially we will say so on this page with the date, and tell anyone on the mailing list. We will not change it quietly and rely on you having agreed to a version you never read.