1. Why this concerns you
Under Law 09-08, the establishment offering the loyalty card is the data controller: you decide the program exists, and your customers' data is collected in your name. KartaPass acts as your processor under the Data Processing Agreement. The CNDP filing is therefore yours to make — one declaration per establishment, before the program starts. Processing without a declaration is punishable by a fine of 10,000 to 100,000 MAD (doubled for companies).
2. What to file
- A prior declaration of your customer-management processing (form F-211, or the simplified F-214 where your practice fits a CNDP model decision) — filed on the CNDP's online portal cndp-forms.ma;
- A foreign-transfer notification (form F-118), filed with the declaration: delivering a pass to Apple Wallet or Google Wallet sends pass data to Apple Inc. or Google LLC in the United States. The transfer rests on your customer's express consent, collected for you on the enrollment form.
The CNDP issues a récépissé; keep its number — it belongs in your customer notices.
3. The facts the forms ask about your processor
- Processor (sous-traitant): [COMPANY NAME], registered in the [CITY] Commercial Register under No. [RC], ICE [ICE], registered office at [ADDRESS], contact [EMAIL];
- Purpose of the processing: managing a customer loyalty program — enrollment, digital card delivery to Apple Wallet / Google Wallet, visit and points tracking, and card messages;
- Data collected: first name, last name, phone number, optional email and birthday; card and points data; visit history (date, points, amount paid, optional note, point of sale); consent records;
- Recipients: your establishment (your own customers only), Apple Inc. or Google LLC (pass delivery, United States), the hosting provider (European Union), the email provider (transactional emails);
- Retention: card and identity data for the life of the card and until erasure; visit history 24 months; technical wallet records 90 days to 6 months; technical logs 30 days;
- Security measures: encrypted transport (HTTPS/TLS), sensitive secrets encrypted at rest, hashed passwords, role-based access, per-establishment isolation, forgery-protected scan codes;
- Data subject rights: access, correction, objection and erasure honoured via your dashboard (on-the-spot erasure) or [EMAIL].
4. What the platform already enforces for you
- Consent first: no card is created without the customer ticking the privacy consent on the enrollment form — the moment of acceptance is recorded;
- Marketing opt-in (art. 10): promotional pushes only ever reach customers who separately opted in, and they can withdraw at any time;
- Erasure on demand: deleting a customer removes their personal details immediately while keeping your anonymous statistics;
- Automatic retention: visit history and technical records are purged on the schedule above, without any action on your part.
5. Where to file
Declarations and transfer requests are filed on the CNDP's portal: www.cndp-forms.ma. Forms, model decisions and guidance: www.cndp.ma. The CNDP acknowledges declarations with a récépissé and answers transfer requests within two months.
This kit is practical guidance to help you file — it is not legal advice. For your specific situation, consult a lawyer or the CNDP.
6. Questions
We are happy to help you fill the forms: [EMAIL].
Data Processing Agreement · Privacy Policy · Terms of Use & Sale