Privacy policy

1. Who is responsible for what

SAMIFISC (contact details in the legal notice) is the controller for the data it collects on its own behalf: site visitors, prospects, contacts at client companies, Client Portal users, applicants, and what its professional obligations require it to retain.

For the data that client companies entrust to it or record in their Client Portal — payroll and employee records, their customers and suppliers in the Commercial Management module, third parties appearing on their accounting documents — each company remains the controller, and SAMIFISC acts as processor, on the terms of the Data Processing Agreement. Data subjects should contact the company first; the firm forwards to it any request it receives.

Contact for personal data: contact@samifisc.com, subject "personal data".

2. The data we process

Visitors to samifisc.com

• Quote request: name, company, e-mail, telephone, activity, headcount, tax regime, needs described.
• Appointment booking: name, e-mail, telephone, time slot, reason.
• Contact form: name, e-mail, telephone, message.
• Job or internship application: name, e-mail, telephone, school or background, CV and cover letter uploaded.
• Newsletter: e-mail, and the record of your subscription.
• Technical data: IP address, browser and pages viewed, in the server logs and, if we enable them, in the measurement tools described in section 7.

Clients and Client Portal users

• Account: name, e-mail, telephone, role, password (hashed, never readable), notification preferences.
• Company file: legal identifiers (RC, ICE, IF, CNSS), managers and contacts, uploaded records and the data the firm extracts from them, filings, exchanges with the firm, appointments.
• Activity log: who did what and when (logins, uploads, validations, sends) — necessary for a firm's traceability and for your own security.

Contacts reaching the firm through WhatsApp

• Telephone number, profile name, content of messages and records sent, transcription of voice messages, timestamps.
• The assistant verifies the identity of a contact recorded in the file by a code sent to their e-mail address; it never asks for a national ID number (CIN), ICE, password or bank details by message.
• Messages sent by the firm to WhatsApp (due-date reminders, documents ready, appointments, requests for supporting documents) require that the contact has been recorded in the file by the company; "STOP" is enough to stop them.

People whose data is entrusted by a client company

• Employees (Payroll & HR module): identity, CIN, family status, address, contact details, CNSS number, contract, pay, bank account details (RIB), absences and leave, HR documents.
• Customers and suppliers (Commercial Management module): identity or company name, ICE, address, contact details, invoicing terms and history.
• Third parties appearing on accounting documents: the names and references that appear on uploaded invoices, statements and contracts.

3. Why and on what basis

We take no decision producing legal effects concerning you solely on the basis of automated processing.

4. Who receives the data

Authorised members of the firm, according to their role and the files assigned to them — every access is logged. And providers, who act only on our instructions:

Data may be disclosed to the administrations and bodies that the engagement requires (DGI, CNSS, commercial courts, the client's banks) and to authorities that lawfully request it. We neither sell nor rent any data.

Transfers outside Morocco. Hosting in France and Cloudflare's European buckets rely on the CNDP's recognition of an adequate level of protection. Transfers to providers established in the United States (Meta, Cloudflare, Anthropic, OpenAI, Google) are governed by their contractual clauses and are subject to the formalities provided for in Articles 43 and 44 of Law No. 09-08; see the CNDP Compliance Commitment.

5. How long

6. How we protect the data

• Encryption in transit (TLS); files and backups encrypted at rest; database on a server dedicated to the firm, unreachable from outside other than through the application; hashed passwords; 12-hour sessions.
• Access by role and by file: a member of the firm sees only the files assigned to them; a client user sees only their company; logins, uploads, document views, validations, sends and deletions are logged.
• Antivirus scan of every uploaded file, size and type limits; no public download link — a document can be downloaded only from an authenticated session.
• Daily encrypted backups on separate storage; hosting in a certified data centre.
• Identity verification of WhatsApp contacts by e-mail code, limited session, topics reserved for a person at the firm.
• The chartered accountant's professional secrecy and confidentiality undertakings signed by every staff member.

In the event of a data breach likely to cause you harm, we inform you, and the company concerned where applicable, within the time limits set by the Data Processing Agreement.

