Data protection
Privacy policy.
This page describes the processing tied to this website: the contact and diagnostic form, demo booking, DigiPulse, sales follow-up, audience measurement, advertising measurement and technical logs. The guarantees covering the platforms institutions use (BrightStep, EasyClass, AlmaHub) are described on the Trust & security page.
Last updated · September 2026
01
Data controller
The controller for the processing described here is GEERD, a company under Moroccan law, Technopark, Casablanca, +212 6 29 08 35 44, contact@geerd.ma. For any question about your data, write to that address with “Personal data” in the subject line.
The website is hosted and served by Cloudflare, Inc. The data held in the GEERD platforms used by institutions is hosted separately, by OVHcloud, in France; it is outside the scope of this page.
02
Legal framework and CNDP filing
The processing carried out through this website is subject to Moroccan law No. 09-08 on the protection of individuals with regard to the processing of personal data and its implementing texts, under the supervision of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). Where the visitor is in the European Union, the General Data Protection Regulation (GDPR) also applies; GEERD aligns all of its processing on both texts.
CNDP filing: the processing carried out on this site has been declared by GEERD and the declaration is being updated with the CNDP to reflect the processors and purposes described below, including the corresponding transfer authorisation request. Receipt numbers will be published on this page as soon as they are issued; no number is printed here before it exists.
Law 09-08 · CNDP · GDPR
03
The processing, purpose by purpose
For each purpose: the data concerned, the basis that permits the processing, and the retention period. There is no newsletter to date; if GEERD starts one it will have its own sign-up, its own consent and an update to this page.
3.1 Contact and diagnostic requests
Data: name, role, institution and institution type, work e-mail, phone number if you provide one, your message, the subject of the request, where your visit came from (campaign parameters) and the date. Basis: pre-contractual measures taken at your request (you write to us, we answer). Retention: three years after the last exchange, then deletion.
3.2 Demo booking
Data: name, e-mail, chosen slot, the platform you are interested in and your answers to the booking questions, processed by Cal.com, Inc. on our behalf. The calendar is loaded when the Demo and Thank-you pages open, and Cal.com then receives your IP address and your browser’s technical details; a note under the calendar says so, and no other page of the site loads anything from Cal.com. Basis: pre-contractual measures taken at your request. Retention: the appointment and its notes follow the prospect record (three years after the last exchange); Cal.com keeps the booking under its own policy.
3.3 DigiPulse
Data: your answers to the thirty questions, the resulting score, your e-mail and the institution details you provide to receive the report. The draft stays in your browser until you ask for the report. Basis: your consent, given when you request the report; if you then request a diagnostic, the score is attached to that request as a pre-contractual measure. Retention: three years after the last exchange, like the prospect record the report is attached to.
3.4 Sales follow-up and client relationship
Data: the details and the content of the exchanges arising from the three purposes above, recorded in GEERD’s customer relationship tool (Twenty) with the institution as the account, plus, for client institutions, the data needed to perform the contract. Basis: GEERD’s legitimate interest in following up a professional contact you initiated (you may object at any time); performance of the contract for clients. Retention: prospects, three years after the last exchange; clients, the duration of the contract then five years under accounting obligations and the commercial limitation period.
3.5 Audience measurement
Two measures, for two different questions. The first, OpenPanel, runs on a server operated by GEERD and works without cookies. Data: pages viewed, the page you came from, country, device type and browser, no cookie, no identifier kept on your device, and no matching against your name or e-mail. Basis: GEERD’s legitimate interest in knowing how many people visit the site and which pages they read; since nothing is written to your device, your consent is not required for this measure, and you may object at any time by writing to us. Retention: twenty-five months. The second, Google Analytics 4, loaded by Google Tag Manager, adds the detail the first does not give. Data: pages viewed, time spent, navigation path, device type, cookie identifier, truncated IP address. Basis: your consent, the “Analytics” category of the banner; nothing is loaded before your choice. Retention: cookies thirteen months at most; aggregate reports fourteen months.
3.6 Advertising measurement
Data: cookie identifiers of the Meta pixel and the LinkedIn Insight tag, pages viewed, conversion event (request sent, demo booked). When you submit a form with this category accepted, our servers also send Meta and LinkedIn the conversion event together with your e-mail and name in hashed form (SHA-256, irreversible), the event identifier, your IP address and your browser, so that the conversion is counted once. Basis: your consent, the “Marketing” category of the banner; if you refuse it, nothing is loaded and nothing is sent, from your browser or from our servers. Retention: cookies thirteen months at most, shorter where the provider expires them sooner.
3.7 Security, technical logs and proof of consent
Data: IP address and browser characteristics in Cloudflare’s logs and our server functions’ logs; the Turnstile token that checks a form is sent by a person; error reports (message, page, date; no IP address, no name, e-mail addresses stripped) on a server operated by GEERD; the log of choices made in the banner (choice, date, notice version, page, country and truncated IP; never your name or e-mail). Basis: GEERD’s legitimate interest in securing the site and its forms; the obligation to be able to demonstrate the consent collected. Retention: technical logs twelve months at most; consent log three years.
