Last updated: 2026-09-13
1. Data controller
l'éditeur du site — [email protected].
2. The principle: we collect the bare minimum
TIWIZY requires no account and sets no advertising tracker. Browsing the directory is anonymous.
3. What we process, why, and for how long
- Contact request to a business — the details you enter (name, contact method, message). Purpose: passing your request to the business. Legal basis: your consent, given by submitting the form. Retention: 24 months maximum, then automatic deletion.
- Listing request (form on the Contact page) — the business name, its city, its neighbourhood, its activity, a phone number, optionally an e-mail address, indicative prices and your message. Purpose: getting back to you — preparing our visit, or creating the page remotely with the owner's agreement. Legal basis: your consent, given by submitting the form. Retention: 24 months maximum, then automatic deletion. This information is not published as such: it stays in our working tool. A request creates no listing — a business page exists only with the agreement of the person responsible for it, given on site or remotely (WhatsApp, Instagram, e-mail, phone); the "verified on site" badge only ever appears after we have been there.
- Reporting a listing — the reason and your optional message. Purpose: correcting the directory. Legal basis: our legitimate interest in keeping information accurate. Retention: 24 months maximum.
- GPS position (“Around me”) — your position is sent to the server, used in memory to compute distances, then immediately forgotten. It is never stored, never logged and never placed in a web address. Only the distance in metres is returned to you. Legal basis: your consent (your browser asks for it).
- Audience measurement — a counter of page views per day and per listing. No personal data: these are totals, never individual visitors. No third-party tool, no Google Analytics.
- Security and abuse prevention — your IP address is used to limit the number of requests per minute. It stays in memory and disappears within an hour at most; it is never written to the database nor kept in a log. Legal basis: our legitimate interest in protecting the service.
4. Listed businesses
A listing publishes professional information: trading name, activity, neighbourhood, position, opening hours, prices charged and a professional contact method. Where the business is run by an individual, some of this information constitutes personal data.
Legal basis: the owner's agreement, obtained on site when the listing is created, together with our legitimate interest in maintaining an informational directory. Retention: for as long as the listing is published.
Any business owner may at any time request the correction or complete removal of their listing, without giving a reason and free of charge, by writing to [email protected]. We comply without argument.
5. Photographs
We photograph premises, products and shopfronts. Where a person is recognisable in a photograph, it is published only with their agreement, and they may request its removal at any time at [email protected].
6. Who receives this data
Your contact request is passed to the business concerned, and to no one else.
To operate the service we rely on technical providers which may, on that basis, process data on our behalf: the host of the application and database, the delivery network and — depending on the configuration in use — the messaging service used to connect you with the business, the e-mail service through which listing requests reach us, and the automatic translation tool for listings. Those providers are not permitted to use the data for their own purposes.
7. Transfers outside Morocco
Our technical providers are established outside Morocco (notably in the United States and the European Union), so your data may be transferred to those countries. In accordance with Articles 43 and 44 of Law 09-08, such transfers are governed and subject to the required formalities with the CNDP. For visitors from the European Union, these transfers rely on the safeguards set out in Chapter V of the GDPR.
8. Your rights
Under Law 09-08 you have a right of access, rectification, objection and erasure in relation to your data. Where the GDPR applies to your situation, you additionally have the right to restriction of processing, to data portability, and to withdraw your consent at any time.
To exercise any of these rights, write to [email protected]. We reply within 30 days at the latest, free of charge.
You may also lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), cndp.ma — or, if you live in the European Union, with the data protection authority of your country.
The declaration formalities with the CNDP are under way. The receipt number will be published here as soon as it is issued.
9. Cookies and local storage
The site sets no advertising cookie and no third-party tracker. The only mechanisms used are:
- a technical session cookie, solely within the administration area reserved for the team;
- local storage in your browser (not a cookie) for your saved addresses and to remember that you declined the install prompt. This information never leaves your phone: it is not sent to us. Clearing the site data erases it.
10. Security
Traffic is encrypted (HTTPS), administration access is password-protected and logged, and database backups are encrypted.
11. Changes
Any change to this policy will be published on this page, with a new update date.