Working document, pending legal validation: this text binds DSSF only once validated by legal counsel. Fields in brackets “[to complete]” remain to be filled in.
1. Data controller
- Digital Solution & System Factory — SARL AU (“DSSF”)
- Trade register: RC 16327
- Registered office: Errachidia, Morocco
- Office: Tangier, Morocco
Contact for exercising rights: [to complete: dedicated e-mail address].
Applicable framework: Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data (CNDP) and, for customers and users established in the European Union, Regulation (EU) 2016/679 (GDPR). [to complete: CNDP declaration or authorisation number.]
2. Data collected
- Account and professional identity: name, e-mail, phone, organisation or workshop, role, language.
- Quotation requests and orders: CAD files and drawings, part configuration, quantities, delivery address, technical exchanges.
- File-vault access log: user, role, action (metadata, preview, download), decision (granted / refused with reason), timestamp, IP address.
- Legal acceptances: document version, date, IP address, role, organisation or workshop.
- Technical security data: IP address, user agent, rate-limiting counters (kept in memory for a few minutes at most).
- Workshops: capabilities, declarations (equipment, availability, declared hourly costs), performance (punctuality, non-conformities), audits.
The platform uses no advertising trackers. Cookies are strictly necessary (session, language, preferences).
3. Purposes and legal bases
- Performance of the contract: quotation, ordering, manufacturing, quality control, delivery, invoicing.
- Security and traceability: file-access control, logging, abuse prevention (rate limiting), proof of legal acceptances.
- Legal obligations: accounting, retention of supporting documents.
- Legitimate interest: service improvement, calibration of estimates from logged human decisions (never from customer files outside the order concerned).
4. Retention periods
- Account: duration of the relationship, then [to complete: archiving period] after closure.
- CAD files and drawings: duration of the order, then kept in the vault until the customer deletes them; immediate logical deletion on request, permanent purge within [to complete: period].
- File-access log and legal acceptances: [to complete: period, 5 years recommended] for evidentiary purposes.
- Backups: rolling 14 days (archives encrypted at destination, see “Processors”).
- Accounting records: statutory period applicable in Morocco.
5. Your rights
You have the right to access, rectify, object to and delete your data (Law 09-08) and, for persons covered by the GDPR, the rights to restriction and portability and the right to lodge a complaint with your supervisory authority.
Requests are sent to [to complete: dedicated e-mail address]; DSSF replies within the statutory time limits after verifying the requester's identity.
In Morocco, the supervisory authority is the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP).
6. File vault and access log
Originals (CAD, drawings, photos, documents) are never served publicly: every access goes through a short-lived signed URL after a rights check (owning organisation, DSSF engineer, assigned workshop having accepted the NDA).
Every metadata view, preview or download — granted or refused — is logged with the user, role, timestamp and IP address. Drawings downloaded by a workshop carry an identifying watermark.
The log can be consulted by the file's owning organisation and by DSSF.
7. Processors and transfers
- OVH SAS (France): hosting of the application, the file vault and backups (virtual private server; object storage for off-site copies if enabled).
- Supabase (when the database mode is enabled): PostgreSQL database, authentication and multi-factor authentication — [to complete: contracting entity, region and transfer clauses].
- [to complete: e-mail sending provider, if any.]
Transfers outside Morocco or the European Union are governed by the safeguards provided by Law 09-08 and, where applicable, the GDPR (standard contractual clauses). [to be validated by legal counsel.]
8. Security
Encryption in transit (HTTPS), role-based access enforced server-side and in the database (row-level security policies), multi-factor authentication for DSSF accounts, rate limiting, daily backups with 14-day rotation, monitoring and access log.
In the event of a data breach likely to create a risk for individuals, DSSF notifies the competent authority and the persons concerned within the statutory time limits.