Privacy Policy

Article 1 — Identity Verification (KYC) & Biometric Data Consent

When you complete identity verification with Alya, you confirm that the identity document and facial scan you provide are authentic, current, and belong to you. You authorize Alya to capture, process, and verify this biometric and identity data - including comparing your facial scan against your ID document - for the purpose of identity verification, fraud prevention, and compliance with applicable Know Your Customer (KYC) obligations in Morocco. This data is processed in accordance with this Privacy Policy and Law 09-08 on the protection of personal data.

Alya processes your biometric data (facial scan) for identity verification purposes, as described above, only with your specific consent.

Article 2 — Data Protection & Use of Personal Information (Law 09-08)

2.1. Who processes your data

Alya, as data controller, processes your personal data in accordance with Law 09-08 and its implementing decrees on the protection of personal data.

2.2. What data we collect

• Identity data: full name, date and place of birth, nationality, national ID/CIN number or passport number, copy of your ID document, your facial scan/photo captured during onboarding.
• Contact data: phone number, email address, home address.
• Financial & transaction data: income or employment information you provide, purchase history, repayment history, payment method details (e.g. tokenized card data), outstanding balances.
• Credit data: information obtained from credit bureaus authorized in Morocco, as authorized under our Terms & Conditions.
• Technical & usage data: device identifiers, IP address, usage logs of our services, geolocation (if enabled), data needed for fraud-detection and security purposes.

2.3. Why we collect it (purposes)

We use this data to: (i) verify your identity and prevent fraud or identity theft; (ii) assess your creditworthiness and decide whether to approve a purchase or payment plan; (iii) manage and collect on your account, including sending reminders or pursuing recovery in case of default; (iv) comply with our legal and regulatory obligations (including KYC/AML obligations and reporting to supervisory authorities); (v) provide customer support; (vi) improve and secure our services; and (vii), only where you separately opt in, send you marketing communications.

2.4. Legal basis

Processing is based on: your consent (for biometric data and, where applicable, marketing); the necessity to perform our contract with you (for account management, payments, and credit decisions); and our legitimate interest or legal obligation (for fraud prevention, AML/KYC compliance, and regulatory reporting).

2.5. Who we share it with

We may share your data with: authorized credit bureaus operating in Morocco; banks and payment partners that process your transactions; regulators and supervisory authorities (e.g. Bank Al-Maghrib) where legally required; debt collection agencies or legal counsel in case of default; and IT/hosting service providers who process data on our behalf under confidentiality and security obligations. We do not sell your personal data to third parties.

2.6. International transfers

Where we use external service providers located outside Morocco to process parts of your personal data on our behalf, each such provider is bound by a data processing addendum (DPA) requiring them to protect your data to a standard consistent with Law 09-08, including appropriate safeguards for any transfer of your data outside Morocco.

2.7. How long we keep it

We retain your data for as long as your account is active, and we continue to retain it after account closure or final repayment unless and until you ask us to delete it. This is subject to any records we are legally required to keep for longer - such as identity verification, transaction, and KYC/AML-related records - to meet our legal, accounting, tax, and regulatory obligations, even after a deletion request.

2.8. Your rights

Under Law 09-08, you have the right to: access the personal data we hold about you; request correction of inaccurate data; object, on legitimate grounds, to certain processing; and request deletion of your data, subject to our legal retention obligations. You can exercise these rights at any time by contacting us at support@alyapay.com.

2.9. Security

We apply technical and organizational measures (encryption, access controls, audit logging) appropriate to the sensitivity of the data, in particular for biometric and financial data.