Privacy Policy

Last updated: 9 October 2026

MaCaisse is point-of-sale software for merchants (café-restaurant, retail shop, hair salon), consisting of a tablet application and an online area at macaisse.net. This page describes which data is processed, why, with whom it is shared, how long it is retained and how to exercise your rights.

1. Who is responsible for what

MaCaisse is published by SAGATEC — Société d’informatique, domotique et sécurité, limited liability company (SARL) under Moroccan law, with registered office at Lot Kortoba, Secteur 1, Meknès, Morocco. Contact: [email protected] — +212 5 35 46 32 58 (landline) — +212 6 45 56 02 90 (management).

Data processing by MaCaisse falls into two distinct legal roles, which it is important not to confuse:

Practical consequence. If you are a customer of a business that uses MaCaisse (loyalty card, credit account, delivered order) and you wish to access your data, correct it or have it deleted, your point of contact is the merchant themselves, not MaCaisse. We can act on that data only on the merchant's instruction, or to assist them in handling your request — see the Your rights section.

We never exploit our customers' business data (sales, end customers, catalogue) for advertising, resale, profiling or commercialised statistics. The application contains no advertising SDK and no behavioural analytics tool.

2. Data collected

Depending on your configuration (register connected to a local server or register synchronised with macaisse.net, integrations enabled or not), some of the categories below may not apply to you.

2.1 Data for which MaCaisse is the controller (account, licence, billing)

2.2 Data processed on behalf of the merchant (MaCaisse is a processor)

When the register is synchronised with macaisse.net, the tablet sends the business's operating data to it. This data belongs to the merchant:

2.3 Image bank

MaCaisse provides a collection of illustrations (label, keywords, images in three sizes) built and maintained by our team. This collection is shared by all merchants, is not attached to any account and contains no personal data of any merchant or end customer.

3. Purposes and legal bases

The processing operations described above fall under Moroccan law 09-08 (loi 09-08, the Moroccan personal data protection act) relating to the protection of individuals with regard to the processing of personal data. The legal bases relied upon are the following:

We send no commercial or promotional e-mail from the product, and the software contains no automated prospecting mechanism.

4. Recipients and processors

4.1 Within MaCaisse

Access to data is limited to the people who need it: the technical team of SAGATEC — Société d’informatique, domotique et sécurité (support, server operations) and, where applicable, the partner reseller to which your account is attached. A reseller sees the accounts and shops they have themselves created, as well as their billing.

4.2 Technical service providers

We use a limited number of providers, bound by contract, who act only to operate the service. Each one receives only the data it needs for its task:

Finally, we may be required to disclose data to a Moroccan judicial or administrative authority where the law obliges us to do so.

5. Transfers outside Morocco

The macaisse.net server is hosted in the European Union. Some of the providers described above (artificial intelligence, online payment, e-mail delivery, website resources and, if enabled, the delivery integration) are also located outside Morocco, in particular in the European Union, the United States and Asia.

In accordance with law 09-08, any transfer of personal data to a foreign State is subject to the approval of the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel, the Moroccan data protection authority). The corresponding formalities are the responsibility of SAGATEC — Société d’informatique, domotique et sécurité for the merchant account data.

Please note: for the data of their own customers, it is the merchant, as controller, who must complete their formalities with the CNDP — see the Merchant's obligations section.

6. Retention periods

6.1 While the account is active

Account data and the business's operating data (sales, records, catalogue, settings) are kept as long as the account is active: they are used for sales history, reports and tablet restoration.

6.2 Temporary data

Verification codes, one-time login links and online area sessions expire quickly and are then deleted automatically.

6.3 Deletions made at the point of sale

When a record is deleted from the tablet, it is first marked as deleted on the server and can be restored if the item is published again. It is permanently erased when the account is deleted or upon a reset request.

6.4 Accounting documents

Subscription invoices and payments are accounting documents: they are kept for 10 years from the end of the financial year concerned, including after the account is deleted.

