Privacy Policy.

The data controller is FORLIK, publisher of the application and of the website of the same name, operating in Morocco on the campus of Université Internationale de Rabat (UIR) and its immediate surroundings.

• Single point of contact — for any question relating to your data as well as for the exercise of your rights: support@forlik.com
• Supervisory authority — CNDP, Commission Nationale de contrôle de la protection des Données à caractère Personnel, the Moroccan data protection authority (www.cndp.ma).

This policy applies to four categories of persons:

• Customers holding a FORLIK account, whether they order for delivery, for pickup or on the premises.
• Persons ordering at their table without an account, via the QR code of a partner restaurant — a distinct situation, dealt with specifically below.
• Couriers, independent students who carry out the deliveries, including the grouped runs from restaurants located outside the campus.
• Representatives of partner restaurants using the merchant dashboard.

We collect only what the service requires. The categories below constitute the whole of what we process.

For any user holding an account

Ordering at a table without an account

If you order in a restaurant by scanning the QR code of your table without creating an account, we process: the table concerned, your first name where the restaurant asks for it, your position at the time you are seated — in order to verify that you are indeed on the premises — and a session identifier kept by your browser. That identifier is what allows you to follow your orders and to add an item to them; it recognises you on the same device on a later visit. We ask for neither a last name, nor a telephone number, nor an email address.

Couriers

In addition to the account data: the identity verification items required at application — identity document number, photograph of that document and photograph of the face — the history of runs, the ratings received, and the bank details provided for the payment of earnings. The latter are encrypted and any consultation of them in clear text is justified, capped and logged.

Representatives of partner restaurants

Professional contact details of the representative or representatives, information about the establishment, menus and prices, and data relating to orders and settlements.

Location is at the heart of a delivery service: it determines whether you are on the campus, which delivery point is offered to you and where the courier must go. Here is exactly what we do with it.

• When the application opens, if you have consented to it at the level of your operating system, we take a reading of your position in order to locate you on the campus and to adapt what is offered to you. We keep the last known value of it.
• During a delivery in progress, the position of the courier is transmitted continuously in order to allow real-time tracking. That continuous transmission stops at the end of the run or when the courier goes offline.
• For an order at a table, your position is read at the time you are seated, for the sole purpose of verifying your presence in the establishment.

Access to location presupposes an explicit authorisation from your operating system. You may withdraw it at any moment from the settings of your device; certain functions, delivery among them, can then no longer be provided.

Your data is communicated only to those who need it in order to perform your order:

Our service providers act on our instructions alone, for the purposes we set, and are not authorised to exploit your data on their own account or for advertising purposes. The list of our sub-processors by name is communicated to you on simple request to support@forlik.com.

Our systems are hosted in data centres located in Europe. Certain service providers — in particular for the routing of messages and notifications — may process data from other countries.

Such processing outside Moroccan territory is governed by recognised contractual protection commitments, such as standard contractual clauses, and by the formalities required with the CNDP.

We keep each item of data for the time necessary to the purpose that justifies it, then in accordance with the periods the law imposes on us:

You may request the deletion of your account from the mobile application, or, from the website, by writing to support@forlik.com.

The request is handled as follows:

• It is deferred for as long as an order is in progress or a financial position remains to be settled — for the time needed to carry the operation through to its conclusion.
• Your free-text entries — delivery instructions, address details, the contact details of a recipient — are erased from past orders.
• The reviews you have published are dissociated from your identity: the rating remains, its author and its text disappear.
• The items the law requires us to keep — accounting records, and for couriers the identity verification items useful to the defence of a claim — are isolated, made inaccessible to the day-to-day service, then deleted when their term expires.

• Access — obtain confirmation that processing is taking place and a copy of your data.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — request deletion, subject to our retention obligations.
• Objection — object to processing based on legitimate interest, and, without giving any reason, to commercial solicitation.
• Restriction — request that a contested processing operation be frozen.
• Portability — receive your data in a machine-readable format.
• Withdrawal of consent — at any moment and without justification, without calling into question what was done before.
• Post-mortem directives — determine what is to become of your data after your death.

We implement technical and organisational measures adapted to the risk: encryption of communications, partitioning of access at the level of the data itself, reinforced encryption of the most sensitive information, traceability of administration operations, and the total absence of any storage of bank card numbers.

In the event of a data breach liable to give rise to a risk to your rights, we inform the CNDP and, where the risk justifies it, the persons concerned, within the time limits laid down by the applicable regulations.

The details are set out on our Security page.

FORLIK is aimed at a university population. The opening of an account is reserved for persons of full age, which you declare upon registration.

We do not collect a date of birth and do not seek to know the age of our users — that would be one more item of data with no necessity for it. We do not knowingly process the data of a minor; if such processing is reported to us, it is brought to an end and the data is deleted.

Our interfaces use only strictly necessary cookies and storage technologies. We place no advertising tracker and no third-party audience measurement tool. The details are set out in our cookie policy.

This policy may be updated. Any substantial modification is notified to you in the application or by message thirty days before it enters into force. The applicable version is the one dated in the header.

This policy is governed by Moroccan law. If our reply does not satisfy you, you may refer the matter to the CNDP (www.cndp.ma), the competent supervisory authority in Morocco. If you reside in the European Union, you may also refer the matter to the supervisory authority of your place of residence.

We invite you, however, to write to us first at support@forlik.com: most requests are settled within a few days.