Preamble

The right to privacy is a fundamental human right. The privacy of individuals must be protected against all infringements that may affect it, particularly those relating to their personal information.

Aware of the importance of this right, CHAABI LLD constantly monitors the protection of personal data (or personal data) and compliance with the obligations that apply to the collection, use and storage of data.

In the interests of transparency and strict compliance with its obligations, CHAABI LLD has adopted this Personal Data Protection Policy.

The purpose of this Policy is to define the terms and conditions for the collection and processing of personal data carried out by CHAABI LLD. It also describes the commitments implemented by CHAABI LLD to ensure the protection of personal data and privacy in accordance with current regulations.

The stipulations of the Policy may be modified at any time by CHAABI LLD. Nevertheless, it shall ensure that new versions are published on the website and that the persons concerned are informed, by any means, also offering them the possibility of consulting them easily through various sections of the website.

This Policy is supplemented by specific information notices on the protection of personal data relating to the various products and services offered by CHAABI LLD. These detailed and exhaustive notices are also available on the various media used.

What is meant by personal data?

• Personal data: any information relating to a natural person who is identified or can be identified, directly or indirectly by reference to an identification number or to one or more elements that are specific to him or her (such as: surname, first name, identification number, e-mail address, IP address, voice, photograph, location data...).
• Sensitive personal data: This sensitive data forms a special category of personal data. It is information that reveals a person's alleged racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
• Processing: Any operation or set of operations involving personal data, whatever the process used (automated or non-automated processing of personal data), and in particular collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination or otherwise making available, alignment or interconnection, limitation, as well as blocking, erasure or destruction.
• Data subject: A data subject within the meaning of the law is any identified or identifiable natural person whose personal data is processed.
• Recipient: The natural or legal person, public authority, service or any other body that receives the communication of personal data, whether or not it is a third party.
• Collection of personal data: consists, as its name indicates, in the action of gathering personal information about one or more people by any means (form by hand during a physical meeting), and whatever the purpose.
• Sub-processor: The natural or legal person, public authority, service or any other body that processes personal data on behalf of, and on the instructions of, a data controller.
• Data transfer: Any communication, copy, or movement of personal data intended to be processed in a third country.

Compliance with applicable regulations 
The processing of personal data carried out by CHAABI LLD is subject to any applicable local regulations.

Rules for processing personal data within the BCP Group 
CHAABI LLD has implemented a set of principles enabling fair and lawful processing of the personal data collected, in compliance with the regulatory guidelines in force.

Any collection of personal data is subject to compliance with the following rules: The explicit consent of individuals is obtained prior to any collection or use of the personal data of the persons concerned; 
Data are collected solely for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with these purposes; 
It is forbidden to collect data whose purpose is not justified. The personal data collected must be proportionate to the purpose pursued, i.e. adequate, relevant and not excessive in relation to the purposes for which they are collected and their subsequent processing; 
All data must be kept for the period necessary to achieve the purpose for which it is collected, unless another retention period is required by law or the consent of the person concerned has been obtained; 
CHAABI LLD implements all security measures to ensure the confidentiality, accuracy, integrity of the data handled.

Typology of personal data processed by BCP Group 
Personal data is defined as any information relating to an identifiable natural person or that can be used to identify him or her, directly or indirectly such as surname, first name, e-mail and postal address, telephone number.

CHAABI LLD undertakes to collect only data that is relevant and necessary for the provision of the products and services subscribed to.

The main categories of personal data that BCP Group is required to process and collect directly from the persons concerned:

• Data relating to civil status and administrative identification and contact data: surname, first name, gender, date of birth, copies of identity documents, telephone number, professional and/or personal email, etc. ;
• Data related to personal situation: family situation, marital status, number and age of children, etc.
• Connection data related to the use of our online services: identification and authentication data for connected areas, logs, cookies, browsing data on sites and applications;
• Data from correspondence and communications between the persons concerned, in the office or remotely: maintenance, telephone calls, electronic messages, instant messaging, communications on social networks or any other type of communication;
• Data related to products and services subscribed: type of product, method of payment, due date, amount, etc.

As part of its activities, CHAABI LLD may collect special categories of personal data (or "sensitive data") such as health data, or biometric data, only when strictly necessary, in particular in connection with the recruitment of its employees, or the subscription to insurance contracts.

Furthermore, CHAABI LLD does not process any data relating to racial origins, political opinions, philosophical beliefs, trade union membership, genetic data or sexual orientation, unless compelled to do so by a legal obligation.

CHAABI LLD may also obtain the aforementioned personal data from, in particular, third parties (partners, suppliers, etc.), publicly accessible sources or public administrations and authorities.

Finalities and legal bases for the use of personal data 
The purpose of processing is defined as the objective or aim for which personal data is collected, used, processed or stored.

