Privacy Policy

Introduction and Scope

This Privacy Policy explains how Kassaba collects, uses, stores, and protects your personal information when you use our syndic management platform, including the web dashboard, resident portal, and mobile application. By using Kassaba, you agree to the practices described in this policy.

Who We Are

Kassaba is a property management platform operated in Morocco. We act as the data controller for the personal information processed through our services. For residents, your building's syndic may also act as a joint controller for data related to your residence and payment obligations.

Data We Collect

We collect information necessary to provide property management services:

• Identity information: name and contact details (phone number, email address)
• Residence information: building name, unit number, and address
• Financial information: charge amounts, payment status, and payment history (we do not process or store payment card details)
• Building data: common expenses, budgets, and expense allocations
• Communication preferences: notification settings and language preferences
• Audit logs: records of account activity for compliance and dispute resolution

How and Why We Use Your Data

We process your personal information for the following purposes:

• Managing resident accounts and building records
• Tracking charges, payments, and outstanding balances
• Sending payment reminders and building notifications
• Providing expense transparency to residents
• Improving our services and ensuring platform security

Legal Basis for Processing

We process your data based on:

• Contract performance: Processing necessary to provide our services to syndics and residents
• Legitimate interests: Improving our platform, preventing fraud, and ensuring security
• Legal obligations: Compliance with Moroccan accounting and data protection regulations

Data Sharing and Sub-processors

We may share your information with:

• Your building's syndic or property manager, who requires access to manage your residence
• Technical service providers who help us operate our platform (hosting, notifications)
• Legal authorities when required by law or to protect our rights

We do not sell your personal data to third parties. All service providers are bound by confidentiality obligations.

For the current named list of technical sub-processors, including their role and location, see our Kassaba Compliance page. Kassaba Compliance

Notifications and Communications

Depending on your role and preferences, we may contact you via:

• Push notifications through our mobile app
• Email for important updates and reminders
• SMS for authentication codes (OTP). Other SMS notifications such as payment reminders are in development and will require your opt-in before activation.

You can manage your notification preferences in your account settings. Some service-related communications are mandatory and cannot be disabled.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Financial records are retained for the legally required period in Morocco (5 years from the date of their closure for accounting records, per Article 11 of Annexe 1 of Décret 2.23.700). Account deletion is processed manually at your request, through your syndic or our support team at [email protected]. Personal identifiers (name, contact information, login credentials, preferences) are removed from active records at that time. Some transaction history is retained in the building's accounting records for the legally required period described above, as Décret 2.23.700 prohibits gaps in accounting records (Annexe 2 Article 4). After that period, further restriction or deletion can be requested.

Audit and security logs: retained for 12 months after recording, for platform security and incident resolution.

Communication data (support emails, notifications): retained for the duration of the contractual relationship plus a reasonable period for the resolution of potential disputes.

Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit and at rest
• Secure cloud infrastructure with access controls
• Regular security assessments and updates
• Employee training on data protection practices

Your Rights

Under Moroccan data protection law, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete information
• Deletion: Request removal of your data (subject to legal retention requirements)
• Objection: Object to certain processing activities
• Portability: Receive your data in a structured format
• Complaint: file a complaint with Morocco's National Commission for the Control of Personal Data Protection (CNDP) if you believe your rights are not respected. Contact details at cndp.ma.

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

Cookies and Analytics

Our marketing website (kassaba.ma) uses analytics cookies to understand visitor behavior and improve our content. The Kassaba application itself does not use tracking cookies. You can manage cookie preferences through your browser settings.

The analytics tool used on kassaba.ma is Google Analytics 4 (measurement ID G-NRBNX6JXNL). You can opt out of this tracking via Google's official browser extension (tools.google.com/dlpage/gaoptout) or via your browser settings. A more formal consent mechanism is being put in place.

International Data Transfers

Data is hosted by Hetzner Online GmbH in Germany (European Union). This transfer to Germany is based on CNDP deliberation no. 236-2015 of December 18, 2015, which recognizes Germany as a country ensuring an adequate level of personal data protection. The detailed list of sub-processors and hosting infrastructure is published on the Kassaba Compliance page.

Service Notice

Kassaba is continuously evolving. Features may change based on user feedback. We will notify users of significant changes that affect data processing. Your continued use of the service constitutes acceptance of any updates.

Contact Information

For questions about this Privacy Policy or to exercise your data rights, contact us:

Email: [email protected]

Website: https://kassaba.ma