Convert customers. Keep their trust.

Your activity,
its real flows.

Compliance is therefore not just about legal notices or a cookie banner. It is necessary to check what is triggered before the visitor's choice, who receives the information, how long it is kept, how a customer exercises their rights and whether the promises displayed correspond to the technical configurations.

RGPD Conseil Maroc combines documentary review, functional control, supplier mapping and action plan. Complex developments, security audits and advice relating to consumer law remain separate so that the quote indicates precisely what will be checked and what is the responsibility of another specialist.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

Launch or redesign

New store, application, marketplace, loyalty program or purchasing journey.

Marketing campaigns

Advertising pixels, emailing, segmentation, similar audiences and consents to check.

New supplier

Payment, delivery, CRM, customer reviews, support or hosting introduced in the chain.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Observe

Visitor journey, account creation, ordering, support, returns and prospecting.

Map

Data, purposes, bases, recipients, tracers, countries and durations.

To correct

Information, cookie choices, forms, contracts, settings and procedures.

Control

Periodic tests, new tags, requests for rights and proof of implementation.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Premature tracers

Beacons can transmit identifiers before the visitor's choice.

Mixed consent

Creating an account or purchasing should not automatically impose unnecessary prospecting.

Scattered data

Store, CRM, payment, delivery and support each retain part of the journey.

Indefinite durations

Inactive accounts, carts, tickets and leads require adapted rules.

Marketplace

The roles between platform, seller, payment and logistics must be qualified.

Difficult rights

Export, deletion or opposition require coordinated research between tools.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

Inventory tracers

List purpose, provider, duration, trigger and category of consent.

Separate Choices

Distinguish between order execution, account creation, loyalty and prospecting.

Supervise suppliers

DPA, security, location, processors and data review meeting.

Set durations

Rules by order, account, prospect, support, fraud and evidentiary obligations.

Organize rights

Point of entry, identity, multi-tool search, validation and secure response.

Test regularly

Control after redesign, new tag, campaign, application or change of CMP.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Route mapping

Steps, data, purposes, tools, managers and information points.

Cookie audit

Inventory, triggering, consent, withdrawal and proof of choice.

Documentary pack

Confidentiality, cookies, forms and notices adapted to actual operation.

Supplier register

Payment, logistics, CRM, marketing, support, hosting and reviews.

Rights procedure

Research, validation, deadlines, decisions, models and secure delivery.

E-commerce plan

Priority fixes with product, marketing, IT and operations managers.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

Incidents and rights →CNDP formalitiesGDPR responsibilities

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Does a privacy policy suffice to make the shop compliant? −

No. The document must correspond to the processing actually carried out. Compliance also depends on trackers, forms, account settings, supplier contracts, durations, security and ability to respond to requests. RGPD Conseil Maroc checks the consistency between public information and the observed journey.

Do all cookies require consent? +

Certain elements strictly necessary for the requested service may fall under a different regime, but the measurement, personalization or advertising tracers must be qualified individually. The simple presence of an “accept” button is not enough if tags are triggered before the choice or if the refusal is not effective.

Does the payment provider send us the data for which we are responsible? +

Roles vary depending on operations. The service provider may act under its own obligations for certain purposes and as a processor for others. We must examine contracts, flows and uses rather than assuming a single role for the entire relationship.

How to manage inactive customer accounts? +

A period must be determined according to the applicable purposes and obligations. Account activity, orders, warranties, accounting, litigation and prospecting do not necessarily follow the same rule. The conservation plan distinguishes sets from uniform deletion.

Does RGPD Conseil Maroc technically configure CMP and tags? +

RGPD Conseil Maroc can audit the configuration, define the rules and monitor the result. Developments or advanced interventions in the tag manager can be carried out by your team or a technical specialist, depending on the scope confirmed in the quote.

Does Law 09-08 apply in addition to the GDPR? +

An activity in Morocco may fall under Law 09-08 and CNDP formalities, while the GDPR may apply for other reasons related to the establishment, targeted persons or European customers. RGPD Conseil Maroc describes each framework and each flow separately before assembling the joint actions.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Serve your mission. Protect your people.
• Health data. Essential trust.
• Welcome guests. Control their data.
• Protect the people behind every HR record.