Privacy Policy

Privacy Policy — Laboralim

Last updated: 11 July 2026

1. Controller / Responsible Party

Laboralim

320 Bd Mohamed Zerktouni, 22000 Casablanca, Morocco

Legal representative: Dr. Btissam Ennaffah (Managing Director)

Email: contact@laboralim.ma

Phone: +212 660 933 072

For all data-protection enquiries: contact@laboralim.ma

2. Representative in the EU (Art. 27 GDPR)

As we are established outside the EU and offer services to data subjects in the European Union, the following representative has been appointed pursuant to Art. 27 GDPR:

KMU-KI, Kreherstr. 6, 09126 Chemnitz, Germany — Email: goedecke@kmu-ki.org

You may exercise your GDPR rights with the EU representative or directly with the controller at the address above.

3. Overview

We take the protection of your personal data seriously. This Privacy Policy explains what data we collect when you visit laboralim.ma, how we use it, on what legal basis, and what rights you have.

This website is directed at professional clients and partners, primarily in the European Union and Morocco. To the extent EU/EEA residents interact with this website, the General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") applies. In addition, Moroccan Law No. 09-08 on the protection of personal data applies.

4. Data We Collect

4.1 When You Visit the Website (Server Log Files)

When you access our website, your browser automatically transmits the following data to the hosting server:

IP address — truncated by removing the last octet (IPv4) / last 80 bits (IPv6) at the time of logging; the full IP address is not stored in clear text
Date and time of access
Pages visited
Browser type and version
Operating system
Referring URL (domain only)

Legal basis: Art. 6(1)(f) GDPR — Legitimate interest in ensuring secure and functional website operation, in detecting and defending against attacks (e.g. DDoS) and in basic error analysis.

Retention: 7 days, then deleted automatically. Logs are stored on EU servers operated by our hosting provider Lovable AB (Stockholm, Sweden) on AWS Europe infrastructure.

4.2 When You Use Our Contact Form or Email

If you contact us via a form or by email, we collect:

Your name
Your email address
Your company name (optional)
Your message / inquiry content

Legal basis: Art. 6(1)(b) GDPR — Processing necessary for pre-contractual or contractual measures; Art. 6(1)(f) GDPR — Legitimate interest in responding to inquiries.

Retention: 12 months after the last contact, unless a business relationship requires longer retention. Form submissions are stored in our database hosted by Supabase Inc. in the EU region (Frankfurt, Germany).

4.3 When You Request a Quote or Submit a Sample Request

In the course of a business inquiry or sample submission, we may collect additional professional data:

Name and position
Company name and address
Product / commodity information
Desired analyses

Legal basis: Art. 6(1)(b) GDPR — Performance of a contract or pre-contractual measures.

Retention: invoicing and accounting documents 10 years (in line with the Moroccan Code Général des Impôts and, where applicable, EU national tax and commercial laws such as § 257 HGB in Germany); general commercial correspondence 6 years.

4.4 Cookieless Reach Measurement (own statistics)

To understand how our website is used we operate our own privacy-friendly, cookieless statistics service. For each page view we transmit the following data to our own backend (Supabase Edge Function "track-view") and store it in our database:

The visited page path (truncated to 500 characters, no query parameters)
Referrer domain only (no full URL, no query parameters)
Device category (desktop / mobile / tablet)
Two-letter ISO country code derived from edge headers (no IP address is stored)
A coarse timestamp

Legal basis: Art. 6(1)(f) GDPR — Legitimate interest in the statistical evaluation of website use and the improvement of our content. We do not set cookies for this purpose, do not create user profiles and do not transmit data to third parties.

Retention: aggregated for 24 months, then deleted. You may object to this processing at any time at contact@laboralim.ma; we will then exclude your visits from the statistics.

5. Cookies and Local Storage

We use only strictly necessary cookies and a small number of optional functional / analytics technologies. Before any non-essential storage is accessed, we obtain your consent through a cookie banner (legal basis: Art. 6(1)(a) GDPR in conjunction with the ePrivacy Directive 2002/58/EC and equivalent national rules, e.g. § 25(1) TDDDG/TTDSG in Germany). Your choice is stored in your browser under the key "laboralim-cookie-consent" for 12 months. You can change or withdraw your consent at any time via the "Cookie settings" link in the footer, without affecting the lawfulness of prior processing.

Name / Key	Provider	Type	Purpose	Duration
laboralim-cookie-consent	Laboralim (own)	localStorage	Stores your cookie preferences and consent timestamp	12 months
laboralim-lang	Laboralim (own)	localStorage	Stores your selected interface language (functional)	12 months
__lovable_anonymous_id, __lovable_session	Lovable (GPT Engineer AB, Sweden)	localStorage	Anonymous platform identifiers set by our hosting provider for the operation and delivery of the website	Persistent / session
Session cookie	Laboralim (own)	HTTP cookie	Maintains basic website functionality during your visit	Session only

Categories presented in the banner: Essential (always active, no consent required), Functional (optional comfort features such as remembering your language) and Analytics (only the cookieless reach measurement described in section 4.4). We do not set or use any other tracking keys (e.g. no shopifySelectors or debug keys are written by this website).

