Privacy policy
This policy sets out the data we collect, what we use it for and the rights available to you. It is drawn up in accordance with Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data.
Who is the data controller
WebApp, Casablanca, Maroc, Casablanca. For any question about your data: donnees@webapp.ma.
Data we collect on this site
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Name, company, email, telephone | Contact or appointment form | Answer your enquiry and prepare a quotation | 3 years from the last exchange |
| Content of your message | Form | Understand your requirement | 3 years |
| IP address, date, page viewed, browser | Server logs | Security, abuse detection, audience measurement | 12 months |
| Language and theme preference | Browser local storage | Show the site as you left it | Until you clear it |
We collect no sensitive data and carry out no profiling. No automated decision is taken about you.
Cookies
This site sets only a technical session cookie, required for the forms to work (protection against fraudulent submission). It expires when the browser closes. We use no advertising network, no embedded social button and no tracker placed on your device. The traffic measurement described below runs entirely server-side, with no cookie and no script on your end.
Traffic measurement and country of origin
We count page views to understand what interests our visitors. This happens on our server: no script, no cookie, no extra request from your browser.
To determine the country and city a visit comes from, your IP address is sent to ip-api.com (Hetzner Online GmbH, Germany), which returns those details. This is a transfer of data outside Morocco. No other data is shared with them, and the result is cached on our side so the same address is never looked up twice. IP addresses are erased from our statistics after twelve months.
An IP address is personal data. If you would rather yours were not processed this way, write to us and we will remove it from our logs.
Recipients
Your data is handled by the WebApp employees who need it. It is not sold, rented or passed on for commercial purposes. Our technical suppliers - host, email delivery service, and ip-api.com for IP geolocation only - access it only as far as their service requires, and are bound by contractual confidentiality.
Our customers' data inside their applications
When we operate an application for a customer, the data it holds belongs to that customer, who is the controller; WebApp acts as processor. Our access is named and logged, limited to operations and support, and ends with the contract. At that point a full backup is handed to the customer and our working copies are destroyed within thirty days, unless the law requires otherwise.
Security
Traffic to this site is encrypted (HTTPS). Passwords are stored as non-reversible hashes. Backups are encrypted and their restoration is tested periodically - a backup never restored is not a backup. Server access is named and logged.
Your rights
You have rights of access, rectification, objection and erasure over your data. To exercise them, write to donnees@webapp.ma stating your request; we answer within thirty days. You may also refer the matter to the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP), the competent authority in Morocco.
Changes to this policy
Any change to this policy is published on this page with its update date. Substantial changes are notified by email to customers under contract.
Last updated: 28 août 2026.