Privacy Policy

TKPay, main agent of NAPS (a payment institution licensed by Bank Al-Maghrib), is committed to protecting your personal data. This policy explains how we collect, use, and protect your information when using our payment services.

We collect the following categories of data: • Personal information: Name, company, professional email, Moroccan phone number, service interest type. • Technical data: IP address, browser type, pages visited, language preferences, anonymized analytics. • Transaction data: Amounts, currencies, payment times, statuses, order identifiers.

Your data is used to: • Process your contact and demo requests. • Manage customer relationships via our CRM. • Deliver our payment services. • Improve user experience. • Send marketing communications (with your consent). • Prevent fraud and illicit activities. • Meet our Moroccan legal obligations.

Your information is shared only with: • Zoho CRM (hosted EU/US) for customer management. • Self-hosted analytics (Umami) for anonymized statistics. • Payment providers licensed by Bank Al-Maghrib. • Moroccan authorities upon legal request. • Commercial partners (with your explicit consent). We never sell your personal data to third parties.

We protect your data with: • SSL/TLS encryption for all transmissions. • CSRF protection against attacks. • Rate limiting. • XSS and SQL injection prevention. • SHA-256 hashing of sensitive data. • Restricted data access. • Encrypted backups. • 24/7 monitoring and audit logs.

Under Moroccan law 09-08, you have the following rights: • Right to access your data. • Right to rectify inaccurate information. • Right to deletion ("right to be forgotten"). • Right to object to processing. • Right to restrict processing. • Right to data portability. • Right to withdraw consent. To exercise these rights: privacy@tkpay.ma

We only use essential cookies for: • Authentication and session security. • Remembering your language preferences. We do not use third-party tracking cookies.

Retention periods: • Contact requests: 3 years after last interaction. • Active customer data: Contract duration + 5 years. • Transactions: 10 years (legal requirement). • Security logs: 1 year. • Marketing data: Until consent withdrawal.

Some data may be transferred to Zoho CRM (EU/US). These transfers are governed by standard contractual clauses approved by the CNDP.

Our services are reserved for professionals. We do not intentionally collect data from minors. If you believe a minor has provided us with data, please contact us immediately.

We may update this policy. Changes will be notified by email and the latest version will always be available on our site with its update date.

• General email: privacy@tkpay.ma • Phone: +212 5 21 19 19 99 • Data Protection Officer: dpo@tkpay.ma • Address: Casablanca, Morocco

The National Commission for the Control of Personal Data Protection (CNDP) is the competent authority in Morocco. Address: Rabat, Morocco Website: www.cndp.ma