Privacy Policy

In the context of its food delivery activity via website and mobile application (hereinafter: the "Platform"), KOOUL, a division of ORA TECHNOLOGIES, a simplified joint-stock company with a share capital of 6 231 420,00 dirhams, headquartered at 265, Boulevard Zerktouni, Casablanca, Morocco, registered with the Casablanca Trade Register under number 570131 (hereinafter: "ORA"), collects and processes personal data relating to its customers and delivery partners, acting as a data controller with respect to the Platform only.

The primary purpose of this document is to provide a clear, transparent, and understandable overview of the data processing we carry out, allowing you to understand under what conditions your data is processed.

KOOUL is committed to protecting the privacy and integrity of its users' personal data in accordance with Moroccan legislation and regulations, as well as relevant European standards where applicable.

What does this Privacy Policy apply to?

This personal data privacy policy applies exclusively to the KOOUL Platform, accessible via a downloadable mobile application on iOS or Android, designed for ordering and fast food delivery.

This policy does not apply to third-party websites, even if they are mentioned on the Platform via hyperlinks or banners.

It is also specified that certain personal data processing operations performed by Vendors or Users following their use of the Platform — but without direct connection to the Platform (e.g. after-sales service by the Vendor, or marketing activities by the Vendor toward its customers, including Platform Users, or payment via third-party platforms) — are not under the responsibility of ORA. Similarly, data processing related to the use of an e-wallet is the sole responsibility of the institution operating said wallet.

What data do we collect from Users, partner restaurants, and couriers when they use our services?

In the context of our personal data processing (described below), KOOUL may collect and process all or part of the following personal data through forms, content uploads, service subscriptions, or correspondence:

• Identification data: title, first name, last name, email, phone and postal address, passwords.
• Order data: order details, turnover achieved, food preferences, special delivery instructions.
• Geolocation data: latitude and longitude during delivery to enable real-time courier tracking.
• Connection data: IP address, connection logs, cookie usage, pages viewed on our Platform.
• Customer relationship data: purchase history, invoice numbers, store information, data collected via satisfaction surveys.
• Ratings and reviews: your opinions and reviews on ordered products and services.
• Customer service communications: records of interactions via chat or other digital communication means.

Legitimate and proportional use of data

When KOOUL processes data, it does so for specific and legitimate purposes, clearly defined and explicitly declared. We commit to collecting and using only the data that is strictly necessary and relevant to the intended objectives.

We also ensure that data is regularly updated and have implemented effective procedures to correct or delete inaccurate data.

The primary purpose of data processing at KOOUL is to connect customers, couriers, and partners. This includes the following sub-purposes and their respective legal bases:

• Customer management: Required to execute a contract or as a pre-contractual measure allowing user registration and food delivery service provision in accordance with our Terms of Use.
• Restaurant partner management: Essential for executing contracts or pre-contractual measures enabling restaurant listing, platform presence management, and transaction facilitation.
• Courier management: Necessary for organizing delivery logistics, including recruitment, training, and coordination of couriers under service contracts.
• Direct marketing: Used to inform users about updates, promotions, and personalized offers, subject to prior user consent where legally required.
• Accounting and financial management: Required to comply with legal and regulatory obligations, including tax and billing management.
• Use of geolocation data: For tracking orders in real-time and providing estimated delivery times, with user consent where applicable.

How do we use the personal data collected?

The personal data collected by KOOUL is essential to the operation of our food delivery service. It is processed and analyzed by our teams to improve and optimize our services. To ensure effective data processing, we may use external IT service providers who act as processors under our instruction and in accordance with our stated purposes. You have the right to request the identity of these processors at any time.

We may also share your personal data with third parties where required by law, to prevent fraud, or for legitimate marketing purposes. These third parties may include partner restaurants, payment service providers, or other contractors necessary for order execution.

KOOUL commits to protecting the confidentiality and security of your data by implementing strong organizational and technical measures to ensure adequate protection against unauthorized access or use.

Where is this personal data stored?

Your personal data is primarily stored in our internal databases and those managed by our service providers, including our technology partner who provides the infrastructure for our application. For operational and compliance purposes, this data may also be hosted on servers located outside the European Economic Area (EEA).

We take all necessary security measures — including physical, organizational, and technical safeguards — to ensure the confidentiality and security of your data. This includes strict access control, regular security audits, and compliance with high security standards by all our providers, including Jungleworks, Inc., to prevent any unauthorized access or misuse of your personal information.

What are your rights?

In accordance with Moroccan Law 09-08 of February 18, 2009 on the protection of personal data and the European General Data Protection Regulation (GDPR), you have the following rights concerning the personal data we hold about you:

• Right of access: You may request a copy of your personal data. This request is generally free, unless it is manifestly unfounded or excessive, in which case reasonable administrative fees may apply.
• Right to rectification: You can request the correction of any inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): You can ask us to delete your personal data in specific circumstances (e.g., when it is no longer necessary for the purposes for which it was collected).
• Right to restriction of processing: You can request that we restrict processing of your data — meaning we can store it but not process it — under certain conditions (e.g., if you dispute its accuracy).
• Right to object: You may object to certain types of processing, such as direct marketing. You can unsubscribe from our marketing emails at any time via the opt-out link or by contacting us.

How to exercise your rights

To exercise any of these rights, or if you have any questions about your rights or the protection of your personal data, please contact us at: [email protected]

We are committed to responding as quickly as possible, and always within legal timeframes.

How long do we retain this data?

KOOUL commits to retaining personal data only for the period strictly necessary for the purposes for which it was collected, in compliance with legal and regulatory requirements. Here are the retention guidelines we apply:

• Personal identification data (name, address, contact info): retained for up to 5 years after the end of the customer relationship, in accordance with legal limitation periods, unless a legal dispute requires longer retention.
• Geolocation data: retained for no more than 1 year, unless extended consent is given or a specific legal requirement applies.
• Connection data (logs, cookies, browsing history): retained for no more than 1 year, for security and usage analysis.
• Billing and accounting data: retained for 10 years from the end of the fiscal year, in compliance with legal accounting requirements.

These retention periods may be extended if specifically requested by authorities or required to resolve disputes. After these periods expire, the data is either securely deleted or anonymized.

Changes to the KOOUL Privacy Policy

We reserve the right to modify this privacy policy at any time to reflect changes in our practices, to stay compliant with applicable laws and regulations, or to improve clarity. Any significant changes will be clearly announced on our Platform and accessible in the User Area of the KOOUL application, where the latest version is always published.

We encourage users to check this policy regularly to stay informed about how we protect your personal information.

Consent

By using the KOOUL Platform, you acknowledge that you have read and understood this Privacy Policy. You consent to the collection, processing, and sharing of your personal data as described herein, for the following purposes:

• Customer management: To create and manage your account, process your orders, and enhance your user experience under our Terms of Use.
• Restaurant partner management: To register and manage information related to partner restaurants on our Platform.
• Courier management: To coordinate and manage delivery, including real-time tracking.
• Direct marketing: To notify you about new offers, services, or promotions — with your explicit consent.
• Accounting and invoicing: To fulfill our legal and regulatory obligations.
• Courier location tracking: To provide real-time updates on the status of your order.
• Fraud prevention: To detect and prevent fraudulent or illegal activities.

You also agree to the international transfer of your personal data to countries within the European Economic Area (EEA) for storage and processing, subject to authorization filed with the CNDP under number: ….. in accordance with Moroccan Law No. 09-08.

To exercise your rights (access, correction, erasure, restriction of processing, etc.), you may contact us at any time at: [email protected].