Three legal frameworks govern syndic software in Morocco: Law 09-08 on data protection, Law 18-00 on co-ownership and Decree 2.23.700 on accounting. This page shows, point by point and article by article, how Kassaba complies with each. No vague "compliant with applicable regulations": claims you can check.
Last updated: June 10, 2026. This page is updated at every step of the CNDP filing.
CNDP file status as of June 10, 2026: standard F211 declaration and four F118 requests finalized, deposit with the CNDP in progress. The deposit date, file number and then the receipt will be published here upon reception. We prefer publishing an exact status over a vague formula.
Law 09-08 · CNDP
Law 18-00
Decree 2.23.700
Kassaba processes only the data necessary for the lawful management of a co-ownership: identity, contact details, lot and tantiemes, financial position, co-ownership documents. The syndic remains the data controller for their co-ownership; Kassaba acts as a technical processor within the meaning of Law 09-08. A Data Processing Agreement (DPA) is available on request.
| Subcontractor | Role | Country | Why this provider | Legal basis |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting | Germany | ISO 27001 certified, high availability, German/EU data protection standards | Adequate country (delib. 236-2015) |
| Google Ireland Ltd | Transactional emails | Ireland | Reliable email delivery, data region configured in Europe | Adequate country (delib. 236-2015) |
| Apple Inc. (APNs) | iOS push notifications | United States | Technical necessity: the only channel Apple allows for iOS notifications | Standard Contractual Clauses (SCC) |
| Google LLC (FCM) | Android push notifications | United States | Technical necessity: the standard channel for Android notifications | Standard Contractual Clauses (SCC) |
Push notifications never contain personal data: a generic message is sent, and details are shown only after opening the authenticated application.
A document written to be handed as-is to co-owners, conseils syndicaux and general assemblies: data processed, hosting, subcontractors, security, rights and retention periods, with exact legal references.
Any vendor can write "compliant with applicable regulations". A syndic managing other people's money deserves better: precise, sourced and therefore checkable claims. If we cite an article, you can open it. If we state a threshold, it comes from Bulletin Officiel No. 7391. If the CNDP file is in progress, we write exactly that, and we will publish the receipt number when it arrives.
It is also a long-term commitment: every change in data processing triggers an update of the CNDP file, and every syndic client is informed of any change of subcontractor.
Kassaba's CNDP file (one standard F211 declaration and four F118 requests for transfers to technical subcontractors) is finalized and being deposited. This page and the compliance memorandum will be updated with the deposit date and file number, then with the receipt as soon as it arrives. We publish the real status rather than a vague promise: that is the principle of this page.
In Germany, with Hetzner Online GmbH, one of Europe's largest hosting providers: founded in 1997, hundreds of thousands of servers, ISO 27001 certified data centers. Co-owners' data therefore lives under German and European data protection law (GDPR), among the strictest in the world, in a country recognized by the CNDP as ensuring an adequate level of protection (Deliberation No. 236-2015 of December 18, 2015). Communications are encrypted with TLS 1.2 minimum and disks with AES-256: the same standards used in online banking.
Kassaba processes no sensitive data within the meaning of Article 12 of Law 09-08: no health data, opinions, beliefs or convictions records. Kassaba does not collect CIN numbers, never resells data, shows no advertising and shares nothing with third parties other than the declared technical subcontractors.
Every legal claim Kassaba makes cites the exact article behind it: the three voting majorities (Articles 20, 21, 22), quorum counted in people (Article 18), the syndic 2-year term (Article 19), the 5-year prescription running from the date the AG approved the charges concerned (Article 43). On the accounting side, Kassaba generates the 12 regulatory annexes of Decree 2.23.700 for the exact tier of the co-ownership (thresholds of 200,000 and 500,000 MAD). Every number can be checked against the Bulletin Officiel.
Yes. A DPA formalizing the division of roles (the syndic remains the data controller, Kassaba acts as a technical processor within the meaning of Law 09-08) is available on request at [email protected].
Decree 2.23.700 guide
Tiers, required annexes and key dates of the accounting decree.
Charges collection
The 5-step workflow anchored on Law 18-00, from penalty to payment order.
Evaluate syndic software
7 verifiable criteria to compare solutions, compliance included.
In Morocco 2026, syndic charges expire 5 years after approval by the General Assembly (Art. 43 Law 18-00). How to calculate and interrupt.
The 12 accounting annexes of Décret 2.23.700 broken down one by one: what each contains, which tier it applies to, and practical tips for Moroccan syndics.
Charges, contributions, budgets, accounting annexes: everything a property manager in Morocco needs to know to keep proper accounts in 2026.
Law 18-00 explained article by article: quorum rules (Art. 18), 3 voting majorities (Art. 20-22), syndic 2-year term (Art. 19), mandatory bank account (Art. 26). With Law 106-12 amendments.
Questions about compliance?
Write to [email protected]: memorandum, DPA, or any question from your co-owners. Kassaba is free during the beta, no credit card required.
