Privacy Policy

Information about your rights regarding the protection of your personal data — in accordance with Moroccan Law No. 09-08 and the GDPR.

Version: March 2026

This Privacy Policy is intended to inform users of the hertz.ma website about the collection and use of their personal data, in accordance with Moroccan Law No. 09-08 and the General Data Protection Regulation (GDPR).

Data Controller

The entity responsible for processing the personal data collected through this website is:

• Name: STARC SAS

• Registered office: N12, 23 Rue Allal Ben Abdellah, corner of 33 Rue El Ouraibi Jilali, Casablanca, Morocco

• Contact email: reservation.starc@gbh.fr

• CNDP registration number: [To be completed]

Our Commitments

We protect your privacy by ensuring the protection, confidentiality, integrity, availability, and security of the personal data you entrust to us. We take all necessary measures to:

• Provide you with clear and transparent information about the collection and processing of your data;

• Implement technical and organizational measures to protect your data against disclosure, loss, alteration, or unauthorized access;

• Retain your data only for as long as necessary for the purposes for which it is processed;

• Allow you to access and update your data at any time through your personal account.

When Do We Collect Your Data?

Your personal data may be collected when you:

• Create an account on our website or mobile application;

• Make a ride reservation;

• Contact us via the contact form or by telephone;

• Visit our website (through cookies);

• Interact with us on social media;

• Exercise your data protection rights.

What Data Do We Collect?

We collect information that you provide to us, including:

• Identity data: first name and last name;

• Contact details: mobile phone number and email address;

• Ride data: pick-up and drop-off addresses and ride history;

• Payment data: payment method and transaction amounts;

• Browsing data: cookies, IP address, and pages visited.

In accordance with applicable regulations, we do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information.

How Do We Use Your Data?

Reservation Management

Processing your rides, sending confirmations by SMS, and handling billing.

Legal basis: Performance of a contract.

Website Browsing

Enabling website navigation and improving your user experience.

Legal basis: Consent.

Communication

Responding to your requests and keeping you informed about your rides and complaints.

Legal basis: Performance of a contract.

Payment Security and Fraud Prevention

Securing payments and detecting and preventing fraudulent activities.

Legal basis: Performance of a contract.

Service Improvement

Analyzing usage data to improve our services and offer you relevant promotions.

Legal basis: Consent and/or legitimate interests.

Legal Obligations

Disclosing data in response to legitimate requests from public authorities, where required by law.

Recipients of Your Data

Only authorized personnel within STARC SAS may access your data when necessary for their duties. Your data may also be disclosed to:

• Our technical service providers (hosting, payment processing, and SMS services), strictly within the scope of their assigned responsibilities;

• Competent authorities, where disclosure is required by law.

Any transfer of data to a third party is governed by a contract ensuring the protection of your personal data.

Data Storage and Retention Periods

Your data is hosted in Morocco or in countries recognized by the CNDP as providing an equivalent level of protection. Any transfer of data outside Morocco is subject to CNDP authorization.

Cookie Policy

A cookie is a text file stored on your device (computer, smartphone, or tablet) while you browse a website. It allows temporary information to be stored in order to improve your browsing experience.

Three types of cookies may be used:

Essential Cookies

These are necessary for the website to function properly, including session management and authentication. Consent is not required.

Analytics and Performance Cookies

These are used to measure website traffic, track pages visited, and improve our services. Consent is required.

Advertising Cookies

These are used to display targeted advertisements based on your interests. Consent is required.

No non-essential cookies are placed on your device until you have given your consent. You may manage your cookie preferences at any time through your browser settings or our consent banner.

Your Rights

Under Moroccan Law No. 09-08 and the GDPR, where applicable, you may have the following rights:

• Right of access;

• Right to rectification;

• Right to erasure;

• Right to data portability;

• Right to object;

• Right to restriction of processing;

• Right to withdraw consent;

• Right to establish post-mortem directives regarding your personal data;

• Right to lodge a complaint with the CNDP (Moroccan National Commission for the Control of Personal Data Protection).

How to Exercise Your Rights

To exercise your rights, please contact our Data Protection Officer (DPO):

• By email: dpo@hertz.ma

• By post: STARC SAS — DPO — N12, 23 Rue Allal Ben Abdellah, corner of 33 Rue El Ouraibi Jilali, Casablanca, Morocco

Proof of identity may be requested where necessary. We will respond to your request within a maximum period of one month.

Data Security

STARC SAS implements appropriate technical and organizational security measures, taking into account the sensitivity of the data, to protect it against malicious intrusion, loss, alteration, or disclosure to unauthorized third parties.

All individuals with access to your data are bound by a duty of confidentiality. Arrangements with third-party recipients are governed by contracts ensuring the protection of your personal data.

We encourage you to protect your devices (computer, smartphone, or tablet) with a strong password and to log out after each session when using a shared device.