Privacy policy
Last updated: 4 October 2026
This text is a translation. The French version prevails.
MarocImmo uses your data to manage your account, publish your listings and help people get in touch. This page explains who receives this data, how long we keep it and how to exercise your rights. It also covers audience measurement, cookies and browser storage.
1. Who is responsible for your data?
The data controller is PRIVATE NETWORK, a limited liability company with share capital of 100,000 DH. Its registered office is at 92 Boulevard Zerktouni, Apartment 6, 2nd floor, Guéliz, Marrakech, Morocco. It is registered with the Marrakech Commercial Register under number 104803.
For any questions or to exercise your rights, email contact@marocimmo.com or use the Contact page. You can find information about the publisher in the legal notice.
This page provides the information required by Article 5 of Law 09-08 on the protection of personal data.
2. What data do we use and why?
Article 4 of Law 09-08 provides several legal grounds for using your data. Depending on the purpose, we rely on your consent, the need to provide the requested service or our legitimate interest. This interest must not override your rights and freedoms. Some optional features are activated when you make a choice. This choice does not constitute consent to other uses.
| Purpose | Data | Grounds |
|---|---|---|
| Creating and managing your account | Email, first name, password hash, advertiser type, phone number, WhatsApp preference, language, account creation and deletion request dates. With Google: identifier, verified email, first name and profile photo URL. If you request a new password: the hash of the link sent by email and its request and use dates. The account exists as soon as you register; we also retain the date and method of email address confirmation, the number of reminders and, for each confirmation email, the recipient address, the reason it was sent, the hashes of the code and link, the number of incorrect codes entered, and the dates it was sent, expired, used or invalidated. For a listing marked “To confirm”, we retain the information entered when it was submitted for as long as it remains in that state: phone number, WhatsApp preference, language, private individual or agency with name and city. | Provision of the service. Signing in with Google remains optional. |
| Publishing and managing your listings and drafts | Title, description, photos, asking price or “Price on request”, features, city, neighbourhood, dates, listing status and the date a rental property becomes available. Optional answer to the question “concluded thanks to MarocImmo”. | Provision of the service; consent for the optional answer. |
| Checking listings and managing moderation | Listing content, decision history, reason for rejection or suspension, details, dates and the team member handling the matter. | Legitimate interest in enforcing the publication rules and preventing abuse. |
| Creating an agency page and verifying its ICE | Name, city, logo, address, website, introduction, ICE, submission and verification dates, reason for rejection and any further details. | Provision of the service for the agency page; legitimate interest in checking the company’s ICE. |
| Forwarding an enquiry | Name, phone number, optional email, message, relevant listing, identifier of the signed-in sender, submission and handling dates. | Provision of the service requested. |
| Answering a message sent from the Contact page | Name, email address, chosen subject, message, language of the page. | Legitimate interest in answering the request. |
| Enabling contact by phone or WhatsApp | Advertiser’s phone number and choice to enable WhatsApp. The “Show phone number” button displays the phone number; the WhatsApp link opens that service. | Provision of the service requested. The advertiser chooses to enable WhatsApp and the visitor chooses to open the link. |
| Saving your favourites | Identifiers of saved listings and, if you are signed in, the link to your account. | Provision of the service requested. |
| Translating listings and helping to write them | Title and description to identify the language and translate the listing; property features and notes provided for “Help me write”; moderation details intended for the advertiser. | Provision of the service for translations and for writing assistance, which you choose to use. |
| Sending service emails | Email address, language and information relating to your listing, your account, your agency’s verification or the enquiries you receive (the visitor’s name and message). | Provision of the service. |
| Handling reports | Reason, details, link to the account if you are signed in, the team member handling the report and its outcome. | Legitimate interest in preventing misleading listings and prohibited content. |
| Securing the site and limiting requests | IP address for request limits; browser, requested page and technical information for logs; token hashes for sessions. Logs do not retain your location or your searches. | Legitimate interest in protecting the site, accounts and users. |
