Data processing agreement

1. Purpose and parties

This agreement is concluded between the client company named in the engagement letter ("the client", controller) and SAMIFISC ("the firm", processor), identified in the legal notice. It sets out the conditions under which the firm processes personal data on behalf of the client in the course of the engagement and the Client Portal, in application of Law No. 09-08 and its implementing Decree No. 2-09-165, and, for clients subject to it, of Article 28 of Regulation (EU) 2016/679 (GDPR).

It forms part of the contract on the same footing as the General Terms, over which it prevails for everything concerning personal data.

2. Who is responsible for what

For the processing for which it is controller, the firm applies its Privacy Policy. This agreement governs the processing in the first three rows.

3. Client instructions

The firm processes the data only on the client's documented instructions. The following constitute instructions: the engagement letter, this agreement, the settings the client sets in its Client Portal (users, modules activated, WhatsApp contacts, recipients of documents) and the written requests it sends to the firm. The firm informs the client if it considers that an instruction infringes the law.

The firm may process the data beyond these instructions where the law or a competent authority requires it; it then informs the client before the processing, unless prohibited by law.

4. The firm's commitments

• Confidentiality: the persons authorised to process the data are bound by the chartered accountant's professional secrecy and by a written confidentiality undertaking; access is limited to staff assigned to the file.
• Security: the measures in Annex B are implemented and adapted to the state of the art.
• Purpose: no use of the data on behalf of the firm or a third party, no sale, no training of an artificial intelligence model on the client's data.
• Assistance: the firm helps the client respond to data subjects' requests (access, rectification, objection) within ten (10) working days of their being forwarded, and provides the information needed for its CNDP formalities and impact assessments.
• Breaches: any breach of the client's data is notified to the client without undue delay and at the latest seventy-two (72) hours after the firm becomes aware of it, with the nature of the breach, the data and persons concerned, the likely consequences and the measures taken; the firm documents the incident.
• Record: the firm keeps the processing sheet in Annex A up to date and makes it available to the client.

5. Sub-processors

The client authorises the firm to use the sub-processors listed in Annex C. The firm imposes on them by contract data protection obligations at least equivalent to this agreement and remains liable to the client for their performance. Any addition or replacement is announced to the client in the Client Portal and by e-mail at least thirty (30) days beforehand; the client may object in writing on legitimate grounds, in which case the parties seek a solution and, failing one, the client may terminate the engagement without penalty.

6. Transfers outside Morocco

The application server and the database are hosted in France; the files and backups are hosted in Cloudflare R2 buckets under European Union jurisdiction — territories recognised by the CNDP as providing an adequate level of protection. Transfers to providers established in the United States, necessary for the service — Cloudflare (storage operator), Meta (routing of WhatsApp messages), Anthropic and OpenAI (artificial intelligence models) — are governed by their contractual clauses and are subject to the formalities of Articles 43 and 44 of Law No. 09-08 on the part of the firm; the client declares, for its part, in its own formalities, the transfer that hosting its files in the European Union constitutes (see the CNDP Compliance Commitment). No other transfer takes place without the client's written agreement.

7. Data subjects' rights

The client responds to the requests of its employees, customers and suppliers. The firm forwards to the client, without replying itself, any request it receives directly — including via WhatsApp — and helps it follow up within the time limits of the law. The export and correction functions of the Client Portal allow the client to satisfy most requests itself.

8. Audit and control

The firm makes available to the client the information necessary to demonstrate compliance with this agreement: processing sheet, list of sub-processors, description of security measures, certificates from the host. The client may, once a year and subject to thirty (30) days' notice, have a documentary or on-site audit carried out by itself or an independent auditor bound by secrecy, during business hours, without access to the data of the firm's other clients and at its own expense, unless the audit reveals a substantial breach.

9. Term and end of processing

The agreement lasts as long as the engagement. When the engagement ends, the client has sixty (60) days to export its data from the Client Portal or to request that the firm hand it over in a reusable format. At the end of that period, the firm deletes the client's data from the active space and certifies it in writing on request; it disappears from full backups when their rotation expires (daily for 7 days, weekly for 4 weeks, monthly for 6 months, yearly for 3 years) and is never restored into an active space.

The firm retains, as controller and under professional secrecy, what its legal and professional obligations require: working file, filings submitted and their supporting documents, for ten (10) years.

10. Liability

Each party is liable for the damage caused by a breach of its obligations under this agreement. The firm's liability is governed by the General Terms, except for harm resulting from a data breach attributable to gross misconduct of the firm or its sub-processors.

Annex A — Processing sheet

Subject matter

Running payroll and administrative management of employees; invoicing and tracking of customers and suppliers; accounting processing of uploaded records.

Nature of operations

Collection, recording, structuring, storage, extraction, consultation, disclosure to administrations, document generation, erasure.

Categories of data subjects

Employees and former employees of the client, applicants and interns; customers and suppliers who are individuals; managers and contacts of third parties; persons appearing on accounting documents.

Categories of data

Identity and CIN; family status and dependants; address and contact details; CNSS number; contract, position, pay and deductions; RIB; absences and leave; ICE and commercial identifiers; amounts, dates and references of transactions.

Sensitive data

None in principle; sick leave is processed without mention of the medical reason, unless a document is uploaded by the client.

Duration

Term of the engagement, then 60 days for export and deletion; the firm's legal archives 10 years.

Location

European Union (France).

Annex B — Security measures

• TLS encryption of all communications; encryption at rest of files and backups; database on a dedicated server, isolated from the public network, backed up encrypted.
• Authentication by hashed password, limited sessions, named invitation of users by the client, immediate revocation.
• Segregation by file: a staff member accesses only the files assigned to them; a client user sees only their company; employee data is visible only to authorised roles.
• Logging of logins, uploads, document views, validations, sends and deletions in the file's log; technical logs purged after twelve (12) months.
• Antivirus scan of every uploaded file, limits on types and sizes; no public download link, a document can be downloaded only from an authenticated session.
• Identity verification of WhatsApp contacts by a code sent by e-mail, verification session limited in time, no identification data requested by message.
• Artificial intelligence model providers receive only the records and messages necessary for the requested processing, with no training of their models on this content.
• Daily encrypted backups, kept at a separate site, restoration tested; recovery objective within eight (8) business hours.
• Security updates applied regularly, isolated production environment, secrets managed outside the code.
• Staff awareness and a confidentiality undertaking signed at hiring.

Annex C — Sub-processors

The up-to-date version of this list is published on this page; changes are notified in accordance with section 5.

Document “Data processing agreement”, version 2026-09, in force since 20 September 2026. Earlier versions are available on request at contact@samifisc.com.