Privacy Policy

Effective Date: May 7, 2024

ARTICLE 1: Introduction and Commitment

This Privacy Policy describes the practices of Ezra Maroc Consulting Services LLC (hereinafter "Ezra Maroc", "we", "our", "us") regarding the collection, use, storage, sharing, and protection of personal data of users (hereinafter "User", "you", "your") of our website accessible at https://www.ezra-maroc.com (hereinafter the "Site").

As data controller, we are firmly committed to protecting your privacy and processing your personal data transparently, fairly, and securely, in accordance with applicable regulations, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and relevant data protection laws.

This Policy aims to inform you about: what data we collect, why we collect it, how we use it, with whom we may share it, how we protect it, how long we keep it, and what your rights are regarding it.

ARTICLE 2: Data Controller

The data controller for your personal data is:

Ezra Maroc Consulting Services LLC
30 N Gould St Ste R, Sheridan, WY 82801, USA.
For any questions regarding this Policy or to exercise your rights, you can contact us via our Data Protection Officer (if designated) or our dedicated service:
Email: info@ezra-project.fr

ARTICLE 3: General Principles of Data Protection

We commit to processing your personal data in compliance with the fundamental principles set out by the GDPR:

• Lawfulness, Fairness, Transparency: Fair, lawful, and transparent processing.
• Purpose Limitation: Collection for specified, explicit, and legitimate purposes.
• Data Minimization: Collection limited to data strictly necessary for the purposes.
• Accuracy: Maintenance of accurate and up-to-date data.
• Storage Limitation: Retention for no longer than necessary for the purposes.
• Integrity and Confidentiality: Implementation of appropriate security measures.
• Accountability: Ability to demonstrate our compliance.

ARTICLE 4: Personal Data Collected

We collect personal data about you in different ways:

4.1. Data provided directly by you

This primarily concerns information you voluntarily provide to us via the contact form on the Site:

• Identification and contact: Full name, email address, phone number (optional).
• Subject of your request: The subject you select from the dropdown list.
• Content of your message: Any information you choose to include, potentially relating to your personal or family situation, your ancestors (names, dates, places, etc.) to obtain information or a preliminary eligibility assessment. We strongly advise you to limit the information shared at this stage to what is strictly necessary for your initial request and not to transmit unsolicited sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health or sex life). The transmission of such data via the form is under your sole responsibility and constitutes explicit consent to its processing for the sole purpose of responding to your specific request.

4.2. Data collected automatically during your navigation

When you visit our Site, technical and browsing data are automatically collected by our servers and potentially by third-party tools (security, analytics) subject to your consent where required:

• IP (Internet Protocol) address - [Anonymized if possible, e.g., by Google Analytics].
• Type and version of web browser.
• Operating system and type of device used.
• Date and time of visit.
• Pages viewed and navigation path on the Site (if analytical tool activated).
• Time spent on pages (if analytical tool activated).
• Referrer (website from which you came, if applicable).
• Technical log data (errors, security).

4.3. Data collected via Cookies and Trackers

We use cookies and similar technologies. These tools may collect information about your browsing preferences, your interactions with the site, or data for statistical analysis, **only if you consent via our cookie management tool.**

For complete and detailed information on the cookies we use (or are likely to use), their purposes, their lifespan, and how to manage your consents, please consult our dedicated Cookie Policy. You can change your choices at any time via the "Cookie Management" link in the footer.

ARTICLE 5: Purposes and Legal Bases for Processing

Each processing of personal data is based on a legitimate purpose and a valid legal basis:

• Managing your requests via the contact form: To process your request for information or preliminary assessment, communicate with you to respond, and ensure follow-up.
  • Legal bases: Your explicit consent given via the form's checkbox (Art. 6.1.a GDPR); Performance of pre-contractual measures (Art. 6.1.b GDPR) if your request concerns our services.
  • By submitting the form, you explicitly agree that we may contact you by email or phone (if provided) strictly within the scope of your initial request.
• Providing, maintaining, and securing the Site: Ensuring the proper technical functioning of the Site, preventing and detecting security incidents, fraud, or illicit activities (server log analysis, use of tools like Cloudflare).
  • Legal basis: Our legitimate interest (Art. 6.1.f GDPR) to maintain a secure and functional online service.
• Analyzing and improving the Site (audience statistics): Understanding how Users use the Site to improve its content, ergonomics, and performance (e.g., Google Analytics).
  • Legal basis: Your prior consent (Art. 6.1.a GDPR) collected via the cookie management tool (Tarteaucitron.js) for non-essential analytical cookies.
• Pre-contractual and contractual management: (If applicable following a request) Preparing, concluding, and executing a Consulting Services agreement.
  • Legal basis: Performance of pre-contractual measures or a contract (Art. 6.1.b GDPR).
• Compliance with legal obligations: Complying with any legal or regulatory obligation to which we are subject (e.g., responding to a judicial authority request).
  • Legal basis: Legal obligation (Art. 6.1.c GDPR).

ARTICLE 6: Recipients and Sharing of Personal Data

6.1. Collected data is processed internally by authorized Ezra Maroc personnel, within the limits of their respective duties.