| Counting listing views | Temporary fingerprint calculated from the IP address, browser and account to avoid double counting; counters per listing and per day without personal data. | Legitimate interest in counting listing views, without profiling. |
| Measuring the audience of the site and our campaigns | Title and address of pages viewed, without address parameters except campaign parameters; referring page or site; browser, operating system, device type, screen size, browser language and country; creation of a draft and first submission of a listing, with the transaction; contact with an advertiser, with the chosen method. The IP address is used to determine the country and calculate a hash, then is not retained. | Legitimate interest in understanding site traffic and the effectiveness of our campaigns, without profiling or advertising. |
| Producing market figures | Asking prices, features, city and property type. Aggregated results, including medians, contain no personal data. | Legitimate interest in producing market statistics. Results without personal data are not subject to Law 09-08. |
| Suggesting nearby cities with “Near me” | Location sent by your browser after you agree, used to suggest nearby cities and never recorded. | Consent when access to your location is requested. |
OpenRouter, in the United States, automatically translates every submitted listing into the site’s three other languages. This provider undertakes not to retain or reuse the texts. We do not send it your name, phone number or email. Listing text must not contain a phone number, email or link. Do not add personal data to the “Help me write” notes either.
The listing’s original language is displayed. You can edit the translations, but the original text prevails. Market figures are based on asking prices in listings over 90 days, not on sale prices in signed contracts. The “≈” sign indicates an approximate figure. These figures are neither an expert assessment nor a valuation: see the methodology.
Without an account, your favourites stay in your browser. When you sign in, they are merged with those in your account. If you do not allow location access, you can choose a city yourself. You can withdraw location permission in your browser settings.
3. What information must you provide?
Article 5 of Law 09-08 requires us to tell you which data is mandatory or optional, and what happens if you refuse to provide it. Without information required for a feature, we cannot carry out the relevant action.
- To create an account, you provide an email address, first name and password, or choose “Continue with Google”. If you register by email, your account is created and you are signed in straight away. You confirm your email address using the code or link sent by email. The site checks whether the domain of your address (the part after “@”) can receive emails. If it cannot, registration is refused. If the address already has an account, the site tells you on screen and gives you the option to sign in. No new account is created and no email is sent to the account holder.
- Until your email address is confirmed, any listing you submit remains “To confirm” and is not sent for review. You also cannot switch to an agency account. If your address is not confirmed within 30 days of account creation, the account is deleted along with its listings marked “To confirm”.
- To publish a listing, you must provide, among other things, a phone number, a title, a description, photos, the property’s features, the city and the neighbourhood. You can state an asking price or choose “Price on request”. We do not ask for the property’s exact address or GPS coordinates.
- To have an agency verified, you must provide its ICE. Without this information, the team cannot award the “Verified agency” badge. We never ask for a CIN.
- To send an enquiry, you provide your name, phone number and message. You can also provide your email address. The phone number is mandatory: without it, the enquiry cannot be sent.
- To write to the team through the Contact page, you must provide your name, email address, subject and message. This information is mandatory so that the team can reply to you. Without it, the message cannot be sent.
- You can report a listing without an account by stating the reason for the report.
- WhatsApp, “Near me”, “Help me write” and the “concluded thanks to MarocImmo” response are optional. You can use the other features without enabling them.
4. What can other users see?
The public can see your listing and your public advertiser profile. For a private individual, the first name is displayed. The phone number becomes visible when someone chooses “Show phone number”. If you enable WhatsApp, a link lets people contact you through that service.
For an agency, the public can see, among other things, its name, logo, city, address, registration date and, after verification, the “Verified agency” badge. The ICE is not public. The badge only indicates that the team has checked the company’s ICE: it is neither an accreditation nor a guarantee.