7. Cookies and audience measurement

The samifisc.com site currently uses only strictly necessary cookies — it places none for advertising purposes and therefore displays no banner. The Client Portal uses a session cookie essential to login, and the browser may remember your display preferences (theme, open panels) without any of this information being transmitted to a third party.

If the firm enables an audience measurement tool (Google Analytics) or a tracking pixel, a banner asks you on your first visit, by category: necessary cookies (session, security, remembering your choice) are always active because the site does not work without them and do not require consent; audience measurement and marketing load only after your consent, category by category ("Accept all", "Reject all" or "Customise"). Refusing has no effect on browsing; your choice is kept for thirteen months in your browser. The "Manage cookies" link in the footer lets you change your mind at any time; you can also delete cookies from your browser settings.

8. Your rights

In accordance with Articles 7, 8 and 9 of Law No. 09-08, you have:

• a right of access: to know whether we process data concerning you and to obtain a copy;
• a right of rectification of inaccurate or incomplete data;
• a right to object, on legitimate grounds, to the processing of your data, and a right to object free of charge to any marketing communication;
• the right to withdraw consent, without affecting processing already carried out;
• for Client Portal users, the right to export their company's data at any time.

Write to contact@samifisc.com (subject "personal data") or by post to the firm's address, enclosing something that allows us to identify you. We reply within one month. Some data cannot be deleted before the statutory retention periods expire (accounting records, filings): we then tell you so.

You may also lodge a complaint with the National Commission for the Control of Personal Data Protection (CNDP) — www.cndp.ma.

9. Minors

The site and the Client Portal are intended for professionals. We do not knowingly collect data from minors; if you believe a minor has sent us some, write to us and we will delete it.

10. Google account data (Gmail, Google Calendar)

A user may, if they wish, connect their Google account to SAMIFISC. There are two separate connections; each asks for your consent on Google's screen and can be withdrawn at any time.

Gmail — sending your documents

• Permissions requested: "send e-mails on your behalf" (gmail.send) and your e-mail address (userinfo.email), to know which account is connected.
• Use: sending from your Gmail address, and only when you ask, the documents you issue in SAMIFISC — invoices, quotes, purchase orders, payslips, HR or legal documents — to the recipients you choose.
• What SAMIFISC does not do: it does not read, list, modify or delete your e-mails; it has no access to your inbox or your contacts.

Google Calendar — two-way synchronisation

• Permissions requested: "view and edit events on your calendars" (calendar.events), the list of your calendars read-only (calendar.calendarlist.readonly) so you can choose the one to synchronise, and your e-mail address (userinfo.email).
• Use: copying into the chosen Google calendar the appointments, due dates and meetings of your SAMIFISC calendar, and bringing into your SAMIFISC calendar the events of that Google calendar (title, date and time, place, description), so that both stay up to date. Events brought in from Google are visible only to you in SAMIFISC, unless you choose to share them with a colleague.

Retention, security and sharing

• The access token issued by Google is encrypted on our servers; it is never displayed or passed to anyone.
• SAMIFISC keeps of the e-mails sent only the record of the sending (recipient, date, document) in the file's log. Synchronised events remain in your SAMIFISC calendar as long as your account exists.
• Data obtained from Google is neither sold, nor rented, nor shared with third parties, is used for no advertising and is not used to train artificial intelligence models. No one at the firm looks at it, except at your request to assist you, for the security of the service or if the law requires.
• Disconnection: "Disconnect" (in your profile or the module settings) deletes the token from our servers; for Google Calendar, access is also revoked with Google and the events SAMIFISC had created in your Google calendar are removed from it. You can also withdraw access at any time from your Google account.

Google API Services — Limited Use. SAMIFISC's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Changes

This policy evolves with our services and the regulations. Each version carries its date; a substantial change is notified to Client Portal users and, where applicable, to newsletter subscribers.

Document “Privacy policy”, version 2026-09, in force since 20 September 2026. Earlier versions are available on request at contact@samifisc.com.