6.5 Technical logs

Technical and security logs are kept for a limited period, for security and diagnostic purposes, and then deleted during maintenance operations.

6.6 Support

Exchanges with the assistant alone are deleted after 90 days; requests sent to the team, one year after they are resolved.

6.7 On the tablet

The local database keeps the register's history until the application is uninstalled or its data is cleared from the system settings.

6.8 Erasure on request

You can delete your account at any time, or request a partial reset of a shop (sales, stock, customers, suppliers or tablets) — see Account and data deletion.

7. Security

7.1 Our measures

• Encrypted communications: exchanges between the tablet, the browser and macaisse.net use HTTPS.
• Protected online account passwords: stored in hashed form, they cannot be viewed by us or by a reseller.
• Tablet authentication with a token specific to each device, which can be revoked at any time from the merchant area.
• E-mail address verification with a one-time code of limited lifetime.
• Separation by shop: a tablet only accesses its own shop's data.
• Protection against intrusion attempts, and access to data limited to authorised people.
• No advertising tracker or behavioural analytics tool in the application.

7.2 What we recommend

• Lock your tablets with a passcode and enable device encryption.
• Change the point-of-sale passwords set at installation as soon as you start using the register, and never reuse a password used elsewhere (e-mail, bank, merchant area).
• Revoke a lost or stolen tablet immediately from the merchant area, and let us know.
• Synchronisation is not a guaranteed backup service: keep your own copies of the information you need.

In the event of a data breach likely to affect your rights, we will inform you and make the required notifications to the CNDP.

8. Cookies and trackers

The site uses only cookies that are strictly necessary for its operation and security, including:

No advertising cookie, no third-party audience measurement, no tracking pixel is set by the site or by the application.

External resources: some pages load fonts and style sheets from third-party services, and the website's traffic passes through a protection and routing service. These requests, made by your browser, communicate your IP address and your user agent to those providers, even though no data from your account is transmitted to them.

9. Mobile application permissions

The application requests only what is strictly necessary for it to work:

The application requests no access to location, contacts, the microphone, SMS, the telephone, Bluetooth or external storage, and integrates no advertising or analytics kit.

10. Your rights

In accordance with law 09-08, you have a right of access, a right of rectification and a right to object on legitimate grounds to the processing of your data, as well as the right to obtain the erasure of data whose processing does not comply with the law. Deletion of the account and of the data is described in the next section.

10.1 If you are a merchant, a reseller or a visitor to the site

Send your request to [email protected], from the e-mail address associated with your account, specifying the subject of the request. We may ask you for proof of identity if reasonable doubt remains as to the origin of the request. We reply as soon as possible, and at the latest within 30 days of receiving the request.

10.2 If you are an employee of a business using MaCaisse

Your data (CIN, surname, first name, point-of-sale password, commissions, cancellations and sales charged to you) is under the responsibility of your employer. Contact them first: they can modify or delete your record from the point of sale or the merchant area. If you obtain no response, you can write to us and we will pass the request on, or you can refer the matter directly to the CNDP.

10.3 If you are a customer of a business using MaCaisse

The business from which you purchased, took out a loyalty card, opened a credit account or placed a delivered order is the controller of your data. Send your request to them directly: they alone know the context of your record and can modify or delete it. We are not entitled to modify or delete this data on our own initiative.

If you are unable to identify the business or if it does not respond, write to us at [email protected]: we will relay your request to the merchant concerned, and we will carry out the erasure as soon as they instruct us to do so. In any event you retain the possibility of referring the matter to the CNDP.

11. Account and data deletion

The detailed procedure is described on a dedicated page: Delete my account and my data. Here is the essence of it.

11.1 How to request deletion

• From the application (normal route): account screen (side menu → Cloud account, or the "My MaCaisse account" button on the login screen) → at the bottom of the screen, red "Delete my account" button → "Send the request". Nothing is erased at that point: the MaCaisse technical service contacts you to confirm that the request really comes from you, then carries out the deletion within a maximum of 30 days. If you change your mind in the meantime, the request is closed with no further action.
• By e-mail, if you no longer have the tablet: write to [email protected] from the e-mail address of your account. We process the request within a maximum of 30 days.
• The online merchant area does not, to date, include a deletion button: use the application or e-mail.

