Aluid Marketing Agency runs this website, the client spaces linked to it, and the agency services described in our general terms. This policy explains what personal data we collect, why, on what legal basis, who helps us handle it, how long we keep it, how we protect it, and the rights you have. It is written to be read: if anything is unclear, write to us.
1. Who is responsible
The data controller is Aluid Marketing Agency, Morocco, Rabat, Rabat, Morocco.
Contact for anything about your data: aluid.hq@gmail.com.
2. What this policy covers
- Visitors to our website.
- People who send us an enquiry.
- Our clients and prospects, and the people who work for them and deal with us.
- People who use a client space or open a devis or invoice link we sent.
- Members of the public who appear in, or take part in, the campaigns and activations we run (see section 10).
It does not cover other websites, social networks or platforms we link to; they have their own policies.
3. What we collect
- Enquiry form: your name, email address, company, the language you used, and what you write in the form.
- Clients and prospects: names, job titles, email addresses and phone numbers of contacts; company details and legal identifiers (such as ICE, RC or tax numbers); devis, invoices, payments and their references; project notes, files, approvals and messages exchanged with us.
- Client space: the messages you send, when you sign in and when you last visited, and which documents you opened.
- Security data: to stop abuse we count attempts per connection. The IP address is never stored as such: it is turned into a keyed one-way code that cannot be reversed, and the counter is deleted when its time window ends (minutes to hours). Our host may keep standard technical server logs for a short period for security.
- Games on our website, such as the hidden envelope: only the code we give you, its language and the date. The code alone does not identify you. We learn who you are only if you send it to us, for example by Instagram message, and we use that conversation only to give you your prize and reply to you.
- We do not ask for, and ask you not to send us, sensitive data: health, religion, political opinions, criminal records, biometric data, or bank card numbers. Payments are made by bank transfer or through the payment provider named on the invoice, never by sending card details to us.
4. Cookies
- We use only cookies that are strictly necessary for the service to work: one keeps you signed in to your client space (up to 30 days, or until you sign out), and one keeps our staff signed in to our private tools.
- We use no advertising cookies, no analytics or audience measurement, no social media trackers and no third-party fonts or scripts that follow you. Because of this, no cookie consent banner is needed.
- If we ever add non-essential cookies, we will ask for your consent first and update this page.
5. Why we use your data, and on what basis
- To answer your enquiry and prepare a devis: steps you asked for before a contract.
- To deliver the work, invoice it, collect payment and keep you informed: performance of our contract.
- To keep accounting and tax records and answer lawful requests from authorities: legal obligations.
- To secure our website and tools, prevent fraud and abuse, and establish or defend legal claims: our legitimate interest, balanced against your rights.
- To show finished work in our portfolio: as set out in our general terms, and you can object at any time.
- To send news or marketing: only with your consent, and you can withdraw it at any time with one email.
We never use your data for automated decisions that produce legal effects on you, and we never sell it.
6. AI tools
Inside our private tools we may use an AI service (currently Groq) to help our team: summarising enquiries, drafting replies to messages, briefing us on a client, deal or project from our own notes, and suggesting campaign ideas for a prospect from public information such as their website or social media page. Our team also has a private assistant that answers their questions from the records they are allowed to see (for example a client's name, city, website, project notes or the lines of a quote) and searches the public web for them. Only the text needed for that task is sent, never email addresses, phone numbers, bank details or passwords. A team member's conversations with the assistant are kept for them only, until they delete them. Every suggestion is read and decided on by a person on our team; the AI never replies to you on its own and never decides anything about you.
7. Who receives your data
- Our team, each person only for what their role needs. Access is protected by strong passwords and compulsory two-step login, and important actions are logged.
- Service providers who handle data only on our instructions and under confidentiality: Vercel (website hosting), Supabase (database hosting), Resend (sending emails), Groq (AI drafting, see section 6), and the payment provider named on an invoice if you choose to use it.
- Professional advisers bound by confidentiality, such as our accountant or lawyer.
- Public authorities or courts, only when the law requires it.
- A buyer or successor of our business, if that ever happens, who would then be bound by this policy.
We do not sell, rent or trade personal data, and we do not share it for other companies' marketing.
8. Transfers outside Morocco
Some of our providers store or process data outside Morocco, mainly in the European Union and the United States. We make these transfers only with the safeguards required by Law 09-08, including the authorisation of the CNDP where it is required, and we choose providers that commit contractually to protect the data.
9. How long we keep it
- Enquiries that do not lead to work: deleted at the latest 24 months after our last exchange.
- Devis, invoices, payment records and the documents that support them: 10 years, as accounting law requires.
- Other client and prospect records (contacts, notes, messages): for as long as we work together, then 5 years to cover legal claims, then deleted or anonymised.
- Client space sessions: until you sign out or the session ends.
- Security counters: minutes to hours.
- Activity log of our tools: up to 5 years, for accountability and security.
- Items deleted by our team go to a recovery bin first, then are permanently erased.
After these periods data is deleted or made anonymous, unless a legal dispute or a legal obligation requires us to keep it longer.
10. Campaigns and people in public spaces
- When a client asks us to collect or use personal data of their own customers or of the public (for example sign-ups at an activation, a contest, or a contact list), the client is the data controller and we act only as their processor: we use the data only for that campaign and on their written instructions, keep it confidential and secure, and delete or return it when the campaign ends. The client is responsible for having a valid legal basis, informing the people concerned, and any declarations to the CNDP for their own processing, unless the devis says otherwise.
- Our guerrilla, ambient and experiential work happens in public places. We photograph and film our activations to document them. We do not make an identifiable person the focus of an image used in publicity without their permission. If you recognise yourself in our images and want to be blurred or removed, write to aluid.hq@gmail.com: we will act promptly, and remove the image from our own channels.
- People who take part in an activation on purpose (for example in a game, an interview or a photo booth) are told how their data or image will be used before taking part.
11. Your rights
Under Moroccan Law 09-08 you have the right to be informed, to access your data, to have it corrected or completed, and to object to its use for legitimate reasons, and at any time and free of charge to marketing. You may also ask us to delete data we no longer need.
If you are in the European Union, the GDPR also gives you the right to data portability, to restrict processing, to erasure, and to complain to your local data protection authority.
To use any of these rights, write to aluid.hq@gmail.com. We may ask you to confirm your identity so that we never hand your data to someone else. We answer as quickly as possible and within one month at the latest. If you are not satisfied, you can contact the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel), www.cndp.ma.
12. Security
We protect data with encryption in transit (HTTPS), encrypted secrets, access limited by role, compulsory two-step login for our team, private links for documents and client spaces, rate limits against abuse, logged actions and regular backups. No system can be guaranteed perfectly secure: if a breach ever puts your data at risk, we will act at once to contain it and inform you and the competent authorities as the law requires.
13. Your part
- Keep your client space link and access code private, and tell us at once if you think someone else has them.
- If you give us personal data about other people (your colleagues, suppliers or customers), make sure you are allowed to and that they know about it.
- Do not send us sensitive data or card numbers by email or message.
14. Children
Our website and services are meant for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a minor has sent us data, write to us and we will delete it.
15. Changes to this policy
We may update this policy when our services or the law change. The date at the bottom shows the latest version. If a change matters to how we use your data, we will tell our clients by email before it applies.
16. Contact
Aluid Marketing Agency, Morocco, Rabat, Rabat, Morocco. Email: aluid.hq@gmail.com.
Last updated : 13 November 2026