Data processing agreement

1. Parties and purpose

This agreement supplements the Terms of service between the customer agency (the “Agency”, controller) and the publisher of SAYRIVO (“SAYRIVO”, processor). It applies whenever SAYRIVO processes personal data on the Agency's behalf. It meets the obligations Moroccan law 09-08 places on processors.

It is accepted together with the terms of service, without a separate signature. A signed copy can be provided on request.

2. Description of the processing

Item	Description
Data subjects	The Agency's customers (renters and additional drivers), people who send a request from its booking page, and the Agency's users.
Data	Identity and contact details: name, phone, email, address, date of birth, nationality. Documents: photos or scans of the national ID card, passport and driving licence, and the fields read from them (numbers, validity dates). Reservations, contracts and on-screen signatures. Payments and deposits. Vehicle photos and inspections. Notes entered by the Agency.
Special categories	The Service is not designed for special-category data (health, opinions, etc.): the Agency does not record any. No biometric processing is done on document photos.
Purposes	Providing the Service to the Agency: managing reservations, drawing up contracts, checking the renter's identity and licence, tracking payments and vehicles, receiving requests from the public page.
Operations	Collection through the app, hosting, consultation, automatic reading of document fields by AI, document generation, notifications, backup, deletion.
Duration	The term of the contract, then deletion under section 12.

Data subjects
Description
The Agency's customers (renters and additional drivers), people who send a request from its booking page, and the Agency's users.
Data
Description
Identity and contact details: name, phone, email, address, date of birth, nationality. Documents: photos or scans of the national ID card, passport and driving licence, and the fields read from them (numbers, validity dates). Reservations, contracts and on-screen signatures. Payments and deposits. Vehicle photos and inspections. Notes entered by the Agency.
Special categories
Description
The Service is not designed for special-category data (health, opinions, etc.): the Agency does not record any. No biometric processing is done on document photos.
Purposes
Description
Providing the Service to the Agency: managing reservations, drawing up contracts, checking the renter's identity and licence, tracking payments and vehicles, receiving requests from the public page.
Operations
Description
Collection through the app, hosting, consultation, automatic reading of document fields by AI, document generation, notifications, backup, deletion.
Duration
Description
The term of the contract, then deletion under section 12.

3. The Agency's instructions

SAYRIVO processes this data only on the Agency's documented instructions: this agreement, the terms of service and the Agency's use of the Service's features. SAYRIVO does not use it for its own purposes, except for anonymous, aggregated statistics. If an instruction seems unlawful to SAYRIVO, it tells the Agency.

4. The Agency's obligations

Have a legal basis for every item of data recorded, and ask only for the documents a rental requires.
Inform its customers about the processing of their data, including the automatic reading of documents and its use of SAYRIVO as a provider.
Set how long copies of documents and contracts are kept, and delete what is no longer needed.
Make the filings and authorisation requests it is responsible for with the CNDP or any other competent authority.
Answer its customers' requests about their data, with SAYRIVO's help.

5. Identity documents and AI reading

Copies of documents are kept in private storage, reserved for the Agency's authorised users, and open only through temporary links.
When a user starts reading a document, the image is sent to an AI provider (Anthropic, or OpenAI where configured: see the Sub-processor list) solely to read its fields. The image is reduced if it is too large.
The provider does not use this data to train its models and keeps it only for the limited period set in its commercial API terms.
The result is a proposal: it pre-fills a form the user checks, and uncertain fields are flagged. The Service takes no automated decision with legal effects on anyone.
No facial recognition or biometric comparison is performed.
The Agency can always enter the information by hand without using automatic reading.

6. Confidentiality

People authorised to process this data at SAYRIVO are bound by confidentiality and access it only when necessary: to answer an Agency request, resolve an incident or run the Service.

7. Security measures

Encryption in transit (HTTPS/TLS) and encryption at rest at the host.
Each agency's data isolated by access rules inside the database, tested against access from one agency to another.
Per-user roles and rights within the Agency; passwords never stored in plain text; passkeys.
Logging of security events and AI feature calls, with usage limits.
Daily backups, including one copy outside the main host.
Regular updates of the software and its dependencies.

8. Sub-processors

The Agency authorises SAYRIVO to use the sub-processors listed in the Sub-processor list. SAYRIVO binds them to data protection obligations equivalent to this agreement and remains responsible to the Agency for their compliance.

SAYRIVO tells the Agency by email at least 30 days before adding or replacing a sub-processor that handles its customers' data. The Agency may object on reasonable grounds. If no solution is found, it may terminate without penalty and be refunded for the unused period already paid.

9. International transfers

The data is hosted in the European Union (Ireland). Some sub-processors, including the AI providers, are based in the United States. These transfers take place within the framework of law 09-08 (CNDP declaration in progress).

10. Assistance to the Agency

Data subject requests: the Agency views and corrects its customers' records in the app. For deletion or export, SAYRIVO carries it out at the Agency's request, in time for the Agency to answer within the legal deadline.
If one of the Agency's customers writes to SAYRIVO directly, the request is passed to the Agency without being answered on the merits.
SAYRIVO gives the Agency the information it needs for an impact assessment or a consultation with the supervisory authority.

11. Data breaches

SAYRIVO informs the Agency of a data breach affecting it without undue delay, and at the latest 48 hours after becoming aware of it. The notice states, as far as known: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken. The Agency notifies the competent authority and the people concerned where the law requires it.

12. End of the contract

When the contract ends, the Agency may request an export of its data for 30 days. SAYRIVO then deletes it, including from backups as they rotate, at the latest 30 days later, unless the law requires it to be kept. A deletion statement is provided on request.

13. Audits

SAYRIVO makes available to the Agency the information needed to show compliance with this agreement. The Agency may have an audit carried out once a year, with 30 days' notice, at its own cost, by an independent auditor bound by confidentiality, and more often after a data breach.

14. Term and order of precedence

This agreement applies for as long as SAYRIVO processes data on the Agency's behalf. On anything concerning personal data, it prevails over the terms of service. It is subject to the same law and courts as they are: Moroccan law.

Data processing agreement.