Merchant Privacy Policy

1. Data Protection & Use of Merchant Information (Law 09-08)

Who processes your data. Alya Pay, as data controller, processes your data in accordance with Law 09-08 and its implementing decrees on the protection of personal data.

What data we collect.

• Identity data: company name, trade name, RC (Registre de Commerce), ICE (Identifiant Commun de l'Entreprise), IF (Identifiant Fiscal), patent number, name and identity document (CIN or passport) of the legal representative.
• Contact information: merchant email address, phone number, business address, store locations.
• Banking information: settlement bank account details, RIB/IBAN, bank name.
• Business information: activity sector, website, VAT information, business licenses (where applicable).
• Platform usage data: login history, IP addresses, device information, dashboard activity, audit logs.
• Transaction data: orders, BNPL transactions, refunds, commissions, settlement reports.

Why we collect it (purposes). We use this data to: (i) onboard merchants and verify their eligibility to use the Alya Pay platform; (ii) perform merchant due diligence and comply with KYC/AML obligations; (iii) manage the ongoing commercial relationship, including contracts and communications; (iv) process settlements and payments to your bank account; (v) prevent fraud and ensure platform security; (vi) provide customer support; (vii) comply with our legal and regulatory obligations, including reporting to supervisory authorities; and (viii) produce accounting and settlement reports.

Legal basis. Processing is based on: the necessity to perform our contract with you (for onboarding, settlement, and commercial relationship management); our legal obligation (for KYC/AML compliance and regulatory reporting); and our legitimate interest (for fraud prevention, platform security, and audit logging). Personal data of the legal representative (identity document) is processed on the basis of explicit consent.

Who we share it with. We may share your data with: payment processors involved in transaction processing and settlement; banking partners that handle fund transfers to your account; regulators and supervisory authorities (e.g. Bank Al-Maghrib) where legally required; hosting and infrastructure providers who process data on our behalf under confidentiality and security obligations; and accounting providers where applicable. We do not sell your data to third parties.

International transfers. Where we use external service providers located outside Morocco to process parts of your data on our behalf, each such provider is bound by a data processing addendum (DPA) requiring them to protect your data to a standard consistent with Law 09-08, including appropriate safeguards for any transfer of your data outside Morocco.

How long we keep it. We retain your data for as long as your merchant account is active, and we continue to retain it after account closure unless and until you ask us to delete it. This is subject to any records we are legally required to keep for longer - such as KYC/AML records, transaction history, and accounting data - to meet our legal, tax, and regulatory obligations, even after a deletion request.

Your rights. Under Law 09-08, you have the right to: access the data we hold about you; request correction of inaccurate data; object, on legitimate grounds, to certain processing; and request deletion of your data, subject to our legal retention obligations. You can exercise these rights at any time by contacting us at support@alyapay.com.

Security. We apply technical and organizational measures (encryption, access controls, audit logging) appropriate to the sensitivity of the data, including banking and identity information.