Personal data protection

Personal data is processed in accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data, its implementing decree and the decisions of the CNDP.

The data controller is the CNCLT. For any question about your data: [contact point / data protection officer — email]. The processing is subject to the required formalities with the CNDP [declaration / authorisation no.].

The platform processes the following categories of data:

• Organisation (CSO) data: name, legal status, receipt number, areas of intervention, geographical area, contact details and supporting documents provided with the membership application.
• User account data: identity, position, email address, and connection data (logs, IP address, browsing data) for security and traceability purposes.
• Activity data: indicators reported by organisations (number of beneficiaries supported, people reached by awareness-raising, cases referred). These indicators are processed in aggregated, statistical form, without identifying the individuals concerned.
• Cookies and trackers: see the “Cookie policy” page.

The platform may process data originating from associations and, in the context of combating trafficking, information that may be sensitive and relate to victims or suspected cases. The following safeguards apply:

• Victims’ identity is never published: no data that could identify a victim, directly or indirectly, is published or made publicly accessible. Publishing the identity of victims, or any element likely to reveal it, is strictly prohibited.
• Cases handled outside the public platform: the reporting and handling of trafficking cases fall under the CNCLT’s dedicated mechanism; they are not collected or published through the public portal.
• Access permissions: access to data is strictly limited according to each user’s role (role-based access control), on a need-to-know basis. Accounts are personal and every sensitive operation (viewing, approval, modification, deletion) is recorded in a time-stamped audit log.
• Retention periods: data is kept only for as long as necessary for the purposes pursued (for guidance: account and profile data for the duration of the registration, then [12] months after deactivation; supporting documents for the duration of membership [+ applicable legal period]; audit and connection logs [12] months; cookies [13] months maximum). After that, data is deleted or anonymised.
• Deletion and anonymisation: data is securely deleted or irreversibly anonymised when the retention periods expire, or following an admissible request from the data subject.

Data is processed for: managing memberships and the CSO directory; publishing content and resources after approval; producing aggregated activity statistics; the security, traceability and proper functioning of the platform.

Depending on the case, processing is based on the consent of the data subject, the performance of a public-interest task entrusted to the CNCLT, and compliance with legal obligations.

Data is intended for the authorised departments of the CNCLT and, where applicable, for the technical service provider acting as a processor, bound by confidentiality. No data is transferred to third parties for commercial purposes.

Technical and organisational measures are in place: encrypted exchanges (HTTPS/TLS), role management, strong authentication, logging, backups and access restrictions.

In accordance with Law No. 09-08, everyone has the right to access, rectify, object to and delete their data. These rights can be exercised with [contact point / email], upon proof of identity. You may also refer the matter to the CNDP.

This policy may be updated; the date of the last update is shown below. [Last updated: … 2026].