11.2 What deletion erases, and what it retains

Deletion is a purge accompanied by anonymisation. We prefer to say so precisely rather than write "everything is erased":

• Actually erased: your shops and the entirety of their synchronised content — sales, sale lines, payments received, items, categories, records of your end customers, salespeople and employees, permissions, VAT, settings — as well as your tablets and their access tokens, the database copies sent to the technical service, the tablets' logs, your exchanges with support and your subscriptions.
• Retained but emptied: if invoices or receipts have been issued in your name, the row for your account survives, stripped of all personal data. Name, company, billing details, ICE and telephone number are reset to empty, and the password is replaced by a random value. It now serves only to link the accounting records. An account without any invoice or receipt is erased entirely.
• E-mail address released: your real address is replaced by a technical address at @macaisse.invalid. You can therefore sign up again later with the same e-mail address.
• Subscription invoices and receipts retained: accounting regulations oblige us to keep them. These documents are a snapshot frozen at their issue date and therefore contain the billing details as they were at that time — including the e-mail address as it then was. After deletion, these records are the only data concerning you that we keep, apart from technical logs and database security copies, which are replaced automatically (14 days at most for the daily copies).

11.3 Erasing only part of your data

You may also request, by e-mail to [email protected], a partial reset of a shop (sales, stock, customers, suppliers or tablets) without deleting your account. This operation is carried out by our team, with the technical caveat described in paragraph 6.4.

11.4 On the tablet

Uninstalling the application erases the data present on the device, but not the data already synchronised to macaisse.net: deletion of the account remains necessary for the latter.

12. The merchant's obligations towards their own customers

By using MaCaisse to record customer files, loyalty cards, credit accounts, delivered orders or employee records, you become a controller within the meaning of law 09-08. It is your responsibility in particular:

• to complete the formalities required with the CNDP for your files. Caution: the file of point-of-sale employees contains the CIN number, which the software uses as an identifier. As such, this processing is subject to the prior authorisation of the CNDP (article 12 of law 09-08) and not to a simple declaration. The file of your customers, for its part, is subject to declaration;
• to inform your customers — by a notice displayed in the shop, a statement on the loyalty enrolment form or on the receipt — of the collection of their data, its purpose, its recipient and their rights, and to obtain their consent where it is required;
• to inform your employees of the recording of their CIN, their sales, their cancellations and their commissions;
• to enter only relevant and necessary data, and in particular not to use the free-text remarks field to record sensitive information (health, opinions, origin, judicial record);
• to handle the requests for access, rectification, objection and deletion coming from your customers and your employees;
• to protect your tablets (lock code, device encryption, named point-of-sale accounts, distinct passwords changed as soon as the system is installed) and to report to us without delay the loss or theft of a device so that we can revoke it.

As a processor, MaCaisse undertakes to process this data only in order to provide the service, not to use it for other purposes, to partition it by shop, and to act upon your instructions for rectification or erasure.

13. Changes to this policy

This policy may change along with the product. The version in force is the one published on macaisse.net, with the date of last update shown at the top of this page. We invite you to consult it from time to time; in the event of a significant change, we will inform subscribing merchants by e-mail at the address associated with their account.

14. Contact and complaints to the CNDP

For any question relating to this policy or to exercise your rights:

If, after contacting us, you consider that your rights are not being respected, you may refer the matter to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), the competent Moroccan authority, in Rabat — www.cndp.ma.

Users located in the European Union

MaCaisse is a Moroccan product, designed for the Moroccan market, and its frame of reference is law 09-08. We claim no GDPR compliance certification. If you are established in the European Union, we nevertheless undertake, on a voluntary basis, to apply the same principles of transparency, minimisation and respect for rights as those described above, and to examine your requests for access, rectification, erasure, restriction and portability within the same time limits.