CHAABI LLD undertakes to process personal data, for specified, explicit and legitimate purposes, and not to further process them in a manner incompatible with these purposes. Thus, each processing of data implemented pursues a purpose based on the following grounds:

• The performance of a contract to which the data subject is a party, when offering, setting up and performing a product or service, in particular:

  - The management of Vehicle rental contracts and associated services in connection with the ordering, preparation, delivery, return, use and management of Vehicles, and in particular:

  - Repairs, maintenance and tires;
  - Accident and claims management;
  - Roadside assistance;
  -Managing the end of your contract;
  - Provide, if necessary, a replacement vehicle;
  - Carry out reporting;
  - Management of traffic fines;
  - Interacting with you when you contact us, request information about our company or services, or as part of 
  updating a contract;
  - Debt collection and litigation management; 
  - Claims management ;
  - The implementation of marketing and communication actions in connection with our product and service offers;
  - The implementation of commercial prospecting approaches in compliance with the legal provisions in force;
  - The performance of customer satisfaction surveys.

• Compliance with legal and regulatory obligations to which the Group or one of its entities is subject, such as:

  - The fight against money laundering and the financing of terrorism;
  - The fight against tax fraud;
  - The exchange of information with tax authorities (FATCA);
  - Official requests from competent public or judicial authorities (BAM, Courts, etc.).).

• Analysis of the use of products and services, with a view to improving the products and services marketed by CHAABI LLD;
• Risk management.
• Consent of the data subject: CHAABI LLD may be required to transmit information to data subjects with the possibility of allowing them to withdraw their consent at any time. This could essentially involve any commercial offer by electronic means relating to products and services

Sharing of personal data

Sharing on a national scale: 
In order to comply with the aforementioned purposes, CHAABI LLD would be called upon to share personal data with empowered and authorized individuals and entities, including:

• To BCP Group entities, its partners, subcontractors and service providers, and solely for the purposes described above;
• To other account-holding institutions for fund transfers;
• To intermediaries for the execution of certain banking transactions;
• To financial, tax, administrative, judicial and authorized guardianship authorities;
• To services of common interest;
• To insurance companies and licensed brokers ;
• To arbitrators, mediators and law enforcement authorities;
• To certain regulated professions such as auditors, notaries, lawyers, in order to provide regulatory reports or to act in defense of BCP Group's rights;
• To third-party payment service providers for the purposes of providing a payment initiation or account information service in the event of consent from the data subject.

International sharing:
The aforementioned processing operations may involve transfers of personal data to countries, whose personal data protection legislation is non-existent or less strict than national law.
In such cases, BCP Group takes the necessary steps with its subcontractors and partners to guarantee an appropriate level of personal data protection that complies with the personal data protection standards in force.
As such, BCP Group implements all appropriate contractual, technical, organizational and physical measures to preserve the security and confidentiality of personal data throughout the transfer process.

Personal data retention 
CHAABI LLD undertakes to retain personal data for the period necessary for the purpose of processing, under the conditions and within the limits provided for by the regulations in force. At the end of the regulatory retention period, the data concerned is deleted.
As an exception, personal data may be archived to manage ongoing claims and litigation, and to respond to authorities entitled to make such requests.
In addition, certain personal data may be retained and anonymized for statistical analysis purposes.

Exercise of data subjects' rights
In accordance with applicable regulations, CHAABI LLD guarantees that data subjects may exercise their rights, namely: 

• Right to information : The right to information concerns the prior information of any person, in a precise and clear manner, on how data is collected, processed and protected.
• Right of access : Any data subject has the right to request in writing, at reasonable intervals, access to his or her personal data and to know whether or not his or her data is being processed, as well as to obtain information on the purposes of the processing, the categories of data, information on the purposes of the processing, the categories of data concerned and the recipients to whom his or her data may be disclosed.
• Right of rectification: Any data subject may demand in writing, as soon as he becomes aware that his personal data is inaccurate or incomplete, that it be amended accordingly.
• Right to erasure : Any data subject may request the establishment to erase his or her personal data if it is no longer required for processing purposes, if it has been processed unlawfully or if the data subject withdraws his or her consent.
• It is important to note that CHAABI LLD is not obliged to erase data if its processing is necessary to comply with a legal obligation.
• Right to limitation:Any data subject may request the limitation of the processing of his or her personal data except for conservation or in the event that there is a legitimate interest in the continuation of the processing.
• Right to object: Any data subject may formulate an objection to the processing of his or her personal data, on legitimate grounds relating to his or her particular situation, particularly in relation to commercial prospecting.
• Withdrawal of consent:When the data subject gives his or her consent to the processing of his or her personal data, he or she has the right to withdraw consent at any time.

For any questions relating to the exercise of rights, data subjects may contact the Data Protection Officer (DPO) by sending an e-mail to dpo@chaabilld.ma or by post to the following address: CHAABI LLD Data Protection Officer - 19 rue des papillons, Quartier Oasis - BP 20410 - Casablanca.

Security measures 
CHAABI LLD takes all physical, technical and organizational measures to guarantee the confidentiality, integrity and availability of personal data, in particular to protect them against loss, accidental destruction, alteration and unauthorized access. CHAABI LLD is committed to protecting personal data, taking into account its sensitivity and the purpose for which it is processed. 
Personal data is stored on information systems that meet the highest security standards, and access is restricted to authorized persons only. In this respect, CHAABI LLD ensures that all of its employees as well as all persons involved in the processing of its data on its behalf (and in particular its subcontractors) comply with data protection and confidentiality measures processed in accordance with the regulations in force and its requirements.