6.2. We may use service providers (sub-processors) for certain technical or analytical operations. These sub-processors only have access to your data to perform these tasks on our behalf and are obliged not to disclose or use it for other purposes. Our main sub-processors (or categories) are:

• Web Hosting and CDN Infrastructure/Security: Cloudflare, Inc. (USA).
• Audience Analysis Tools (if activated by consent): Google LLC (for Google Analytics, USA).
• Transactional Email Provider (for contact form responses): [Provider Name - TO BE SPECIFIED IF USED, e.g., Brevo (France/EU), SendGrid (USA)].

6.3. Your data may also be communicated to third parties if required by law, to respond to legal proceedings, to protect our rights, or in the context of a possible corporate restructuring (merger, acquisition), always in compliance with regulations.

6.4. Apart from these cases, your personal data is not sold, rented, or exchanged with third parties for commercial purposes.

ARTICLE 7: Data Transfers Outside the European Union

As a US-based company using international sub-processors (Cloudflare, Google, potentially others), your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), particularly the United States. We ensure that these transfers are governed by appropriate safeguards in accordance with the GDPR, such as:

• Using providers certified under the EU-US Data Privacy Framework (successor to the Privacy Shield).
• Signing Standard Contractual Clauses (SCCs) of the European Commission with the relevant sub-processors, accompanied by Transfer Impact Assessments (TIAs) when necessary.

You can obtain more information about these safeguards by contacting us.

ARTICLE 8: Data Retention Period

Your personal data is kept for a limited period, proportionate to the purposes for which it was collected:

• Data from the contact form: For a simple information request, kept for the time to provide a complete response and for a maximum period of 12 months after the last exchange, unless you exercise your right to erasure beforehand. If the request leads to a commercial proposal not followed by an agreement, also kept for 12 months. If the request results in a contractual relationship, the relevant data is kept for the duration of the contract, then archived in accordance with legal prescription periods (generally 5 years for commercial and contractual matters).
• Connection data and server logs: Kept for a maximum period of 12 months for security and diagnostic purposes.
• Cookies and trackers: Lifespans are detailed in our Cookie Policy. The retention period for your consent or refusal is **6 months**.

ARTICLE 9: Data Security and Confidentiality

We implement appropriate technical and organizational security measures to protect your personal data against destruction, loss, alteration, disclosure, or unauthorized access. This includes, in particular, the use of the HTTPS protocol (SSL/TLS) to secure data exchanges, the protection of our infrastructures, and strict access controls.

User Responsibility: You are also responsible for the confidentiality of the information you transmit to us and for the security of your own equipment (password protection, antivirus, etc.).

ARTICLE 10: Your Rights Over Your Personal Data

In accordance with the GDPR and applicable data protection laws, you have the following rights over your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten") (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR), particularly to processing for direct marketing purposes.
• Right to withdraw your consent at any time (Art. 7.3 GDPR), without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to define directives concerning the fate of your data after your death.
• Right to lodge a complaint with a competent supervisory authority (e.g., the ICO in the UK, or your local DPA).

Exercising your rights: You can exercise these rights by contacting us via:

• Email to: info@ezra-project.fr
• Postal mail to the address indicated in Article 2.

For security reasons and to prevent fraudulent requests, we may ask you to prove your identity. We commit to responding to your request as soon as possible and at the latest within one (1) month of its receipt (extendable by two months if necessary, upon informing you).

Supervisory Authority: If you are in the EU or UK, you can lodge a complaint with your local Data Protection Authority. For example, in France, it is the CNIL (Commission Nationale de l'Informatique et des Libertés), 3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07, France - Website: www.cnil.fr.

ARTICLE 11: Cookie Management

The Site uses the Tarteaucitron.js tool to manage your consent to the placement of non-essential cookies. During your first visit, a banner informs you of the presence of these technologies and allows you to accept, refuse, or customize your choices.

You can change your preferences at any time by clicking on the "Cookie Management" link in the Site's footer.

For a detailed description of the cookies used, their purposes, and their lifespan, please consult our Cookie Policy.

ARTICLE 12: Links to Other Sites

The Site may contain links to third-party websites. We exercise no control over these sites and disclaim any responsibility for their privacy practices or content. We encourage you to carefully read the privacy policies of these third-party sites before providing them with personal data.

ARTICLE 13: Protection of Minors

The Site and services offered by Ezra Maroc are not intended for minors under the age of 15 (or the applicable age of digital consent). We do not knowingly collect personal data from minors without the prior consent of parental authority holders. If you believe that a minor has provided us with data without such consent, please contact us so that we can take the necessary measures.

ARTICLE 14: Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy at any time to comply with legal, regulatory, jurisprudential, or technological developments. Any changes will be effective upon publication on the Site, with an update of the "Effective Date". In case of substantial changes, we may inform you through additional means.

We encourage you to consult this page regularly.

ARTICLE 15: Contact and Questions

For any questions, requests for information, or to exercise your rights regarding this Privacy Policy and the processing of your personal data, please contact us:

By email: info@ezra-project.fr
By postal mail:
Ezra Maroc Consulting Services LLC
Attn: Data Privacy Inquiry
30 N Gould St Ste R
Sheridan, WY 82801
USA