RCM
Launch or redesign
New store, application, marketplace, loyalty program or purchasing journey.
E-COMMERCE · MARKETPLACE · MARKETING
Convert customers.
Convert customers.
Keep their trust.
A merchant site concentrates identities, addresses, buying history, exchanges with support, browsing behaviors and sometimes more revealing data than expected. Between the shop, payment, delivery, advertising, emailing and analysis, the data circulates in an ecosystem rarely controlled by a single contract.
COOKIESORDERSMARKETINGPRESTATARY
Your activity,
its real flows.
Compliance is therefore not just about legal notices or a cookie banner. It is necessary to check what is triggered before the visitor's choice, who receives the information, how long it is kept, how a customer exercises their rights and whether the promises displayed correspond to the technical configurations.
RCM combines documentary review, functional control, supplier mapping and action plan. Complex developments, security audits and advice relating to consumer law remain separate so that the quote indicates precisely what will be checked and what is the responsibility of another specialist.
Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.
WHEN TO COME
Triggers
Triggers
most common.
A mission may begin before a launch, during a negotiation or after a gap appears.
Marketing campaigns
Advertising pixels, emailing, segmentation, similar audiences and consents to check.
New supplier
Payment, delivery, CRM, customer reviews, support or hosting introduced in the chain.
FROM THE FIELD TO EVIDENCE
A journey
A journey
in four stages.
Decisions and limits are made visible at each stage.
Observe
Visitor journey, account creation, ordering, support, returns and prospecting.
Map
Data, purposes, bases, recipients, tracers, countries and durations.
To correct
Information, cookie choices, forms, contracts, settings and procedures.
Control
Periodic tests, new tags, requests for rights and proof of implementation.
SECTORAL RISKS
What the documents
What the documents
Don't always show.
These situations are points of analysis, not automatic conclusions.
Premature tracers
Beacons can transmit identifiers before the visitor's choice.
Mixed consent
Creating an account or purchasing should not automatically impose unnecessary prospecting.
Scattered data
Store, CRM, payment, delivery and support each retain part of the journey.
Indefinite durations
Inactive accounts, carts, tickets and leads require adapted rules.
Marketplace
The roles between platform, seller, payment and logistics must be qualified.
Difficult rights
Export, deletion or opposition require coordinated research between tools.
OPERATIONAL CONTROLS
Measures that
Measures that
teams can apply.
Each check must have a responsible person, frequency and proportionate proof.
Inventory tracers
List purpose, provider, duration, trigger and category of consent.
Separate Choices
Distinguish between order execution, account creation, loyalty and prospecting.
Supervise suppliers
DPA, security, location, processors and data review meeting.
Set durations
Rules by order, account, prospect, support, fraud and evidentiary obligations.
Organize rights
Point of entry, identity, multi-tool search, validation and secure response.
Test regularly
Control after redesign, new tag, campaign, application or change of CMP.
DELIVERY
What RCM
What RCM
Leave it to your teams.
The final scope depends on maturity, risks and elements already available.
Route mapping
Steps, data, purposes, tools, managers and information points.
Cookie audit
Inventory, triggering, consent, withdrawal and proof of choice.
Documentary pack
Confidentiality, cookies, forms and notices adapted to actual operation.
Supplier register
Payment, logistics, CRM, marketing, support, hosting and reviews.
Rights procedure
Research, validation, deadlines, decisions, models and secure delivery.
E-commerce plan
Priority fixes with product, marketing, IT and operations managers.
TWO FRAMES
GDPR and law 09-08,
GDPR and law 09-08,
I didn't confuse them.
The same activity may fall within both frameworks for different reasons.
GDPR
Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.
Law 09-08
Treatment in Morocco, rights, security and formalities of declaration or authorization.
International flows
Access, hosting, recipients, mechanism, context and additional measures.
Evidence
Contracts, registers, decisions, controls, training, incidents and actions followed.
INTERVENTION FORMATS
Start small.
Start small.
Maintain if necessary.
The amounts are confirmed after scoping; no fictitious pricing is published.
Starting point
Targeted interviews, review of available elements, major risks and sectoral roadmap.
Fixed price · after scopingPriority base
Agreed deliverables, corrections, review meeting and operational transfer to internal managers.
From — on estimateContinuous management
Volume, deadlines, meetings, controls, new projects and contract overruns.
Subscription · on quote
RESPONSIBILITIES AND LIMITS
Advise, structure
Advise, structure
and advance.
RCM provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.
- Penetration tests, forensic investigations and certifications are carried out by competent experts.
- Reserved legal consultations and litigation are directed to a lawyer.
- Sectoral regulations excluding data protection remain outside the scope unless expressly stated.
FREQUENTLY ASKED QUESTIONS
Specific responses.
Specific responses.
Contextualized decisions.
These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.
Does a privacy policy suffice to make the shop compliant? −
No. The document must correspond to the processing actually carried out. Compliance also depends on trackers, forms, account settings, supplier contracts, durations, security and ability to respond to requests. RCM checks the consistency between public information and the observed journey.
Do all cookies require consent? +
Certain elements strictly necessary for the requested service may fall under a different regime, but the measurement, personalization or advertising tracers must be qualified individually. The simple presence of an “accept” button is not enough if tags are triggered before the choice or if the refusal is not effective.
Does the payment provider send us the data for which we are responsible? +
Roles vary depending on operations. The service provider may act under its own obligations for certain purposes and as a processor for others. We must examine contracts, flows and uses rather than assuming a single role for the entire relationship.
How to manage inactive customer accounts? +
A period must be determined according to the applicable purposes and obligations. Account activity, orders, warranties, accounting, litigation and prospecting do not necessarily follow the same rule. The conservation plan distinguishes sets from uniform deletion.
Does RCM technically configure CMP and tags? +
RCM can audit the configuration, define the rules and monitor the result. Developments or advanced interventions in the tag manager can be carried out by your team or a technical specialist, depending on the scope confirmed in the quote.
Does Law 09-08 apply in addition to the GDPR? +
An activity in Morocco may fall under Law 09-08 and CNDP formalities, while the GDPR may apply for other reasons related to the establishment, targeted persons or European customers. RCM describes each framework and each flow separately before assembling the joint actions.
Your sector deserves A concrete scoping.
Present your tools, data, customers, suppliers, countries and deadlines. RCM will indicate the first useful perimeter.
Scoping the mission →