Privacy Policy

1. Data Controller

The data controller for personal data processing is Ayoub Sedqy, sole proprietor, reachable at support@baghidar.ma. Baghi Dar is a platform published and operated in Morocco, hosted on a Hostinger Virtual Private Server (VPS) located in Lithuania.

2. Data Collected

We collect the following categories of data:

• Registration data: full name, email address, password (encrypted with bcrypt), phone number. • Profile data: profile photo, city, account type (renter, landlord, samsar, agency), preferred language. • Listing data: title, description, price, property photos, location (city, district, GPS coordinates), property characteristics (type, rooms, bathrooms, area). • Browsing data: IP address, pages visited, visit duration, browser type, operating system, referrer. • Payment data: subscription history, amounts paid, bank transfer references (full bank details are never stored on our servers). • Communication data: messages exchanged via the platform, contact form content.

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Connection: enabling the publication of property listings and connecting landlords with renters. • Identity verification: sending OTP codes via WhatsApp (via Meta) during registration to verify phone number uniqueness. • Account management: creation, authentication, and management of your user account. • Notifications: sending transactional emails (account confirmation, listing alerts, subscription updates, boost notifications). • Service improvement: analyzing platform usage to improve the user experience. • Security: detecting and preventing fraud, abuse, and violations of the terms of use. • Legal obligations: retaining data as required by Moroccan law.

4. Legal Basis for Processing

In accordance with Moroccan Law No. 09-08, the processing of your data is based on the following legal bases:

• Consent: you give your explicit consent when creating an account and for receiving marketing communications. • Contract performance: processing is necessary for the performance of the terms of use you accept by using the platform. • Legitimate interest: we process certain data to improve our services, ensure platform security, and prevent fraud. • Legal obligation: we process and retain certain data to comply with applicable Moroccan laws.

5. Data Recipients

We never sell your personal data. We share certain data with the following processors, limited to what is necessary for the performance of their services:

• Cloudinary (USA): hosting and optimization of listing photos. Transfer governed by standard contractual clauses. • Google LLC (USA): audience analytics service (Google Analytics) and OAuth authentication service. • Meta Platforms Inc. (USA): sending OTP codes via WhatsApp and tracking pixel to measure advertising campaign effectiveness. • Hostinger (Lithuania): hosting of the virtual private server and PostgreSQL database. • Sentry (USA): application error and performance monitoring.

All processors are bound by data processing agreements ensuring a level of protection compliant with Law 09-08. For transfers outside Morocco, we ensure that appropriate safeguards are in place.

6. Retention Period

We retain your personal data for the following periods:

• Active account data: for the entire duration of account activity, then archived for 1 year after the last activity. • After account deletion: your personal data is retained for 30 days (withdrawal period), then permanently deleted from our systems. • Connection and browsing logs: retained for 6 months for security and diagnostic purposes. • Payment data: retained for the legal period required by Moroccan tax legislation. • Anonymized data: aggregated and anonymized data may be retained indefinitely for statistical purposes.

7. User Rights (Law No. 09-08)

In accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, you have the following rights:

• Right of access (Art. 7): obtain confirmation that your data is being processed and access all your personal data held by Baghi Dar. • Right of rectification (Art. 8): have any inaccurate or incomplete data concerning you corrected. • Right to object (Art. 9): object to the processing of your data on legitimate grounds, particularly for marketing purposes. • Right to erasure: request the deletion of your personal data under the conditions provided by law. • Right to portability: receive your data in a structured and commonly used format, or request its transfer to another data controller. • Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at support@baghidar.ma. We will respond within a maximum of 30 days. No fees are charged for exercising these rights, except in cases of manifestly unfounded or excessive requests.

8. Cookies and Trackers

The Baghi Dar platform uses the following cookies:

• Session cookies (NextAuth.js): mandatory session cookie to maintain your connection to the platform. Duration: browser session. Legal basis: legitimate interest (essential service operation). • Language cookie: remembers your language preference (French or English). Duration: 1 year. • Google Analytics (measurement ID: G-WD8HJLNPBH): analytical cookies to measure platform audience and usage. Duration: 13 months maximum. You can disable Google Analytics via the official opt-out module or by configuring your browser.

On your first visit, a consent banner allows you to accept or decline non-essential cookies. Cookies strictly necessary for the site's operation do not require your prior consent.

9. Security Measures

We implement the following technical and organizational measures to protect your data:

• Password encryption: all passwords are hashed with the bcrypt algorithm (randomly generated salt, cost factor 10). No plain-text passwords are ever stored. • HTTPS: all communications between your browser and our servers are encrypted via TLS. HSTS is enabled. • Restricted access: access to personal data is limited to the sole data controller (Ayoub Sedqy). No employees or third parties have access to the production database. • Regular updates: the server and software dependencies are kept up to date to patch security vulnerabilities. • Backups: daily database backups are performed and stored securely.

In the event of a personal data breach presenting a high risk to your rights and freedoms, we will inform you as soon as possible, in accordance with Article 11 of Law 09-08.

10. Contact and CNDP Complaints

For any questions regarding this privacy policy or to exercise your rights, contact the data controller:

• Email: support@baghidar.ma • WhatsApp: +212 708 027 145 • Contact form: available on the site's contact page

If you believe your rights have not been respected, you have the right to file a complaint with the National Commission for the Control of Personal Data Protection (CNDP), the Moroccan supervisory authority:

• Website: www.cndp.ma • Address: Avenue Mohammed V, Rabat, Morocco

We fully cooperate with the CNDP in any investigation or complaint.

11. Policy Changes

Baghi Dar reserves the right to modify this privacy policy at any time to reflect legal, regulatory, or technical developments. Users will be informed of any significant changes:

• By email at the address associated with their account, at least 14 days before the changes take effect. • By a visible notification on the platform upon the first login following the modification.

Continued use of the platform after the changes take effect constitutes acceptance of the new policy. We encourage you to review this page regularly. Last updated: May 2026.