1. Data controller

EI GHALI KHOMSI, sole proprietorship registered with the French National Business Register (RNE), trade name MOROSKO, SIREN 995 260 460, 35 rue du Sergent Bauchat, 75012 Paris (France). Data contact: contact@morosko.ma · +212 6 84 73 08 21.

2. Data, purposes, legal bases and retention

• Orders and delivery (identity, addresses, email, phone, order content and amount, parcel tracking, exchanges with customer service): performance of the contract (art. 6.1.b GDPR). Retention: for the duration of the business relationship, then 5 years (limitation period). Accounting records: 10 years (French Commercial Code L123-22).
• Archiving of contracts of €120 or more: legal obligation (French Consumer Code L213-1), 10 years.
• Payment and fraud prevention: performance of the contract and legitimate interest. Card data is processed by Stripe; Morosko does not receive it.
• Newsletter: consent, which can be withdrawn at any time through the unsubscribe link. Retention: until you unsubscribe, or 3 years without interaction.
• Contact form and workshop applications: legitimate interest in replying. Retention: 3 years after the last contact; an application that is not accepted is deleted at the end of the review.
• Sign in with Google (« Continue with Google » button and Google One Tap prompt): if you choose to sign in with Google, we receive from Google your name, email address, profile photo and Google identifier. Purpose: creating your customer account and signing you in. Legal basis: performance of the contract, at your request (Art. 6(1)(b) GDPR). Recipient: Google Ireland Ltd.; transfers to the United States are possible, covered by the EU–US Data Privacy Framework. Retention: for the life of your account.
• Form protection (Google reCAPTCHA): when you use a protected form (for example customer or artisan registration), Google's reCAPTCHA service checks that the request does not come from a bot. Purpose: protection against bots. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Recipient: Google.
• Audience measurement and order attribution (Google Analytics, Google Tag Manager, WooCommerce attribution cookies): consent (Art. 6(1)(a) GDPR), collected through the cookie banner. You accept by clicking « Accepter » (Accept) or by continuing to browse (scrolling the page or clicking outside the banner). Clicking « Refuser » (Refuse), « En savoir plus » (Learn more) or « Gérer les cookies » (Manage cookies) does not count as acceptance. You can withdraw your consent at any time via the « Gérer les cookies » (Manage cookies) link at the bottom of the page. Retention: 13 months for cookies, 25 months for data.
• Partner artisans: proof of acceptance of the seller agreement. When an artisan accepts the seller agreement online, we record their full name (as shown on their national identity card), together with the date, time, their email address, the IP address and the version of the agreement accepted. This data is used solely to prove acceptance of the seller agreement and to pay the artisan the amounts due to them. The national identity card (CIN) number is not requested. This data is kept for the term of the agreement plus 5 years, then deleted. For artisans residing in Morocco, this data is also processed in accordance with Law No. 09-08; you may exercise your rights by writing to admin@morosko.ma and may lodge a complaint with the CNDP (www.cndp.ma).
• Identity check and payment of partner artisans. Before the first payout, and whenever their bank details (RIB) change, Morosko asks the artisan for a photo of their national ID card (CIN, front and back) and their RIB. Purpose: to check that the name on the CIN and on the RIB matches the full name given at sign-up, then to make the payouts. Legal basis: performance of the vendor agreement. Recipients: Morosko administrators only. Files are private and stored with the website's hosting provider. The RIB is passed to the bank to make the transfer. Data is never sold and is shared with authorities only where the law requires it. Retention: the ID photo is deleted no later than 30 days after the check; Morosko keeps only the note "identity verified on …". The RIB is kept for the term of the agreement, then for 10 years with the payment records (accounting obligations), and then deleted. Your rights: under Moroccan law no. 09-08, you can access, correct, object to the processing of, or ask for the deletion of your data by writing to admin@morosko.ma. We reply within 1 month. You can also contact the CNDP, the Moroccan data protection authority (www.cndp.ma).

