Privacy Policy

    Last updated: 9 August 2026 — version 1.0

    A summary of our data protection approach, designed within the framework of Moroccan Law 09-08, CNDP principles and the GDPR. Version 1.0 — effective 9 August 2026. The full, detailed notice is presented inside the DarID check-in application.

    CNDP & GDPR framework

    DarID is designed within the framework of Law 09-08, CNDP principles and the GDPR. This page summarizes how that applies and does not constitute legal advice.

    DarID facilitates administrative compliance but does not replace the host's legal obligations.

    Data we collect

    Identity (first name, last name, date of birth, nationality) · Contact (email, city) · ID document (type, number, expiry date, front/back images) · Technical data (IP address, device, browser, action timestamps) · Signature (image, OTP verification, SHA256 document hash).

    Uploaded identity documents

    Travelers upload a copy of their identity document and enter their own information in the form. No automatic reading or extraction is performed in this version. Documents are stored securely and kept only for the legally required period.

    CNDP, Law 09-08 and GDPR framework

    Processing is designed within the framework of Law 09-08 on the protection of individuals with regard to the processing of personal data, CNDP principles and the GDPR where it applies (travelers from the European Union). In practice: purpose limited to the legal registration of the stay, data minimization, clear information to the traveler, consent for uploading the ID document and signing, defined retention periods, security and traceability. Data is never sold or reused for advertising.

    Legal grounds and roles

    Grounds: legal obligation (guest forms and register, law 80-14), performance of the stay and of the service contract, consent (ID document upload, electronic signature) and legitimate interest limited to platform security. Roles: the host is the data controller, DarID acts as a technical processor on instruction, under a data processing agreement. Sub-processors: hosting (Nindohost — Morocco, Hostinger — Paris), transactional email and OTP delivery.

    Retention periods

    Identity data, ID document images and individual guest forms: 1 year (law 80-14, availability to the authorities) · Signed contracts and audit logs: 5 years · Technical data (IP, device): 90 days · Contact data: 5 years. Earlier deletion is possible where not prohibited by law.

    Your rights

    Under Law 09-08 and the GDPR: access, rectification, erasure (subject to legal retention), restriction, portability and objection. Requests to privacy@darid.ma, answered within 30 days (extendable by 30 days for complex requests).

    Security and hosting

    TLS 1.3 encryption in transit and AES-256 at rest, access restricted to authorized staff, audit logs and monitoring. Primary hosting in Morocco (Nindohost); application and database hosting with Hostinger (server in Paris, France). Any transfer outside Morocco relies on appropriate contractual safeguards.

    Contact and supervisory authority

    Personal data questions: privacy@darid.ma. No data protection officer has been formally appointed to date. Supervisory authority: CNDP — www.cndp.ma. For a stay, the host (property) is the data controller and DarID acts as technical processor.

    Important note: DarID facilitates administrative compliance but does not replace the host's legal obligations regarding accommodation safety, guest verification or incidents.