Business Privacy Policy

Last Updated: August 2026

This Business Privacy Policy describes how commercial and personal data belonging to Business Partners ("you", "Store Owners") is collected, processed, and protected in compliance with Moroccan Law 09-08 (relating to the protection of individuals with regard to the processing of personal data).

1. Data We Collect From Business Partners

To set up and manage a Business Account, we collect the following categories of information:

Business Identity Data: Store name, commercial category, physical venue address, geographic map coordinates, store logo, interior/exterior photos, and public status announcements.

Contact & Account Credentials: Representative full name, business email address, contact phone number, city, and encrypted account password.

Registration & Verification Data: Identity and registration documentation (ICE — Identifiant Commun de l'Entreprise, Register of Commerce, or Auto-Entrepreneur documentation) used solely to verify that the applicant represents a legitimate local business.

2. Purpose of Data Processing

Your data is processed strictly for the following operational purposes:

1. To display your store venue, location pin, logo, and promotional status on the public interactive map within the application;

2. To manage your partner account, enable dashboard login, and display aggregated visibility metrics (map views and profile clicks);

3. To verify partner applications and maintain the accuracy of the business directory;

4. To communicate service updates or administrative alerts;

5. To enforce platform security, content moderation standards, and prevent fraud.

3. Compliance with Law 09-08 & CNDP Notification

3.1 CNDP Declaration: The processing of personal and commercial data conducted by this platform has been declared to the National Commission for the Protection of Personal Data (CNDP) under mandatory statutory filing procedures.

3.2 Statutory Rights: Under Moroccan Law 09-08, business representatives possess the following rights regarding their personal data:

Right of Access: Request a copy of the personal and contact data maintained about your account.

Right of Rectification: Request immediate correction of inaccurate or outdated business contact details.

Right of Erasure (Right to be Forgotten): Request complete deletion of your business profile and representative details upon termination of service.

To exercise any of these rights, submit a written request to: support@lecocon.app.

4. Data Breach Notification

In the event of a data breach affecting your personal data, the Platform will notify the CNDP and affected business partners within 72 hours of discovery, as required by Moroccan Law 09-08. Notification will include the nature of the breach, the data affected, and remedial measures taken.

5. International Data Transfers

Your data may be processed and stored on secure cloud infrastructure (Supabase/AWS) located outside the Kingdom of Morocco. In such cases, we ensure that adequate data protection measures are in place, as required by Law 09-08, including encryption in transit and at rest.

6. Data Sharing & Public Exposure

6.1 Public Interactive Map: Store details explicitly published for visibility (store name, category, address, photos, logo, and status updates) are publicly accessible to application members on the interactive map.

6.2 Compliance: We do not sell, lease, or rent business partner data to third-party data brokers.

6.3 Cloud Storage Infrastructure: Business data and uploaded media are securely hosted using enterprise-grade cloud infrastructure (including Supabase), adhering to modern data encryption standards both in transit and at rest.

7. Data Retention & Account Deletion

7.1 Operational Data: Business profile data and contact details are retained for as long as your Business Account remains active.

7.2 Account Erasure: Upon account deletion, public map pins, status updates, and store photos are permanently removed from active databases.

7.3 Registration Records: Where you submit registration documents (commercial register, tax or auto-entrepreneur status) to have your Business Account verified, those documents are retained only for as long as needed to verify the directory entry and to exercise our legal rights. They are never published and are erased once verification is complete and no longer required.

8. Contact & Privacy Inquiries

For any questions regarding this Business Privacy Policy or to submit a data protection request, contact our support team at support@lecocon.app.