Privacy Policy

Ijaroc ("we", "us", "our") operates an online marketplace connecting customers with independent local car rental agencies operating in Morocco.

This Privacy Policy applies to all personal data processed when you access the Platform, create an account, make a booking, or contact us.

The personal data we collect depends on whether you are a Customer or a Lessor.

Full payment card details are processed by the payment providers and are not stored by IJAROC. IJAROC retains the information needed to track transactions, as described in the “Payments” section.

With your consent to audience and ad performance measurement, Google Analytics also processes browsing and usage data: pages viewed, searches, booking or sign-in steps, technical browser and device information, tracker identifiers and booking data useful for statistics. This also concerns visitors without an account.

• To create and manage user accounts.
• To process bookings and provide rental confirmations.
• To verify Lessors and ensure trust and safety on the Platform.
• To provide customer support and respond to inquiries.
• To prevent fraud, secure the Platform, and comply with legal obligations.
• Measure audience and the booking journey with Google Analytics, and ad performance with Google Ads, based on your consent.

IJAROC does not send newsletters or promotional offers to users. Its communications concern account management, bookings, payments and the security deposit, support, security or legal obligations.

IJAROC processes personal data on the following legal bases, depending on the purpose concerned:

• Contract and pre-contractual steps at your request (Article 6(1)(b) GDPR): create and manage your account, arrange bookings, send confirmations and provide payment, security-deposit, refund and service-related support follow-up, where you are personally a party to the contract with IJAROC and to the extent necessary for that service.
• Legitimate interests (Article 6(1)(f) GDPR): secure the platform and prevent fraud and ban evasion, verify rental agencies and their representatives, manage dealings with agency representatives, answer general enquiries and defend IJAROC’s rights in disputes. The data used must be necessary for those purposes, provided that the individuals’ interests or fundamental rights do not override them.
• Legal obligations (Article 6(1)(c) GDPR): maintain and retain accounting records, including under Article L. 123-22 of the French Commercial Code, handle GDPR rights requests and comply with disclosure obligations legally applicable to IJAROC. A request from a foreign authority does not, on its own, establish this legal basis; disclosure and transfer requirements must also be checked.
• Consent (Article 6(1)(a) GDPR): measure audience, usage journeys and ad performance with Google Analytics and Google Ads. You can withdraw this consent at any time through “Manage cookie choices” in the footer, without affecting the lawfulness of processing before withdrawal.

Payments are processed through Stripe and PayPal. IJAROC does not store full payment card details. It retains references for operations linked to bookings, the payment method used, amounts, dates and statuses needed to track authorizations, charges, refunds and security deposits. This information is used to manage operations, respond to complaints and maintain accounting records, under the rules described in the “Data retention” section.

Payment providers: Stripe and PayPal.

We share personal data only when necessary to operate the Platform and provide our services.

• With the relevant Moroccan agencies, only for data needed to arrange and perform the booking, excluding copies of driving licences and identity documents submitted to IJAROC.
• With Amazon Web Services for hosting, Stripe and PayPal for payments, Google (Gmail) for the [email protected] mailbox, and Cloudflare for website and contact-form security. Google also receives audience and ad performance measurement data through Google Analytics and Google Ads when you accept it. Each disclosure is limited to the needs of the service concerned.
• IJAROC may disclose to competent authorities or legally authorized bodies only the information and, where necessary, document copies covered by a legally valid request or an applicable legal obligation. Before any disclosure, IJAROC verifies the requester’s identity and authority, the legal basis, the scope of the request and the conditions applicable to any international transfer. The request and checks are documented, and the disclosure is secured. A mere report or the existence of a dispute does not, by itself, authorize disclosure.

Copies of driving licences and identity documents submitted to IJAROC are not public and are not made available to Lessors. Within IJAROC, access is restricted to authorized personnel who need them for verification and case handling. The Lessor checks the documents presented by the Customer and each driver directly in person before vehicle handover; IJAROC’s checks do not replace those checks.

Supporting documents submitted by Lessors to IJAROC to verify their account or vehicles, including the commercial register, the legal representative’s identity document and vehicle registration documents, are not published on the Platform. Within IJAROC, access is restricted to authorized personnel who need them for verification and case handling. Any legally justified disclosure to an authority remains subject to the applicable checks and limits.

Customer data and documents held by IJAROC on its AWS infrastructure are stored in the AWS Europe (Paris) Region in France. Hosting is provided by Amazon Web Services EMEA SARL, whose address is 38 Avenue John F. Kennedy, L-1855, Luxembourg.

