1. Introduction
Portfoler attaches great importance to protecting your privacy. This policy transparently describes the processing of personal data carried out through the platform. It has been drawn up in accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, the European Union General Data Protection Regulation (GDPR) and applicable US privacy laws, in particular the California CCPA/CPRA.
2. Data controller
The data controller is the company that publishes Portfoler, established in Morocco. Its company name, registered office address, contact email and the references of its declaration to the Moroccan National Commission for the Control of Personal Data Protection (CNDP) are given in the legal notice. For any question about your data, you can write to us at the email address shown there.
3. Data collected
We collect the data you provide directly: identity (last name, first name, title), email address, password (stored in hashed form), and the information you publish (profile, CV, portfolio, posts, comments, recommendations, messages, services, offers, company page). We also collect technical data related to your use (IP address, device type, browser, date and time, approximate location, profile visits) for security and statistical purposes. Mandatory fields are indicated at the time of collection: without them, the requested service cannot be provided. We do not ask for any sensitive data (health, political or religious opinions…) and encourage you not to publish any.
4. Purposes of processing
Your data is processed to: create and manage your account; display your profile, CV and portfolio; provide the platform's features (search, networking, messaging, recommendations); inform you about your profile's audience; secure the service (detection of suspicious logins, fraud prevention); send you notifications related to your account and, with your consent, informational communications. It is never used for purposes incompatible with these.
5. Legal bases
Within the meaning of the GDPR and Law No. 09-08, processing is based, as the case may be, on: performance of the contract (account creation, provision of the service you request); your consent, which you can withdraw at any time (newsletter, promotional communications, optional features); our legitimate interest (security, fraud prevention, service improvement), with due regard for your rights and freedoms; or compliance with legal obligations.
6. Automated decisions and profiling
Some features (ranking of search results, profile or offer suggestions, "match of the day") rely on automated processing of your professional information. This processing produces no legal effects concerning you, and no decision significantly affecting you is taken solely on that basis, in accordance with Article 11 of Law No. 09-08 and Article 22 of the GDPR. You can obtain information about the logic involved.
7. Retention periods
Your account data is kept for as long as your account is active. After a deletion request, your account is deactivated and then permanently erased within 30 days. IP addresses associated with profile visits are anonymized after 30 days and visit history is deleted after one year. Some data may be kept longer where required by law (for example accounting and tax obligations) or for the establishment, exercise or defence of legal claims.
8. Recipients of data
Portfoler does not sell your personal data and does not share it for targeted advertising. It is accessible only to authorized staff and to our technical processors, bound by contract and acting solely on our instructions: DigitalOcean (server hosting) and Mailgun (email delivery). Information you choose to make public (public profile, posts) is accessible to all visitors. Your data may also be disclosed to authorities where required by law.
9. International transfers
Our hosting and email providers are US companies, so your data may be processed in the United States. For people located in the European Union, these transfers are governed by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. For people located in Morocco, they are carried out in accordance with Articles 43 and 44 of Law No. 09-08 — the transfer being necessary for the performance of the contract between us — and with the applicable formalities before the CNDP.
10. Security
We implement appropriate technical and organizational measures: encryption of communications (HTTPS) and of data sent to our API, password hashing, access control, logging of sensitive events and regular backups. Our processors are chosen for the security guarantees they provide (Article 23 of Law No. 09-08, Article 32 of the GDPR). In the event of a data breach posing a risk to your rights, we notify the competent authority (within 72 hours under the GDPR) and, where applicable, the people concerned. As no system is infallible, we cannot guarantee absolute security.
11. Cookies
Portfoler only uses cookies that are strictly necessary for the service to work: authentication cookies (keeping you signed in) and security cookies (CSRF protection), which do not require your consent. Your preferences (language, light or dark theme) are stored locally in your browser. No advertising cookies or third-party trackers are used. Should non-essential cookies (analytics, advertising) ever be introduced, they would only be set after your prior consent, which you could withdraw at any time. We honour the "Global Privacy Control" signal sent by your browser.
12. Your rights
Depending on where you live, you have: the right to be informed; the right of access to your data and to the logic of automated processing; the right to rectification, updating and erasure; the right to restriction of processing; the right to object on legitimate grounds and, free of charge, to any direct marketing; the right to data portability; and the right to withdraw your consent at any time. You can exercise most of these rights directly from your account area (edit, export, delete) or by contacting us; proof of identity may be requested. Exercising your rights is free of charge. We respond within one month; rectification requests under Law No. 09-08 are handled within ten clear days.
13. United States residents
If you reside in the United States, in particular in California (CCPA/CPRA) or in a state with a comparable law, you have the right to know which categories of personal information we collect (identifiers, professional information, activity on the platform, connection data and approximate location), for what purposes and with whom it is shared; to access it; to have it corrected or deleted; and not to be discriminated against for exercising these rights. Portfoler does not sell your personal information and does not "share" it for cross-context behavioral advertising; your login credentials are used only to provide the service. You can exercise these rights yourself or through an authorized agent; we respond within 45 days.
14. Communications and marketing
Emails related to the operation of your account (security, notifications you have enabled) are sent to you as part of the service. In accordance with Article 10 of Law No. 09-08, the GDPR and the US CAN-SPAM Act, we only send you promotional communications with your prior consent or where permitted by law. Each message clearly identifies the sender and lets you unsubscribe free of charge; you can also manage your notification preferences from your account.
15. Minors
The platform is not intended for people under 16 and is in no way directed at children under 13 (within the meaning of the US COPPA). We do not knowingly collect data about minors; if we learn that such an account has been created, it is deleted without delay. Parents or guardians can contact us for this purpose.
16. Contact and complaints
To exercise your rights or for any question regarding your personal data, contact us via the contact form or at the email address indicated in the legal notice. If you believe your rights have not been respected, you can lodge a complaint with the competent authority: in Morocco, the National Commission for the Control of Personal Data Protection (CNDP — www.cndp.ma); in the European Union, the data protection authority of your country of residence or work (in France, the CNIL); in California, the California Privacy Protection Agency or the state Attorney General.
17. Changes
We may update this policy to reflect legal or functional changes. In the event of a substantial change, you will be informed by email or by a notification on the platform before it takes effect. The date of the last update is shown at the top of the page.