Personal data protection

The data controller for the personal data collected on iris.ma is SGM2I S.A.R.L. (Société Générale Marocaine de l'Internet et de l'Informatique), a limited liability company (S.A.R.L.) under Moroccan law, whose registered office is located at Hassan II Boulevard, Les Perles de Témara Residence, Building 5, Apartment 2, 12000 Témara.

You may contact the controller at service.client@iris.ma, by telephone on (+212) 05 30 31 64 21, or by post at the address of the registered office. For administrative or legal correspondence: contact@sgm2i.com.

The company's registrations (trade register, tax identifier, ICE) appear on the legal notice page.

In accordance with Law No. 09-08 promulgated by Dahir 1-09-15 of 18 February 2009, relating to the protection of individuals with regard to the processing of personal data, the processing operations carried out on this site have been notified to the National Commission for the Control of Personal Data Protection (CNDP).

• Processing of customer data and of their orders: receipt No. D-CE-389/2015 of 31/12/2015.
• Transfer of the database abroad: receipt No. T-I-155/2015 of 31/12/2015.

These numbers are restated beneath every form on the site that collects information concerning you.

We collect only the information necessary for the purpose pursued. The essential fields are marked as mandatory in each form; the others are optional and you may leave them empty without consequence.

• Creating and managing your account — surname, first name, e-mail address, password (encrypted, never legible by our teams), and, where applicable, company name and ICE for a business account.
• Processing and delivering your orders — delivery and billing addresses, mobile telephone number, contents of the order.
• Collecting your payment — the entry of your bank card takes place on the secure platform of Attijari Payment, never on iris.ma. We keep no card number.
• Answering you — the information you send us through the contact form, a request for a quotation, a call-back request or a message to the after-sales service.
• Alerting you at your request — the e-mail address for back-in-stock and price-drop alerts, which you may delete at any time.
• Publishing your reviews — the rating, the title and the text you write, together with the first name under which you wish to appear. Your e-mail address serves solely to confirm the submission and is never published.
• Sending you our new products and our promotional offers by e-mail. You may object at any time, in one click.
• Protecting the site and your account — technical logs used to combat fraud and intrusion attempts. IP addresses are recorded there in the form of an irreversible fingerprint, never in clear text.

Your data is processed by the teams of SGM2I S.A.R.L. authorised to have knowledge of it, each one limited to what its work requires. It is passed on, solely to the extent necessary for their task, to:

• our partner carriers, in order to deliver to you. They receive only the name, the address and the telephone number of the recipient;
• Attijari Payment, our bank card payment partner. The entry of your card takes place on its platform: we neither receive nor keep any card number;
• our e-mail routing provider (MailerSend), in order to convey to you the order confirmations, the alerts and the newsletter;
• our host, which hosts the site and its database.

Apart from these cases and from the requisitions that the law obliges us to answer, your data is neither sold, nor rented, nor transferred to third parties.

The hosting of the site and of its database entails a transfer of data outside Morocco. This transfer has been notified to the CNDP and authorised under receipt No. T-I-155/2015 of 31/12/2015, as Law 09-08 requires.

Your data is kept only for the time necessary for the purpose for which it was collected, extended, where applicable, by the periods that accounting and commercial regulations require us to observe.

• The information in your account is kept for as long as the account exists. You may request its deletion at any time.
• Orders and their supporting documents are kept for the period required by accounting and tax obligations.
• The technical logs used to combat fraud are purged automatically after 90 days.
• The cookies we place expire of their own accord (see below).

Law 09-08 grants you three rights over the information concerning you:

• the right of access (article 7): to know whether we hold data concerning you, and to obtain communication of it;
• the right to rectification (article 8): to have inaccurate, incomplete or out-of-date data corrected, updated, blocked or erased;
• the right to object (article 9): to object, on legitimate grounds, to your data being the subject of processing.

Most of these requests are settled immediately, without writing to us: the my profile section of your customer account allows you to consult and amend your contact details and your preferences, my addresses to manage your address book, and my alerts to delete your stock and price alerts.

For anything that cannot be done there — access, erasure, objection — write to us at service.client@iris.ma, use the contact form or call (+212) 05 30 31 64 21. The exercise of these rights is free of charge and we answer you as promptly as possible.

We send our new products and our promotional offers by e-mail to our customers, as well as to the people who have given us their address. These mailings concern products comparable to those we sell.

You may object at any time, free of charge and without having to give a reason. Every message contains an unsubscribe link, which takes effect as soon as you click on it. You may also switch off these mailings from the my profile section, or ask us to do so at service.client@iris.ma — we act on it without delay.

A cookie is a small file placed on your device by the site you are visiting. iris.ma uses two kinds of them.

The cookies necessary for the operation of the site: they maintain your session when you are logged in and keep the contents of your basket (one year at most, so that you find your selection again from one visit to the next without having to identify yourself again), remember your delivery city, retain the fact that a banner has been closed, and make it possible to attribute a referral or a partner recommendation (30 days). Without them, the site simply cannot work.

The audience measurement and advertising cookies: they are placed by Google Analytics, Meta and Criteo. They allow us to understand how the site is used and to present our products to you on other sites.

You may object to the latter in two ways: by setting your browser to refuse or delete cookies — all browsers allow this, most often from the "Privacy" menu — or by switching on private browsing mode. Refusing measurement and advertising cookies in no way affects your ability to browse and to order.

Access to the data is restricted to the staff who need it. Exchanges with the site are encrypted (HTTPS), passwords are stored in an encrypted and irreversible form, and access to your account may be protected by two-factor authentication. The IP addresses recorded in our security logs are recorded in the form of an irreversible fingerprint.

Iris keeps no bank card number. The entry and the processing of your card take place entirely on the secure platform of Attijari Payment, where your data is encrypted and used for the time of the single transaction. At no point does it pass through our servers.

By registering on iris.ma, the customer undertakes to provide us with sincere and truthful information, the provision of false information being deemed fraudulent and contrary to the terms of use of the merchant site.

For any question relating to the processing of your personal data, write to the data controller at the address service.client@iris.ma, call (+212) 05 30 31 64 21, or use the contact form.