Privacy Policy

This Privacy Policy is intended to inform users of the website almaviva.ma (hereinafter "the Site") about how their personal data is collected, processed and protected, in accordance with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data.

Article 1 — Data controller

The data controller is:

Article 2 — Data collected

In the course of using the Site and placing orders, Alma Viva may collect the following categories of data:

• Identification data: surname, first name, email address, phone number.
• Delivery data: recipient's postal address, delivery instructions.
• Payment data: payment information is collected and processed directly by our payment provider Stripe. Alma Viva never has access to full bank card numbers.
• Personalised content: text messages, audio or video files uploaded as part of the personalised message service (QR code).
• Browsing data: IP address, browser type, pages viewed, visit duration, cookie data.
• Communication data: exchanges with customer service (emails, messages).

Article 3 — Purposes of processing

Personal data is collected for the following purposes:

• Order fulfilment: order management, bouquet preparation and delivery, generation and hosting of personalised messages.
• Customer relationship management: order tracking, complaint handling, after-sales service.
• Payment: secure transaction processing via Stripe.
• Marketing communications: sending newsletters and promotional offers (only with the Customer's prior consent).
• Service improvement: Site traffic analysis, user experience optimisation.
• Legal obligations: compliance with accounting and tax obligations.

Article 4 — Legal basis for processing

Personal data processing is based on the following legal grounds:

• Contractual performance (Law 09-08): order processing, delivery, provision of the personalised message service.
• Consent (Law 09-08): sending marketing communications, placing non-essential cookies.
• Legitimate interest (Law 09-08): improving the Site and services, fraud prevention.
• Legal obligation (Law 09-08): retention of invoices and accounting data.

Article 5 — Data retention period

Personal data is retained for the period strictly necessary for the purposes for which it is collected:

Article 6 — Data recipients

Personal data may be shared with the following sub-processors and partners, strictly within the scope of the purposes described above:

Alma Viva does not sell, rent or transfer its Customers' personal data to third parties for commercial purposes under any circumstances.

Article 7 — International data transfers

Some of our sub-processors (Supabase, Vercel) are based in the United States. These transfers are safeguarded by appropriate guarantees in accordance with Law 09-08, including:

• Contractual clauses guaranteeing an adequate level of data protection.
• Security certifications of the providers (SOC 2, ISO 27001).

You may obtain a copy of the safeguards in place by contacting Alma Viva at contact@almaviva.ma.

Article 8 — Your rights

In accordance with Law 09-08, you have the following rights regarding your personal data:

• Right of access (Law 09-08): obtain confirmation that your data is being processed and receive a copy.
• Right of rectification (Law 09-08): have your inaccurate or incomplete data corrected.
• Right to erasure (Law 09-08): request the deletion of your data, subject to legal retention obligations.
• Right to restriction of processing (Law 09-08): request the suspension of processing of your data in certain cases.
• Right to data portability (Law 09-08): receive your data in a structured, machine-readable format.
• Right to object (Law 09-08): object to the processing of your data on legitimate grounds, as well as to processing for direct marketing purposes.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing based on consent given prior to withdrawal.
• Right to define post-mortem directives: define directives regarding the fate of your data after your death.

To exercise your rights, send your request along with a copy of an identity document to:

Alma Viva undertakes to respond within one (1) month of receiving your request. This period may be extended by two (2) months in case of complex requests.

In case of difficulty, you have the right to lodge a complaint with the National Commission for the Control of Personal Data Protection (CNDP):

Article 9 — Cookies

The Site uses cookies and similar technologies. A cookie is a small text file placed on your device (computer, tablet, smartphone) when you visit the Site.

Strictly necessary cookies: essential for the operation of the Site (session, shopping cart, authentication). They do not require your consent.

Analytical cookies: used to measure Site traffic and improve user experience. Placed only with your consent.

Third-party cookies: related to payment services (Stripe) and hosting (Vercel). Necessary for the proper functioning of the relevant services.

You may configure your cookie preferences at any time via the consent banner displayed during your first visit or through your browser settings. Deleting cookies may limit access to certain features of the Site.

Article 10 — Data security

Alma Viva implements appropriate technical and organisational measures to ensure the security and confidentiality of your personal data, including:

• Data encryption in transit (HTTPS / TLS).
• Data encryption at rest in the database.
• Secure payments via Stripe (PCI-DSS Level 1 certified) — no banking data is stored on our servers.
• Restricted access to personal data to authorised personnel only.
• Regular data backups.
• Regular monitoring and updating of systems.

Article 11 — Changes to the Privacy Policy

Alma Viva reserves the right to modify this Privacy Policy at any time. Any changes will be published on this page with the updated date. In the event of significant changes, users will be notified via a visible notice on the Site or by email.

We encourage you to regularly check this page for any updates.

Article 12 — Contact

For any questions regarding this Privacy Policy or the protection of your personal data, you may contact us:

• By email: contact@almaviva.ma
• By phone: 06 63 26 62 73
• By post: Harhoura residence badiaa 2, Temara 12040