When you contact an advertiser through the form, we send them your contact details and message so they can handle your enquiry. No other advertiser receives them. The advertiser can view them in “Enquiries”, under the “Received” tab. An email notifies them of the new enquiry. It contains your name and message, but not your phone number or email address. Authorised staff and the relevant technical service providers may also access your contact details and message as part of their duties.
Published photos and logos are publicly accessible. Do not include identity documents or private information in them. Follow the listing rules. Listing photos and agency logos are saved without their metadata.
If you use WhatsApp, any further exchanges take place through that service and are subject to its own privacy rules. They are not recorded in “Enquiries”, under the “Received” tab.
5. Who receives your data?
The team accesses the data it needs to perform its duties. Service providers receive the data they need for their role. The recipients are listed below, in accordance with Article 5 of Law 09-08.
| Recipient | Role | Country |
|---|---|---|
| PRIVATE NETWORK and its authorised team | Managing accounts, listings, enquiries, moderation, security and your rights. | Morocco. |
| PulseHeberg SAS | Hosting the site, application, database and audience measurement tool. | France; servers in France. |
| Bunny.net — BunnyWay d.o.o. | Storing and delivering public photos and logos. | Slovenia; storage in Germany, replication in Spain and worldwide delivery. |
| Resend | Sending service emails: recipient’s address and email content. | American company; emails sent from Ireland (European Union). |
| OpenRouter and the model providers used by this service | Language identification, translation and writing assistance: listing texts, features, notes and moderation details intended for the advertiser. No name, phone number or email is sent; undertaking not to retain or reuse the texts. | OpenRouter: United States. |
| If you choose this sign-in method: authentication and loading the profile photo. Google acts as the controller for its own processing. MarocImmo receives the identifier, verified email, first name and photo URL. | United States. | |
| Other users | Viewing listings and public profiles; receipt of contact details and the message by the advertiser concerned. | Depending on where they are viewed or received. |
| Competent authorities | Disclosure of data in response to a lawful request. | Depending on the request and the applicable legal framework. |
If you use Google sign-in and a MarocImmo account already has the same verified email address, we link Google sign-in to that account. If the account’s email address has not yet been confirmed, Google sign-in confirms it. In this case, it deletes the saved password and phone number, replaces the account photo with your Google profile photo and closes any previous sessions for that account. That account’s listings marked “To confirm” remain in “My listings” until you review and submit them. Your browser loads the profile photo directly from Google.
6. Is any data transferred abroad?
Yes. PulseHeberg’s servers are in France. Bunny.net uses facilities in Slovenia, Germany and Spain to store and deliver images. These European Union countries are among those recognised by the CNDP as providing sufficient protection under Article 43 of Law 09-08.
Bunny.net’s network delivers public images worldwide, not only in the countries where they are stored. A public image may still be personal data.
OpenRouter involves transfers to the United States. Resend is an American company. Emails are sent from its servers in Ireland, but Resend can access them from the United States. If you choose Google sign-in, this also involves transfers to the United States. The United States is not on the list of countries recognised by the CNDP as providing sufficient protection.
For these transfers, two grounds must be assessed for each operation: the need to provide the requested service and contractual safeguards, under the conditions set out in Article 44 of Law 09-08. Using a foreign provider is not in itself enough to prove that need. Contractual safeguards must be submitted to the CNDP for authorisation where required by Article 44.
Transfers remain subject to the applicable formalities with the CNDP, in accordance with Articles 43 and 44 of Law 09-08 and Decree 2-09-165. Their description on this page constitutes neither authorisation nor confirmation that these formalities have been completed.
