Personal data protection

1. Legal framework

This processing of personal data is governed by Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data (enacted by Dahir No. 1-09-15 of 18 February 2009, published in Official Bulletin No. 5744 of 5 March 2009) and its implementing Decree No. 2-09-165, under the supervision of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). This page complements the privacy policy by detailing the points specifically required by this law.

2. Data controller

The data controller is VBM (VolleyBall Maroc), who can be reached at [email protected] for any question about the processing of your personal data.

3. Purposes of processing

• Creating, securing and managing your user account.
• Displaying and managing the official competitions and amateur tournaments you are linked to (participation, organisation, team approval).
• Linking your account, at your request and after approval by an administrator, to an existing player, staff or referee profile.
• Sending you notifications if you have turned them on in the mobile app.
• Measuring site traffic anonymously.
• When advertising is enabled and according to your choices, funding public content through ads, measuring their delivery, fighting fraud and, with your consent where required, personalising those ads.

VBM does not sell your data. Advertising processing is kept separate from the processing needed for your account and limited to the public surfaces intended for it.

4. Legal basis for processing

Processing is based on your express consent, collected when you create your account (email/password or Google sign-in), and on the performance of the service you use (management of the competitions and amateur tournaments you take part in). Advertising consent, where required, is collected separately and can be refused or withdrawn without preventing access to your account or to VBM's essential features.

5. Recipients of the data

Your data is only accessible to authorised VBM staff (administrators, and organisers for the data strictly needed to manage their tournament) and to the following technical providers, acting as processors:

• Google — Google sign-in, Firebase, then AdSense or AdMob when advertising is enabled and allowed by the applicable privacy choices.
• Vercel — website hosting and anonymous traffic statistics.
• Oracle Cloud Infrastructure — hosting of the application server and database.
• Capconnect — sending transactional emails (email address verification).

6. Data transfers outside Morocco

Some of these providers (notably Vercel and Google) operate infrastructure located outside Moroccan territory. In accordance with Article 43 of Law 09-08, such a transfer is only possible to a country ensuring an adequate level of protection, or in the exceptional cases provided for by law (in particular the performance of a contract between you and VBM for processing strictly necessary to the service, or consent where it is the appropriate basis). Advertising-related transfers only take place within the framework described in the privacy policy and the choices presented by the consent management platform.

7. Retention period

Your data is kept as long as your account is active. If you delete your account (see Account deletion), your personal data is anonymised; the sports results you took part in may be kept in anonymised form, as they are part of the public history of competitions.

8. Your rights as a data subject

In accordance with Articles 7, 8 and 9 of Law 09-08, you have the following rights over your personal data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification: correct inaccurate or incomplete data — directly from your profile for most fields.
• Right to object: object, on legitimate grounds, to the processing of your data.

You can exercise these rights by writing to us at [email protected], stating your name and the email address linked to your account. We reply within a reasonable time and, in any event, in line with the requirements of Law 09-08.

9. Data security

Passwords are hashed (never stored in plain text), exchanges between your browser or the app and our servers are encrypted (HTTPS), and access to administration data is limited to accounts with an explicit role.

10. Complaint to the CNDP

If you believe the processing of your data does not comply with Law 09-08, you may, after contacting us, file a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), the Moroccan supervisory authority for personal data protection.

11. Changes

This page may change along with the platform and regulations; the last updated date at the top of the page shows the version in force.