This policy explains how to collect, use, preserve, share and protect data when visiting the site, nominating, registering, studying, or requesting a document or support. The party responsible for the processing and the contracting party are specified in the legal notice, the collection page and the individual contract depending on the process.

The Academy and the institution, each according to its role, are committed to:

1. A clear and legitimate purpose;
2. Collect the necessary amount;
3. Accuracy and up-to-date;
4. A specific retention period;
5. Restricted access permissions;
6. Transparency of rights and recipients;
7. Security appropriate to risks;
8. Document accountability and choices.

It may include, as needed:

• Identity and contact information;
• Age and guardian’s consent if necessary;
• Candidacy file, certificates and language;
• Registration, programme, attendance, actions and results;
• performance and invoice, without storing the full card data if processed by a competent performance provider;
• Account and device data and security logs;
• Correspondence, complaints and support;
• Access needs and limited health data that a person voluntarily provides to request an arrangement;
• Cookie and marketing choices;
• Records of document issuance and verification.

It comes directly from the person, his guardian or representative, his activity on the platform, a payment party on his behalf, a document issuing party requesting verification, or a technical service provider within a declared purpose.

The data is used for:

1. Responding to inquiries and managing the nomination;
2. Verification of eligibility and documents;
3. Contract formation, registration and performance;
4. Provide education, evaluation and support;
5. Issuance and verification of documents;
6. Adequate and safety arrangements;
7. Account and platform protection and fraud prevention;
8. Complaints, disputes, accounting and legal obligations;
9. Improvement and quality with appropriate statistics;
10. Marketing where there is consent or a legitimate basis that can be withdrawn.

Do not use the data for a new, incompatible purpose without notification, consent or an appropriate basis.

The collection page determines, depending on the process and applicable law, whether processing is necessary for pre-contract measures or performance, for a legal obligation, for a proportionate legitimate interest, to protect a vital interest, or based on retractable consent.

It is collected to a minimum, with strict guarantees, and the trainee is not required to upload a complete medical file. Health need data is used to implement the appropriate arrangement and is not disclosed to the teacher except to the extent necessary.

Age and eligibility are taken into account in POL-07. The intervention of the guardian or legal representative is requested when necessary, with a simplified and appropriate explanation of the treatment, and to prevent inappropriate direct marketing to the minor.

The data may reach the necessary extent to:

• Authorized employees of the academy or institution;
• The Canadian entity or the African entity within a specific program or document issuance;
• Training service provider;
• Hosting, platform, performance, correspondence and verification providers;
• Advisers or authorities when there is a legitimate duty or claim.

Personal data is not sold, and the receiving party is not granted broader powers than intended.

The Service Provider is subject to a contract specifying instructions, confidentiality, security, assistance in rights, incidents, deletion or return. Reduce the need and risks before enabling the data.

Data may be hosted or processed outside of Morocco, including Canada or the country of the technical provider. Before transport, the destination, purpose, categories and guarantees are determined, the required permits, licenses or transport applications are completed with the CNDP, and the original processing must be authorized or authorized where applicable.

Varies depending on purpose:

• Incomplete request: a short period specified and then deleted or anonymized;
• Contract and invoices: accounting and legal period;
• Academic record and documents: the period necessary to prove study and verification;
• Security records: a period proportional to investigation and protection;
• Marketing: until approval is withdrawn or the purpose ends;
• Complaint or dispute: until it ends and the claim period expires.

The internal retention schedule shows the exact duration and who is responsible for the deletion.

Measures such as proper encryption, multi-factor verification for sensitive accounts, backup, segregation, updating, logging and auditing, and incident management are in place. There is no way to guarantee complete absence of risk.

Depending on the applicable law, you may request:

• Information and access;
• Data correction;
• Object to certain processing;
• Withdraw consent without prejudice to previous processing;
• Delete what is not necessary to keep;
• Restricting or interpreting an influential decision;
• Submit a complaint to the academy or the competent authority. Requesting deletion does not mean erasing an academic or accounting record or document proof that must be preserved; It explains what will be deleted, what will be kept, and why.

The request is sent to [email protected] with the title “Data Protection Request”. Only what is necessary for verification is requested, and is returned within the legal deadline. If implementation is not possible, in whole or in part, the reason and method of complaint shall be stated.

A final decision with a significant academic, disciplinary, or financial impact shall not be issued solely relying on automated processing without an appropriate basis and guarantees, including informing the person and allowing for human intervention and objection.

Applies POL-21 to traces and POL-22 to messages. Acceptance of unnecessary files or marketing is not required to complete registration, unless the service itself is optional and based on it in a clear and legitimate way.

The incident is contained, evaluated and documented, and the person and the competent authority are informed when the law requires it or the risk justifies it. POL-23 and the applicable internal control apply.

The version number and date appear. Notice is given when a material change in purpose, entities or rights occurs, and the old consent is not used for a new, incompatible purpose.

ASMH Africa
59 Rue Zarqtouni, Les Fleurs Residence, 7th floor, Apartment 20, Casablanca, Morocco
[email protected] — https://www.asmhafrica.com

Concerned persons may resort to the National Commission for Monitoring the Protection of Personal Data (CNDP) according to its jurisdiction.

Instructive references

• Moroccan Law No. 09.08
• CNDP Rulers
• Transferring data abroad to the CNDP
• Canadian PIPEDA Principles