7. How long do we keep your data?
Article 3 of Law 09-08 requires us not to keep your personal data longer than necessary for the purpose for which it was collected. Here are the retention periods we apply.
| Data | Retention period |
|---|---|
| Account and profile data | For as long as the account exists; permanently erased 30 days after a deletion request. |
| Listings, including ended listings (expired, withdrawn, sold, rented), and their photos | For as long as the account exists (they remain in “My listings”); erased with the account. Aggregated market statistics (medians by city and type) contain no personal data and are retained. |
| Enquiries (name, phone number, email, message) | 12 months after they are sent, then erased; erased sooner if the recipient advertiser deletes their account. |
| Messages sent from the Contact page | Kept in the team’s mailbox for 12 months after the last exchange, then erased; nothing is kept on the site. |
| Reports | 2 years after they are handled; anonymous reports are not linked to anyone. |
| Moderation history and reasons for rejection or suspension | For as long as the account concerned exists. |
| Drafts | 7 days without an account; 6 months after the last edit with an account. |
| Sign-in session | 30 days, extended with use. |
| “Forgot password” links | Valid for one hour and for one use only; erased one day after they expire. |
| Unconfirmed accounts | Deleted 30 days after their creation, along with their listings marked “To confirm”. Email address confirmation codes and links: valid for 24 hours and for one use only; erased one day after they expire. |
| Listing views | A counter per listing and per day, without personal data, kept for 400 days; to avoid counting the same visit twice, a temporary fingerprint (IP address, browser, account), kept for 30 minutes in memory only. |
| Audience measurement (page views, campaigns and actions) | 6 months; older data is erased daily. |
| Server technical logs (IP address, browser, requested page, without location or searches) | 6 months. |
| Browser local storage | Until the person clears it; the phone number saved for publishing is erased on sign-out. |
You can request the deletion of your account in Settings. We immediately hide your listings. We permanently erase your account and profile data 30 days after your request. During this period, you can cancel the deletion by signing in again and then choosing “Keep my account”. We send you an email confirming the erasure date. If your account’s email address is not confirmed, we erase the account no later than 30 days after it was created.
Deleting your account does not immediately erase enquiries you have sent to other advertisers. They are retained for the period stated in the table. To exercise your rights regarding an enquiry you have sent, even if you do not have an account, contact us.
The storage periods in your browser are detailed in the section on cookies. They are separate from the retention periods on our servers.
8. How do we protect your data?
We put technical and organisational measures in place to protect your data. Articles 23 and 24 of Law 09-08 govern security, confidentiality and the use of processors.
- Your password is not stored in plain text. We keep a hash generated using a hash function, not a copy of the password that can be decrypted.
- Sessions use tokens. We store only hashes of these tokens in the database. We also do not store confirmation codes and links sent by email in plain text: we retain only their hashes.
- Connections to the site are encrypted.
- Listing photos are reoriented, resized and re-saved; agency logos are too. Their metadata, including any GPS coordinates, is removed.
- The team’s access is limited to the data necessary for its duties, particularly for management, moderation, security and the exercise of your rights.
- We limit the number of requests per IP address and apply technical checks to reduce abuse. Our logs do not retain your location or searches.
When we use a processor, its work must be governed by a contract or legal act. In particular, the contract or legal act must require the processor to follow our instructions and comply with security obligations. It does not replace the formalities required for a transfer abroad.
No technical measure guarantees that no incident will occur. This does not reduce our obligations or your right to hold us liable under the conditions provided by law. Keep your password confidential and contact us if you suspect unauthorised access.
9. What are your rights?
- Access: you can find out whether we process data about you. You can also obtain that data in an understandable form, subject to the conditions set out in Article 7 of Law 09-08.
- Rectification: you can request the correction or updating of inaccurate or incomplete data. Where applicable, you can also request the blocking or erasure of data whose processing does not comply with the law. Article 8 sets a time limit of 10 clear days for these operations.
- Objection: you can object to processing on legitimate grounds. You can also object, at no cost, to your data being used for direct marketing, in accordance with Article 9. To opt out of audience measurement in your browser, use the “Do not measure me on this device” button in section 11.
In your Profile, you can change your first name, phone number, WhatsApp preference and agency information. You can request deletion of your account in Settings.
