Privacy policy · v1.1
Privacy Policy
How CareerAction collects, uses, shares and protects the personal data of candidates, partners and website visitors.
1. Who is responsible for your data
The controller is [company legal name], [legal form], registered in the Marrakech Trade Register under no. [RC], with its registered office at [address], Marrakech, Morocco ("CareerAction", "we"). For any question about your data, write to info@careeraction.ca.
We apply Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data. Where you are in the European Union, we also apply the General Data Protection Regulation (GDPR); where you are in Québec, the Act respecting the protection of personal information in the private sector (Law 25).
2. What data we collect
| Category | Examples |
|---|---|
| Identity and contact | Name, date of birth, nationality, passport details, email, phone, country of residence |
| Education and career | CV, diplomas, certificates, work history, languages, recommendation letters and their authors' contact details |
| Preferences | Target positions, departments, destinations, availability, goals |
| Assessment | Your answers to the personality and profile questionnaire, and the resulting scores and report |
| Eligibility documents | Proof of funds (e.g. bank statement), police or criminal-record certificate, where the partner programme requires them |
| Payment | Payment status, amount, date, transfer receipt and reference. We never collect card details |
| Partners | Name, role, work email and phone of partner contacts; contract and commission records |
| Technical | Log-in times, device and browser type, pages visited on our platform, and cookies strictly needed to run it |
3. Why we use it, and on what basis
| Purpose | Legal basis |
|---|---|
| Create your account, deliver the Passport to Success, answer your questions | Performance of our contract with you |
| Verify your documents and prepare your assessment and matches | Performance of our contract; your consent for the personality questionnaire |
| Send your file to the partner programme you choose | Your explicit consent, given for each partner |
| Take payments, keep accounts and invoices | Legal obligation |
| Follow up 30 days after you sign with a partner; improve our service | Our legitimate interest in service quality |
| Send you news or offers | Your consent, which you can withdraw at any time |
| Protect our platform and prevent fraud | Our legitimate interest; legal obligation |
4. Sensitive documents
Some partner programmes require a police or criminal-record certificate. You provide it only if the programme you choose requires it, and with your explicit consent. We use it only to forward it to that partner. We do not assess it, do not keep a register of criminal records, and delete it within 30 days of forwarding it. The same applies to proof of funds, which we check against the partner's published threshold and keep only as long as clause 9 states.
5. Automated matching
We use software, including AI tools, to score your questionnaire and to match your profile with open positions. A member of our team reviews every report before it is sent. The matching does not decide whether you are accepted; only a partner does that. You may ask for a human explanation of your results at info@careeraction.ca.
6. Who receives your data
- The partner you choose, and only with your consent: your CV, diplomas, recommendation letters, verification summary, signed contract and, where required, eligibility documents.
- Our service providers, who act on our instructions under contract: hosting and database, email, our bank, and AI tools used to prepare reports (see clause 7).
- Authorities, where the law requires it.
- We do not sell your data.
7. Where your data is stored
| Service | Provider | Location |
|---|---|---|
| Database and file storage | Supabase | Canada (Montréal) |
| Website and application hosting | Vercel | [United States / global network] |
| Hostinger | [to confirm] | |
| Payments | Bank [name] and money-transfer services (e.g. MoneyGram) | Morocco / provider's country |
| Report preparation (AI) | [provider] | [to confirm] |
8. Transfers outside Morocco
Your data is stored in Canada. Canada is among the countries that the Moroccan data protection authority (CNDP) recognises as providing adequate protection. Transfers to partners in other countries are made with your explicit consent and because they are needed for the service you asked for. We have declared these transfers to the CNDP: [CNDP declaration / authorisation reference].
9. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, assessment and report | 24 months after your last activity, then deleted or anonymised |
| Police or criminal-record certificate | Deleted within 30 days of forwarding to the partner |
| Proof of funds | Deleted 6 months after your report, or after forwarding to the partner |
| Invoices and accounting records | [10] years, as required by accounting law |
| Partner contracts and commission records | Duration of the contract plus [5] years |
| Marketing consent | Until you withdraw it |
10. Your rights
You may ask to access your data, correct it, object to its use for legitimate reasons, or withdraw a consent at any time. Where the GDPR or Law 25 applies, you may also ask for erasure, restriction or a copy in a portable format. Write to info@careeraction.ca with a copy of an identity document; we answer within 30 days. You may also complain to the CNDP (www.cndp.ma), or to the data protection authority where you live.
11. Security
We encrypt data in transit and at rest, restrict access to the staff who need it, log access to candidate files, and require our providers to protect data to the same standard. If a breach puts your rights at risk, we inform you and the competent authority as the law requires.
12. Cookies
Our platform uses only the cookies needed to log you in, keep your session secure and remember your language. We do not use advertising cookies. If we add analytics cookies, we will ask for your consent first.
13. Minors
The service is for people aged 18 and over. We do not knowingly collect data from minors and delete it if we learn we have.
14. Changes
We may update this policy. We publish each version with its date and tell registered users by email about any significant change.
Version 1.1 · [date of publication]