3. Recipients and processors

Hostinger International Ltd. (hosting, Cyprus); Stripe Payments Europe Ltd. (payment, Ireland) and, depending on the method chosen, Apple Pay, Google Pay, Klarna, Amazon Pay or Link; Google Ireland Ltd. (audience measurement: Google Analytics, Google Tag Manager, only if you accept it; see §2 and §6); Google Ireland Ltd. (purpose: on-demand translation, when you choose English with the FR/EN switcher; possible transfer to the United States); the carrier in charge of delivery and customs clearance; the chartered accountant; the artisans and workshops in Morocco, only for the information needed to prepare the order. No data is sold.

4. Transfers outside the European Union

Pieces are shipped from Paris (France), and the data controller accesses data from Morocco. Morocco is not covered by an adequacy decision of the European Commission: these transfers are governed by the European Commission’s standard contractual clauses (art. 46 GDPR) or, for the performance of your order, by art. 49.1.b GDPR. Some providers (Google, Stripe) may transfer data to the United States, under the EU–US Data Privacy Framework or standard contractual clauses. A copy of the safeguards is available on request.

5. Your rights

Access, rectification, erasure, restriction, objection, portability, withdrawal of consent at any time, and instructions on what happens to your data after your death. Write to contact@morosko.ma (reply within one month). You can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

6. Cookies

Necessary cookies. Some cookies are essential for the site to work: cart, session, payment security (Stripe) and storing your cookie choice (mk_consent_v2). They are set without consent (art. 82 of the French Data Protection Act).

Functional cookies: Sign in with Google (Google One Tap). Google's script (accounts.google.com) is loaded only after you accept, in the same way as for measurement cookies (clicking « Accepter » (Accept), scrolling the page or clicking outside the banner), or when you click « Continue with Google ». Google may then set the g_state cookie, which remembers whether the prompt was shown or closed. When you sign in, the googlesitekit_auth_nonce security cookie (15 minutes) is set. If you refuse, the script is not loaded and the prompt is not shown.

reCAPTCHA (Google): Google's script (www.google.com/recaptcha) is loaded only when you interact with a protected form (clicking or typing in a field, or submitting the form). It is not loaded when pages open.

Audience measurement and attribution cookies (Google Analytics, Google Tag Manager, WooCommerce attribution). None of these cookies is set and no measurement tool is activated until you have made a choice. They are set only after you accept, either by clicking « Accepter » (Accept) or by continuing to browse (scrolling the page or clicking outside the banner), as stated in the banner. Clicking « Refuser » (Refuse), « En savoir plus » (Learn more) or « Gérer les cookies » (Manage cookies) does not count as acceptance. If you refuse, no measurement cookie is set.

Your choice is kept for 6 months. You can change it or withdraw your consent at any time, as easily as you gave it, via the « Gérer les cookies » (Manage cookies) link at the bottom of every page. Measurement cookies last 13 months at most.

Advertising cookies. No advertising cookies are used at present. Before any advertising tool is activated (for example Meta or TikTok), this policy will be updated, and those cookies will be subject to the same consent as measurement cookies.

Transfers. Audience measurement data may be transferred by Google to the United States, under the EU–US Data Privacy Framework or standard contractual clauses (see §4).

To adapt the site's language, we determine your approximate country from your IP address, without storing it (IP Geolocation by DB-IP database, https://db-ip.com, CC BY 4.0 licence).

7. Minors

The site is not intended for children under 15. Placing an order requires legal capacity to contract.

8. Last update

27 October 2026: §2, partner artisans: the CIN number is no longer requested; before the first payout, the check is on the name (CIN and RIB).

27 October 2026: §4, shipping location updated (shipped from Paris, as in the Terms of Sale and the Shipping page).

20 October 2026: Google reCAPTCHA added (protection of forms against bots, loaded only when a form is used).

20 October 2026: Sign in with Google added (button and Google One Tap). Previous version: 19 October 2026.