The people responsible for IJAROC’s support and administration access customer data and documents from France.

Choosing a storage region in France does not mean that all processing takes place in France. Data needed to arrange and perform the rental is shared with the relevant agencies in Morocco. Payment and communication providers may also process certain data in other countries. These exchanges with agencies do not include copies of driving licences and identity documents submitted to IJAROC.

Where processing involves a transfer of data outside the European Economic Area, that transfer must be governed in accordance with the GDPR. You may request information about the applicable safeguards and how to access the corresponding documents at [email protected].

Accounts are deleted after ten consecutive years of inactivity. Earlier deletion may be requested under the procedures and exceptions described below.

Support correspondence by email (Gmail) and WhatsApp is retained for ten years from the date of each message. This period is also subject to the deletion requests and exceptions described below.

Documents submitted by Customers and Lessors are kept by IJAROC and remain associated with the relevant account. Deletion requests are handled under the procedures and exceptions described below.

Customers and Lessors may request deletion of their data and documents submitted to IJAROC at any time by contacting [email protected], WhatsApp support or the website’s contact form. IJAROC deletes the data and documents covered by the request, subject to the exceptions described below. Deleting all data or documents associated with an account also closes that account, for both Customers and Lessors.

Data whose retention is still required by law or strictly necessary for the establishment, exercise or defence of legal claims is not erased. Such data is kept in restricted-access archives for the applicable period. In particular, invoices and accounting supporting records must be retained for ten years from the end of the relevant financial year. This obligation does not, by itself, justify retaining all copies of identity documents, driving licences or Lessor documents. IJAROC informs the user of the retained categories, the reason and the retention period, unless disclosure is legally restricted. The data is deleted when the necessary or mandatory period expires.

When a banned account is deleted, IJAROC keeps separately, in an exclusion list, only the Customer’s driving licence number or, for the Lessor, the national identity card (CIN) number and commercial register number. This list contains no first name, surname or document copy. The account’s other data and documents are deleted, subject to the accounting and legal-claim exceptions described above.

Numbers in the exclusion list are retained without a time limit to prevent ban evasion. A match with this list during a new registration results in automatic refusal. These numbers remain personal data even without a first name or surname and remain subject to the rights described below.

Retention in Google Analytics is set to 2 months for event data and 14 months for user data. The period associated with the user identifier restarts with each newly recorded activity. Data whose retention period has expired is deleted through Google’s monthly deletion cycle. These settings do not apply to standard aggregated statistical reports and do not determine cookie lifetimes.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse.

Depending on your location, you may have the following rights regarding your personal data:

• Right of access.
• Right to rectification.
• Right to erasure, in certain circumstances.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing.
• Right to withdraw consent at any time.

To exercise your rights, please contact us using the details below.

To protect data against fraudulent deletion or disclosure, IJAROC verifies the requester’s identity using proportionate means. A new copy of an identity document is not systematically required; additional information is requested only where there is reasonable doubt and only to the extent necessary.

IJAROC handles requests to exercise data protection rights without undue delay and informs the person of the action taken no later than one month after receipt. This period may be extended by two additional months if the complexity or number of requests justifies it; the person is informed within the first month, together with the reasons for the extension. The support service’s commitment to a written response, where applicable, remains unchanged. If a request is refused in whole or in part, IJAROC explains the reasons and available remedies, including a complaint to the CNIL or proceedings before the competent court.

You can contact [email protected] to challenge your inclusion in the exclusion list or an automatic refusal and request that a person review your situation. You can exercise your rights to rectification, erasure and objection under the conditions provided by law. If you object on grounds relating to your particular situation, IJAROC must stop this processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or a need relating to the establishment, exercise or defence of legal claims.

The site uses cookies and similar technologies for sign-in, security and your preferences. Audience and ad performance measurement with Google Analytics and Google Ads requires your consent. You can refuse it or withdraw consent using “Manage cookie choices” in the footer.

For more details, please refer to our Cookie Policy.

Your choice to accept or refuse optional trackers is valid for six months from your decision, in the browser you use. Browsing does not extend this period. On expiry, the banner is shown again and optional trackers remain disabled until you accept them again. You can change your choice or withdraw consent at any time using “Manage cookie choices” in the footer.

If you have any questions regarding this Privacy Policy or your personal data, you may contact us at:

Email:

[email protected]

We may update this Privacy Policy from time to time. Any changes will be published on this page.