6. AI-Powered Translation

This website uses an integrated AI translation function to display content in multiple languages (English, French, Spanish, German, Arabic). Translation requests are routed through the Lovable AI Gateway and processed by underlying large-language-model providers (e.g. Google Gemini, OpenAI, Anthropic), which may be located in third countries (in particular the USA). Such transfers are based on EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and supplementary measures.

Legal basis: Art. 6(1)(f) GDPR — Legitimate interest in offering a multilingual website to a professional, international audience.

Please do not enter sensitive personal data into fields that are dynamically translated. Static content (this page, navigation, etc.) is translated without any user input.

7. Processors and Recipients

We engage carefully selected processors to operate this website. Data processing agreements pursuant to Art. 28 GDPR are in place with each of them:

Provider	Location	Purpose	Transfer mechanism
Supabase Inc.	EU region (Frankfurt, Germany)	Database, edge functions, file storage, authentication	Art. 28 GDPR DPA; EU hosting
Lovable AI Gateway	EU + third-country model providers	Routing of AI translation requests	Art. 28 GDPR DPA; EU SCCs (2021/914) for US sub-processors
Lovable / GPT Engineer AB (Stockholm, SE)	EU (AWS Europe / Frankfurt region) + platform script served via cdn.gpteng.co	Website hosting, log management, content delivery and operation of the website platform (sets anonymous IDs in localStorage: __lovable_anonymous_id, __lovable_session)	Art. 28 GDPR DPA; legitimate interest under Art. 6(1)(f) GDPR for platform operation
FlagCDN (operated by Vercel Inc., USA — globally distributed CDN)	Global CDN with points of presence including the USA	Delivery of country flag images in the language switcher	Legitimate interest under Art. 6(1)(f) GDPR; your IP address, user agent and requested image URL are transmitted to the CDN provider. Third-country transfer to the USA relies on EU SCCs (2021/914).

We do not use Google Analytics, advertising networks, retargeting pixels, social-media plugins (Facebook, LinkedIn, etc.) or any third-party chatbot widgets. Website fonts (Inter, Instrument Serif) are self-hosted — no requests are made to Google Fonts / fonts.gstatic.com.

8. International Data Transfers (Morocco and Beyond)

Personal data we collect through this website is primarily processed on EU servers (see section 7). To the extent personal data is transferred to our headquarters in Casablanca, Morocco, please note: as of June 2026, Morocco is not covered by an adequacy decision of the European Commission. Such transfers therefore take place on the basis of EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by a Transfer Impact Assessment (TIA) in line with EDPB Recommendations 01/2020 and additional technical measures (encryption in transit and at rest, pseudonymisation, strict access controls).

You may obtain a copy of the safeguards in place by contacting contact@laboralim.ma.

9. Your Rights Under the GDPR

As a data subject, you have the following rights under Articles 15–22 GDPR:

Right of access (Art. 15) — You may request confirmation of whether we process your personal data and receive a copy.
Right to rectification (Art. 16) — You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17) — You may request deletion of your data, subject to legal retention obligations.
Right to restriction of processing (Art. 18) — You may request that we restrict the processing of your data.
Right to data portability (Art. 20) — You may request your data in a structured, machine-readable format.
Right to object (Art. 21) — You may object at any time to processing based on legitimate interest (Art. 6(1)(f)), including the cookieless reach measurement described in section 4.4.
Right to withdraw consent (Art. 7(3)) — Where processing is based on consent (e.g. functional cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at: contact@laboralim.ma. We will respond within 30 days of receiving your request (Art. 12(3) GDPR).

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. In the EU/EEA, this is the data protection authority of your country of residence; a full list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In Morocco, the competent authority is:

Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) — www.cndp.ma

11. Data Security

We implement appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your personal data against unauthorised access, loss or misuse. These include: TLS/HTTPS encryption for all connections, encryption at rest of stored data, multi-factor authentication for administrative access, regular backups, principle of least privilege and continuous logging of administrative actions.

12. No Data Protection Officer

We have not appointed a Data Protection Officer because the conditions of Art. 37 GDPR are not met (our core activities do not require regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special categories of data). Data-protection enquiries reach us directly at contact@laboralim.ma.

13. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Links to Third-Party Websites

Our website may contain links to external websites. This Privacy Policy applies solely to laboralim.ma. We have no control over and accept no responsibility for the privacy practices of third-party websites.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or our data processing practices. The current version is always available at: laboralim.ma/privacy.

The date at the top of this document indicates when it was last updated.

16. Contact

For all data protection enquiries, please contact: