Privacy policy

1. Data controller

The personal data collected on the ServOrbit.com website (hereinafter the « Site ») is processed by MEGALOGI, a SARL under Moroccan law whose registered office is located at 4, rue oued ziz, apt 7, Agdal, Rabat Maroc, in its capacity as data controller. The processing is carried out in accordance with law no. 09-08 relating to the protection of individuals with regard to the processing of personal data and its implementing texts.

2. Data collected

The data strictly necessary for the purposes described below is collected:

• Identification data: surname, first name, email address, telephone, and, for professionals, company name, address and ICE;
• Order and billing data: subscribed services, invoices, payment history — banking data is processed exclusively by the approved payment providers and is never retained by the Company;
• Domain name holder data: when a domain name (in particular in .ma) is ordered, the identity of its holder — who may be a third party distinct from the account holder — is collected as required by the applicable regulations: for an individual, the type and number of an identity document (CIN, passport or residence permit) and the address; for a company, the company name, the ICE and the address. For a .ma domain name, a scanned copy (image or PDF) of that identity document is also collected, and may therefore likewise concern a third party: since 23 July 2026, the ANRT registry requires this document to be attached to each domain name in its registration system and then verified by the provider, failing which the domain is blocked and then deleted. This collection is based on the performance of the contract and on that regulatory obligation of the registry; the document is never made public nor reachable through a public address, and access to it is reserved for the authorised staff of the Company. This information is transmitted to the competent registry (the ANRT, established in Morocco, for .ma) for the sole purpose of registering the domain — for .ma, this transmission is not a transfer of data outside Morocco;
• Promotional email tracking data: for users who have activated the « Promotional notifications » option only (consent, disabled by default), the measurement of engagement with these emails — opens and clicks, with the associated timestamp, IP address and browser. Transactional emails (orders, invoices, security) are never concerned and no third-party tracking tool is used;
• Prospecting data (capture forms): when you voluntarily sign up via a capture form — domain name availability alert, quote request (VPS, dedicated server), newsletter subscription or download of a guide — your email address, the context of the request (for example the domain searched for or the product concerned) and, if you accept it via a separate checkbox, your telephone number with a view to being contacted by WhatsApp. This registration is optional, is based on your consent and can be withdrawn at any time;
• Data submitted to AI assistance tools: when you use an assistance tool relying on artificial intelligence (domain name suggestions, presentation-page generator), the search term, the product description or the link that you voluntarily submit — transmitted without an account identifier — as well as, for abuse prevention, an anonymised technical fingerprint of the IP address;
• Technical data: connection logs and browsing data, for security, support and audience-statistics purposes. This data is recorded by our servers and tied to a technical browser identifier and, if you are signed in, to your account. As it does not rely on a tracker stored in your browser, this recording does not depend on your cookie choices (point 7); it feeds no advertising profiling and is not passed to any third party for advertising purposes.

3. Purposes of processing

The data is processed for:

• the creation and management of the client account;
• the processing of orders, billing and collection;
• the provision of services (registration of domain names, hosting, VPS) — including the transmission to the competent registries and bodies of the information and supporting documents required for the registration of a domain name;
• client assistance and support;
• understanding the context of a support request and preventing abuse — on the basis of the Company’s legitimate interest in providing relevant assistance and protecting the availability of its services;
• compliance with the legal and regulatory obligations of the Company;
• subject to the user's consent — collected at sign-up, at checkout, or from the notification preferences in the client area, by means of a box that is never pre-ticked and never affects your ability to purchase — the sending of commercial communications. This includes abandoned-cart reminders: article 10 of Law No. 09-08 classes as direct marketing any message intended to promote goods or services, which such reminders do;
• subject to this same consent, the measurement of the effectiveness of these commercial communications (open and click rates) in order to improve their relevance;
• subject to your consent obtained during a voluntary registration, commercial prospecting and its personalised follow-up (sending relevant information according to your interest until a possible first order), where applicable by email and, if you have accepted it separately, by WhatsApp.

4. Recipients of the data

The data is intended for the authorised departments of the Company and, to the extent strictly necessary, for its subcontractors and technical partners (domain name registries, payment providers, infrastructure hosts). It is never sold to third parties.