04
Retention periods, in one table
At the end of the period the data is deleted or anonymised. Periods run from the last exchange unless stated otherwise.
| Data | Period | Basis |
|---|---|---|
| Prospects: contact, demo, DigiPulse, CRM record | 3 years after the last exchange | Pre-contractual measures · consent · legitimate interest |
| Clients: contract data | Contract duration + 5 years | Performance of the contract · legal obligations |
| Analytics and advertising cookies | 13 months at most | Consent |
| Aggregate audience reports (GA4) | 14 months | Consent |
| Technical and security logs, error reports | 12 months at most | Legitimate interest |
| Consent choice log | 12 months at most | Duty to demonstrate consent |
| Your cookie choice, in your browser | Until you change it or clear your browsing data | Necessary for the site to work |
05
Recipients and processors
Your data is intended for authorised GEERD staff. The following providers process it on our behalf, each for the purpose indicated and under a processing agreement. No data is sold or passed to third parties for their own marketing.
| Processor | Role | Country |
|---|---|---|
| Cloudflare, Inc. | Website hosting and delivery, server functions behind the forms, technical logs, anti-robot protection on forms (Turnstile) | United States · global network |
| Twenty | Customer relationship tool, instance operated by GEERD: details, institution, request, notes | Operated by GEERD |
| Resend, Inc. | Delivery of notification and confirmation e-mails and of the DigiPulse report | United States |
| Cal.com, Inc. | Demo booking calendar, loaded on the Demo and Thank-you pages | United States |
| Google LLC | Google Tag Manager and Google Analytics 4: audience measurement, on consent | United States |
| Meta Platforms, Inc. | Meta pixel and Conversions API: advertising measurement, on consent | United States |
| LinkedIn Ireland Unlimited Company | LinkedIn Insight tag and Conversions API: advertising measurement, on consent | Ireland · processing in the United States |
| GEERD analytics server | Cookie-free audience measurement (OpenPanel, instance operated by GEERD): pages viewed, country, device type | Operated by GEERD |
| GEERD error server | Technical error reports with no personal identifier (Sentry protocol, instance operated by GEERD) | Operated by GEERD |
| OVHcloud SAS | Hosting of the platforms institutions use, outside the scope of this site | France (Gravelines, Roubaix) |
06
Transfers outside Morocco and outside the European Union
Several of this site’s processors are established in the United States or process data there: Cloudflare, Resend, Cal.com, Google, Meta and LinkedIn. Using the form, opening the booking page or accepting a category in the banner therefore transfers your data to that country. The data of the platforms institutions use is not concerned: it stays in France, with OVHcloud.
Under law 09-08 (articles 43 and 44), a transfer to a foreign state is permitted only where that state ensures an adequate level of protection, or with the CNDP’s authorisation. The European Union is among the destinations the CNDP recognises as ensuring adequate protection; for the United States, GEERD relies on the contractual safeguards described below and has included the corresponding transfer authorisation request in the update of its CNDP file.
Under the GDPR, these transfers are framed by the European Commission’s standard contractual clauses signed with each provider in its data processing agreement and, where the provider is certified under it, by the EU–US Data Privacy Framework. You can obtain a copy of the applicable safeguards by writing to us.
Art. 43–44 law 09-08 · SCCs · DPF
07
Security
Exchanges with the site are encrypted (HTTPS). Forms are protected against automated submission. Data passed to advertising platforms is hashed. Access to the customer relationship tool is by named account and limited to the staff who need it. Error reports are stripped of any e-mail address before they are recorded.
08
Your rights
Law 09-08 and, where it applies, the GDPR give you the following rights over the data that concerns you:
- Access: know what data we hold about you and obtain a copy.
- Rectification: have inaccurate data corrected or incomplete data completed.
- Objection: object to processing based on legitimate interest, and at any time to marketing.
- Withdrawal of consent: at any time, without affecting earlier processing; for cookies, from the “Manage cookies” link at the foot of every page.
- Erasure: have your data deleted when it is no longer needed or you withdraw your consent.
- Restriction: have processing frozen while a dispute is examined.
- Portability, where it applies: receive the data you gave us in a structured, machine-readable format.
- Complaint: apply to the CNDP (cndp.ma) and, if you live in the European Union, to the supervisory authority of your country.
09
Exercising your rights
Write to contact@geerd.ma with “Personal data” in the subject line, or by post to GEERD, Technopark, Casablanca. State the e-mail address you used on the site; we may ask for something that verifies your identity before disclosing data. We acknowledge receipt within five working days and answer within one month at most. Exercising these rights is free of charge.
Acknowledged within 5 working days · answered within 1 month
10
Changes to this page
This page is updated when the processing changes: a new processor, a new purpose, a CNDP receipt number. The date at the top is that of the latest version; the cookie banner carries its own version, recorded with each choice.
Cookies
What is set in your browser, with and without your consent, and what is loaded from third parties, is detailed on the Cookies page, where you can also change your mind at any time.