1. Parties
This Data Processing Agreement ("DPA") forms part of the agreement between the organization using Morocco Business Gateway ("Customer", acting as data controller for the personal data described below) and MT Performance, RC 528651, ICE 002993731000042, registered at 131, boulevard d'Alsace, 6ᵉ étage, bureau n° 18, 20250 Casablanca, Maroc ("we", "us", acting as data processor), collectively the "Parties".
2. Subject matter and duration
We process personal data on Customer's behalf solely to provide the Morocco Business Gateway platform (business matchmaking, verification, messaging, deal and billing management) for as long as Customer maintains an active account, plus any period required by our legal and accounting retention obligations thereafter.
3. Nature and purpose of processing
We collect, store, transmit, and (where the Customer initiates it) share with a matched counterpart the personal data Customer enters into the platform, strictly to operate the matchmaking, verification, messaging, and transaction features Customer uses. We do not process this data for any purpose of our own, such as advertising.
4. Categories of data subjects and data
- Data subjects: Customer's authorized users, and the individual contacts Customer identifies on its company/organization profile (e.g. a legal representative or a business contact).
- Data categories: names, business contact details (email, phone), professional role/position, identity and registration documents uploaded for verification (e.g. national ID, business registration certificate), and the content of messages/deal records Customer's users create on the platform.
We do not intentionally collect any special category of data beyond what is described above.
5. Our obligations
- We process personal data only on Customer's documented instructions (namely, operating the platform as configured and used by Customer), unless required otherwise by law.
- We ensure anyone we authorize to process the data is bound by confidentiality.
- We implement the technical and organizational security measures described in our Security & Compliance Overview, appropriate to the risk.
- We assist Customer, at Customer's request, in responding to data subject requests (access, rectification, deletion) concerning data Customer controls on the platform.
6. Sub-processors
Customer authorizes us to engage the sub-processors listed on our Security & Compliance Overview page, each bound by a written agreement imposing data protection obligations no less protective than those in this DPA. We will update that list if it changes and, on request, notify Customer of a new sub-processor before it begins processing Customer data.
7. Personal data breach notification
We will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data, and provide the information reasonably available to us to help Customer meet its own notification obligations.
8. International transfers
Some of our sub-processors may process data outside Morocco. Any such transfer is made under the safeguards described in our Privacy Policy and in compliance with Moroccan law 09-08.
9. Audit
On reasonable prior written notice and no more than once per year (absent a specific incident), we will make available the information reasonably necessary to demonstrate compliance with this DPA and answer a reasonable written security questionnaire.
10. Deletion or return of data
On termination of Customer's account, we will delete or anonymize Customer's personal data within a commercially reasonable period, except to the extent we are required by law to retain it, consistent with the retention terms in our Privacy Policy.
11. Liability and governing law
Liability under this DPA follows the liability terms of the underlying agreement between the Parties (our Terms of Use). This DPA is governed by the laws of the Kingdom of Morocco.
12. Contact
Questions about this DPA, or a request for a countersigned copy, can be sent to contact@moroccobusinessgateway.com.