Until your email address is confirmed, you can change it in Settings using “Change the address”. To change an email address that has already been confirmed, write to contact@marocimmo.com or use the Contact page. You can also use either option to obtain a copy of your data, take action concerning an enquiry sent without an account or exercise your right to object. State what you are requesting and provide the information needed to locate the relevant data.
If necessary, we verify your identity, particularly using the email address linked to the account. We never require a CIN online.
Access must be provided without undue delay, subject to the conditions set out in Article 7. The time limit of 10 clear days set out in Article 8 applies to rectification and the other operations covered by that article. It is not a general time limit for every request. If a request is refused, you can refer the matter to the CNDP.
11. Audience measurement
To understand site traffic and the effectiveness of our campaigns, we use Umami, free and open-source audience measurement software. We host it on our server at PulseHeberg in France, and it does not send measurement data to any third party. We do not use any advertising pixels.
- No cookies: measurement does not write anything to your device. Only your choice to opt out is kept there, if you request it.
- Data: the title and address of pages viewed, without address parameters except campaign parameters (utm_source, utm_campaign…); the page or site you came from; your browser, your operating system, your device type and screen size, your browser language and your country, never your region or city.
- IP address: it is used to determine your country and calculate a hash, together with your browser and a key that changes each month. It is not retained, and the hash cannot be used to link your visits from one month to the next.
- Actions: creation of a draft and first submission of a listing, with the transaction (sale or rental), and contact with an advertiser, with the chosen method (call, WhatsApp or message). No name, email, phone number, message content or account identifier.
- Retention: 6 months; older data is erased daily.
- Do Not Track: if your browser sends this signal, nothing is measured.
This measurement, without profiling or advertising, relies on our legitimate interest (Article 4 of Law 09-08). CNDP Deliberation D-939-2025 exempts it from consent. You can nevertheless opt out.
To avoid being measured on this device, use the button below: your browser keeps this choice in its local storage (umami.disabled) and no longer sends anything for measurement. “Re-enable measurement” cancels this choice. If you clear the site data in your browser, measurement resumes.
You are not being measured on this device.
12. Use by minors
You must be 18 or over to create an account, publish a listing or contact an advertiser. This is the legal age of majority under Article 209 of the Family Code. Anyone may browse the site.
If you believe that a minor has provided data through a feature restricted to adults, contact us so we can look into it.
13. Service emails and direct marketing
We only send service emails. These notify you when your listing is received, published, rejected, changed or removed. For a listing marked “To confirm”, the receipt email is sent when the listing is submitted for review. We also remind you when a property becomes available and notify you of any new enquiry received. We send you a code and link to confirm your email address when you register, after you select “Resend the code” or “Change the address”. If your address is still unconfirmed, we send reminders 24 hours and 7 days after the account is created. We also send a link to choose a new password, a password change alert and confirmation of your request to delete your account. Other emails concern account suspension or reactivation, agency verification or ICE rejection. These emails contain no tracking pixels. We send no more than 3 confirmation codes per hour to the same address, excluding reminders.
We do not send newsletters or direct marketing emails. If we ever offer direct marketing by email, we will obtain your prior consent in accordance with Article 10 of Law 09-08. Each email will then include a simple, free way to unsubscribe.
14. Complaints to the CNDP
You can contact us if you have any issues concerning your data. You can also submit a complaint directly to the National Commission for the Control of Personal Data Protection (CNDP) using its online complaint form.
15. Updates to this policy
Version dated 4 October 2026. We may update this page to reflect changes to the service or the legal framework. The version date helps identify these updates.
Before changing how we use your data, we will provide you with the information required by Article 5 of Law 09-08. We will obtain your consent where required by law. Publishing a new version does not constitute consent and does not retrospectively authorise processing.
The French version prevails; the other versions are translations. This rule does not reduce your rights. If there is any doubt about a clause applicable to a consumer, the interpretation most favourable to the consumer prevails, in accordance with Article 9 of Law 31-08.