In short
We only collect what you choose to send us through the contact form or by email. We use it to reply to you and to work with you, we keep enquiries for 30 days unless we start working together, and we never sell it. This website has no advertising or analytics trackers.
The rest of this page explains the details, as required by Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, the EU General Data Protection Regulation (GDPR), the UK GDPR, Brazil’s LGPD and applicable US state privacy laws.
Who is responsible for your data
The data controller is MHA ONE, Société à responsabilité limitée (SARL), Bd Mohammed VI, Les Orchidées 4, Imm A, Bureau N°4, 28800 Mohammedia, Morocco (RC 20131 (Tribunal de Mohammedia), ICE 001952117000022). Enquiries handled by our US office are processed together with MHA ONE LLC, 1603 Capitol Ave, Suite 310 A430, Cheyenne, WY 82001, USA.
For any privacy question or request, contact us at or by post at either address above.
What we collect
Information you give us
When you use the contact form we collect the services you’re interested in, your name, email address, company or website (optional), main market and budget range (optional), your message, and your confirmation that we may reply. When you email or call us, we collect what you choose to share.
Information collected automatically
- Server logs kept by our hosting provider: IP address, date and time, page requested and browser type, used to keep the site secure and running.
- Form security data: when you send the form we record your IP address and the time of sending to prevent spam and abuse.
- Google reCAPTCHA: when you start filling in the contact form, Google reCAPTCHA checks that the form is being used by a person (see below).
- Technical cookies to protect the form and remember your cookie choices. See the cookie policy.
We do not use analytics tools, advertising pixels or social media trackers on this website.
How we use it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your enquiry and preparing a proposal | Form and email contents | Your consent, and steps taken at your request before a contract (GDPR Art. 6(1)(a) and (b); Law 09-08 Art. 4) |
| Carrying out a project you’ve agreed to | Contact and project details | Performance of a contract (GDPR Art. 6(1)(b)) |
| Protecting the site and the form from spam and abuse | IP address, timestamps, server logs | Our legitimate interest in keeping the site secure (GDPR Art. 6(1)(f)) |
| Spam protection with Google reCAPTCHA | IP address, browser and interaction data | Your consent (GDPR Art. 6(1)(a)), given in Cookie settings |
| Keeping business and accounting records | Invoices and related correspondence | Legal obligation (GDPR Art. 6(1)(c)) |
We do not use your data for automated decision-making or profiling, and we will not add you to a mailing list unless you ask us to.
Google reCAPTCHA
The contact form can be protected by Google reCAPTCHA, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). reCAPTCHA is only loaded if you allow it in Cookie settings (or with the button on the contact form) and once you start filling in the form. It analyses information such as your IP address, browser details, time on the page and mouse or touch movements to tell people and automated programs apart, and may set or read cookies from google.com.
We use it, on the basis of your consent, because spam submissions are a real security problem and it lets us keep the form open to everyone. You can withdraw your consent at any time in Cookie settings. Google processes this data under its own Privacy Policy and Terms of Service. If you prefer not to use reCAPTCHA, you can contact us by email or phone instead.
Who we share it with
We never sell or rent your personal data. We only share it with service providers who help us run the website and our business, under contracts that require them to protect it:
- Website hosting: Namecheap, Inc., United States;
- Email: Google Workspace (Google LLC / Google Ireland Limited), which receives and stores the enquiries sent from the form and our email correspondence;
- Spam protection: Google reCAPTCHA, as described above;
- professional advisers such as accountants and lawyers, where necessary;
- public authorities, only where the law requires it.
International transfers
MHA ONE works from offices in Morocco and the United States, and our providers (Namecheap and Google) may process data in the United States and other countries. When personal data from the EU, the UK or Brazil is transferred to a country without an adequacy decision, we rely on appropriate safeguards: the EU–US Data Privacy Framework for certified providers, the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), or your explicit request where the transfer is needed to reply to you. Transfers from Morocco are made in line with Law No. 09-08 and the requirements of the CNDP. You can ask us for details of these safeguards.
How long we keep it
- Enquiries that don’t lead to a project: 30 days after our last exchange, then deleted from our inbox.
- Website copies of form submissions: deleted automatically after 30 days.
- Anti-spam records (IP address, time of sending, spam logs): deleted automatically after 30 days at the latest.
- Server logs: kept by our hosting provider for up to 30 days.
- Client records: for the duration of the project, then only what accounting and tax law requires us to keep (invoices and related documents, up to 10 years).
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data or complete incomplete data;
- ask us to delete your data;
- restrict or object to how we use it, including where we rely on legitimate interests;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting what we did before you withdrew it.
To exercise any of these rights, write to . We will reply within one month and may ask you to confirm your identity first.
You also have the right to complain to a data protection authority: the CNDP in Morocco (Commission Nationale de contrôle de la protection des Données à caractère Personnel), or the authority where you live — for example the CNIL (France), ICO (United Kingdom), Garante (Italy), your regional authority (Germany), AEPD (Spain) or ANPD (Brazil). We’d appreciate the chance to resolve your concern first.
California and other US states
We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. US residents may make the requests above using the same contact details.
Security
The website is served over an encrypted (HTTPS) connection. Form submissions are validated on our server, protected against automated abuse, and stored outside the public part of the website with restricted access. Our email addresses and phone numbers are shown in a way that makes them hard for spam robots to collect. No system is perfectly secure, but we review our measures regularly and limit access to the people who need it.
Children
Our services are intended for businesses. This website is not directed at children and we do not knowingly collect data from anyone under 16.
Changes to this policy
We may update this policy, for example if we add a new tool to the website. The date at the top of this page shows when it last changed.