Last updated: 2026-07-29
1. Data controller
l'éditeur du site — [email à compléter].
2. The principle: we collect the bare minimum
TIWIZY requires no account, sets no advertising tracker and sells no data. Browsing the directory is anonymous.
3. What we process, why, and for how long
- Contact request to a business — the details you enter (name, contact method, message). Purpose: passing your request to the business. Legal basis: your consent, given by submitting the form. Retention: 24 months maximum, then automatic deletion.
- Reporting a listing — the reason and your optional message. Purpose: correcting the directory. Legal basis: our legitimate interest in keeping information accurate. Retention: 24 months maximum.
- GPS position (“Around me”) — your position is sent to the server, used in memory to compute distances, then immediately forgotten. It is never stored, never logged and never placed in a web address. Only the distance in metres is returned to you. Legal basis: your consent (your browser asks for it).
- Audience measurement — a counter of page views per day and per listing. No personal data: these are totals, never individual visitors. No third-party tool, no Google Analytics.
- Security and abuse prevention — your IP address is used to limit the number of requests per minute. It stays in memory and disappears within an hour at most; it is never written to the database nor kept in a log. Legal basis: our legitimate interest in protecting the service.
4. Listed businesses
A listing publishes professional information: trading name, activity, neighbourhood, position, opening hours, prices charged and a professional contact method. Where the business is run by an individual, some of this information constitutes personal data.
Legal basis: the owner's agreement, obtained on site when the listing is created, together with our legitimate interest in maintaining an informational directory. Retention: for as long as the listing is published.
Any business owner may at any time request the correction or complete removal of their listing, without giving a reason and free of charge, by writing to [email à compléter]. We comply without argument.
5. Photographs
We photograph premises, products and shopfronts. Where a person is recognisable in a photograph, it is published only with their agreement, and they may request its removal at any time at [email à compléter].
6. Who receives this data
Your contact request is passed to the business concerned, and to no one else. We do not sell or otherwise disclose data to third parties for commercial purposes.
To operate the service we rely on technical providers which may, on that basis, process data on our behalf: the host of the application and database, the delivery network and — depending on the configuration in use — the messaging service used to connect you with the business and the automatic translation tool for listings. Those providers are not permitted to use the data for their own purposes.
7. Transfers outside Morocco
Our technical providers are established outside Morocco (notably in the United States and the European Union), so your data may be transferred to those countries. In accordance with Articles 43 and 44 of Law 09-08, such transfers are governed and subject to the required formalities with the CNDP. For visitors from the European Union, these transfers rely on the safeguards set out in Chapter V of the GDPR.
8. Your rights
Under Law 09-08 you have a right of access, rectification, objection and erasure in relation to your data. Where the GDPR applies to your situation, you additionally have the right to restriction of processing, to data portability, and to withdraw your consent at any time.
To exercise any of these rights, write to [email à compléter]. We reply within 30 days at the latest, free of charge.
You may also lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), cndp.ma — or, if you live in the European Union, with the data protection authority of your country.
The declaration formalities with the CNDP are under way. The receipt number will be published here as soon as it is issued.
9. Cookies and local storage
The site sets no advertising cookie and no third-party tracker. The only mechanisms used are:
- a technical session cookie, solely within the administration area reserved for the team;
- local storage in your browser (not a cookie) for your saved addresses and to remember that you declined the install prompt. This information never leaves your phone: it is not sent to us. Clearing the site data erases it.
10. Security
Traffic is encrypted (HTTPS), administration access is password-protected and logged, and database backups are encrypted.
11. Changes
Any change to this policy will be published on this page, with a new update date.