Privacy Policy

1. Identity Verification (KYC) & Biometric Data Consent

By proceeding, I confirm that the identity document and facial scan I provide are authentic, current, and belong to me. I authorize Alya Pay to capture, process, and verify this biometric and identity data - including comparing my facial scan against my ID document - for the purpose of identity verification, fraud prevention, and compliance with applicable Know Your Customer (KYC) obligations in Morocco. I understand this data will be processed in accordance with this Privacy Policy and Law 09-08 on the protection of personal data.

I specifically consent to the processing of my biometric data (facial scan) for identity verification purposes, as described above.

2. Data Protection & Use of Personal Information (Law 09-08)

Who processes your data. Alya Pay, as data controller, processes your personal data in accordance with Law 09-08 and its implementing decrees on the protection of personal data.

What data we collect.

• Identity data: full name, date and place of birth, nationality, national ID/CIN number or passport number, copy of your ID document, your facial scan/photo captured during onboarding.
• Contact data: phone number, email address, home address.
• Financial & transaction data: income or employment information you provide, purchase history, repayment history, payment method details (e.g. tokenized card data), outstanding balances.
• Credit data: information obtained from credit bureaus authorized in Morocco, as authorized under our Terms & Conditions.
• Technical & usage data: device identifiers, IP address, app usage logs, geolocation (if enabled), data needed for fraud-detection and security purposes.

Why we collect it (purposes). We use this data to: (i) verify your identity and prevent fraud or identity theft; (ii) assess your creditworthiness and decide whether to approve a purchase or payment plan; (iii) manage and collect on your account, including sending reminders or pursuing recovery in case of default; (iv) comply with our legal and regulatory obligations (including KYC/AML obligations and reporting to supervisory authorities); (v) provide customer support; (vi) improve and secure our app; and (vii), only where you separately opt in, send you marketing communications.

Legal basis. Processing is based on: your consent (for biometric data and, where applicable, marketing); the necessity to perform our contract with you (for account management, payments, and credit decisions); and our legitimate interest or legal obligation (for fraud prevention, AML/KYC compliance, and regulatory reporting).

Who we share it with. We may share your data with: authorized credit bureaus operating in Morocco; banks and payment partners that process your transactions; regulators and supervisory authorities (e.g. Bank Al-Maghrib) where legally required; debt collection agencies or legal counsel in case of default; and IT/hosting service providers who process data on our behalf under confidentiality and security obligations. We do not sell your personal data to third parties.

International transfers. Where we use external service providers located outside Morocco to process parts of your personal data on our behalf, each such provider is bound by a data processing addendum (DPA) requiring them to protect your data to a standard consistent with Law 09-08, including appropriate safeguards for any transfer of your data outside Morocco.

How long we keep it. We retain your data for as long as your account is active, and we continue to retain it after account closure or final repayment unless and until you ask us to delete it. This is subject to any records we are legally required to keep for longer - such as identity verification, transaction, and KYC/AML-related records - to meet our legal, accounting, tax, and regulatory obligations, even after a deletion request.

Your rights. Under Law 09-08, you have the right to: access the personal data we hold about you; request correction of inaccurate data; object, on legitimate grounds, to certain processing; and request deletion of your data, subject to our legal retention obligations. You can exercise these rights at any time by contacting us at support@alyapay.com.

Security. We apply technical and organizational measures (encryption, access controls, audit logging) appropriate to the sensitivity of the data, in particular for biometric and financial data.