Data Breach Policy

Purpose

This policy establishes the framework for responding to personal data breaches in compliance with GDPR Article 33-34 and Morocco's CNDP regulations.

Definition

A personal data breach is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Detection & Reporting

All employees must report suspected breaches to the Data Protection Officer (DPO) immediately via [email protected] or the internal security hotline. Automated monitoring systems also detect anomalies 24/7.

Assessment

The DPO assesses each incident within 24 hours to determine: (a) nature and scope of the breach, (b) categories of data affected, (c) approximate number of individuals affected, (d) likely consequences, and (e) measures taken or proposed.

Notification to Authorities

If the breach is likely to result in a risk to individuals' rights and freedoms, we notify the CNDP within 72 hours. The notification includes breach description, DPO contact, likely consequences, and remediation measures.

Notification to Individuals

If the breach is likely to result in a high risk to individuals, we notify affected persons without undue delay via email and in-platform notification, describing the breach in clear language.

Remediation

Immediate containment actions are taken, followed by root cause analysis, system hardening, and process improvements. All actions are documented in our breach register, retained for 5 years.

Contact

Data Protection Officer: [email protected] Security Team: [email protected] Customer Obsession SARL, Casablanca, Morocco

Questions about this data breach policy? Contact us.

Document Version History

3.0

January 1, 2026

Major update: Added CNDP alignment, expanded data breach procedures, SLA formalization.

2.1

July 15, 2025

Minor update: Updated sub-processor list, clarified cookie retention periods.

2.0

January 1, 2025

GDPR alignment update, added accessibility statement, expanded privacy rights.

1.0

June 1, 2024

Initial publication of all legal documents.

Language Notice

This document is available in English, French, and Arabic. In the event of any discrepancy between language versions, the French version shall prevail for Moroccan operations, and the English version for international operations. Translations are provided for convenience only.

Applicability by Brand

CloudLink: Additional enterprise SLA terms may apply for dedicated infrastructure clients.

Toutsuite: Moroccan fiscal compliance addendum applies to all ERP clients.

Twily: Legal service retainer agreements supersede general terms where applicable.

Jungle: Web development project terms are governed by individual SOWs.

Sure: Marketplace terms of sale apply between buyers and vendors independently.

Jurisdiction & Governing Law

Morocco

Law 09-08 (Data Protection), Code de Commerce

Casablanca Commercial Court

European Union

GDPR (Regulation 2016/679)

Local competent court per consumer domicile

United States

CCPA, State consumer protection laws

State of Delaware courts