Some of this data is hosted and processed outside Morocco. The infrastructure hosting the Site, the customer area and orders is located in Finland and Germany. The traffic filtering and delivery service (Cloudflare) is established in the United States and sees every request made to the Site. The international payment provider PayPal is also established in the United States; card payments handled by CMI remain processed in Morocco. The registries and registrars to which domain name holder data is transmitted are located in Morocco (ANRT, for “.ma”), the Netherlands, France and the United Kingdom. These transfers are governed by articles 43 and 44 of Law No. 09-08.

When you consent to being contacted by WhatsApp, the prospecting messages pass through a WhatsApp service provider (Business Solution Provider) acting as a subcontractor, which may be located outside Morocco, for the sole purpose of routing these communications.

When you use an assistance tool relying on artificial intelligence, the content you submit (search term, product description or link) may be processed by an AI model provider acting as a subcontractor, which may be located outside Morocco, for the sole purpose of producing the requested suggestion or page — without an account identifier or IP address. Depending on the configuration of the service, this processing may also be carried out entirely on the Company’s infrastructure, without any external recipient.

When you consent to the “advertising trackers” purpose, a measurement tag provided by Google is loaded on the Site and acts as a recipient: it receives browsing data and technical identifiers, including advertising cookies, for the sole purpose of linking a contact request to an ad and measuring its effectiveness. Google may be located outside Morocco. The Company transmits no identifying data to it: no name, no email address, no telephone number, and no content of your request. Without this consent, the tag is not loaded at all — it is neither set nor run in any degraded mode; you may reverse your choice at any time through “Manage cookies”, which puts an end to this transfer.

5. Retention period

The data is retained for the duration of the contractual relationship, increased by the applicable legal limitation periods, in particular in accounting and tax matters. The data of inactive or deleted accounts is erased or anonymised at the end of these periods. The copy of the identity document of a domain name holder is retained for the duration of the registration of the domain concerned, then for 90 days after the holder's last domain ends — the time needed to answer a registry audit covering the period when the domain was still managed — after which it is deleted. Promotional email tracking data (opens, clicks) is retained for thirteen (13) months at most, then aggregated anonymously or deleted. The prospecting data of persons who signed up via a capture form and who do not become clients is deleted after a period of inactivity, or earlier at their request (unsubscription).

6. Security

The Company implements appropriate technical and organisational measures to protect the data against destruction, loss, alteration or unauthorised access: encryption of exchanges (TLS), access control, logging and hosting in secure data centres.

7. Cookies

The Site sets cookies and equivalent technologies that are strictly necessary for its operation (session, cart, language, currency, display preferences): these are not subject to consent. Audience measurement is performed without cookies or individual identifiers, by a tool hosted on our own infrastructure (aggregated statistics, no advertising profiling): it involves no deposit subject to consent. Advertising trackers, for their part, require your prior and explicit consent, collected through the banner displayed on your first visit. None is set or executed before you accept; refusing is as simple as accepting, no box is pre-ticked, and your choice can be reversed at any time through the “Manage cookies” link in the page footer. You may also configure your browser to refuse all or part of the cookies; the operation of certain services may then be degraded. Lastly, two of the processing operations described in point 2 do not go through this banner, as neither relies on a tracker stored in your browser: the audience measurement above, and the recording of browsing data by our servers. Refusing advertising trackers therefore does not stop that recording, which serves security, support and abuse prevention — never advertising; you retain over it all the rights described in point 8.

8. Your rights

In accordance with Law No. 09-08, you have a right of access, rectification and objection regarding the processing of your personal data, as well as a right of erasure under the conditions provided by law. These rights may be exercised by writing to … or via the contact page, providing proof of identity. Consent to commercial communications and to the measurement of their engagement may be withdrawn at any time and free of charge, via the unsubscribe link in every email or from the notification preferences in your client area; withdrawal immediately disables tracking. The date and point of collection of your consent are retained for as long as it remains active, so that it can be evidenced; they are erased as soon as it is withdrawn. You also have the right to lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

9. Changes to this policy

The Company reserves the right to change this policy at any time, in particular to take account of legal and technical developments. The applicable version is the one published on the Site on the date of consultation.