The data controller for your personal data is:
HEC Rabat - École des Hautes Études de Commerce
Higher education institution — Moroccan limited liability company (SARL), operating since 1989.
Article 01
Data controller
Privacy
Policy
Your data belongs to you. This policy explains precisely how HEC Rabat collects, uses and protects your personal information in compliance with Law No. 09-08.
Article 02
Data collected
HEC Rabat collects only the data strictly necessary for the purposes described in this policy. Data is collected directly from you via:
Contact and information request forms available on the website, application forms for training programmes, registrations for events, webinars or information sessions, and exchanges by email or phone with our teams.
The categories of data collected include: identification data (surname, first name, date of birth), contact data (email, phone, address), professional data (employer, position, industry, experience) and academic background data (qualifications, institutions).
No sensitive data (ethnic origin, political or religious beliefs, health data) is collected or processed by HEC Rabat, except where expressly required by law.
Article 03
Purposes of processing
Your data is processed for the following purposes, each based on a distinct legal ground:
| Purpose | Legal basis |
|---|---|
| Application processing and enrolment management | Contract performance |
| Academic and administrative student management | Contract performance |
| Communication about our programmes and events (newsletter, emails) | Consent |
| Improving our services and website experience | Legitimate interest |
| Legal and regulatory obligations (accounting, audits) | Legal obligation |
| Anonymised statistics and reporting | Legitimate interest |
Article 04
Data sharing
HEC Rabat never sells, rents or transfers your personal data to third parties for commercial purposes. Limited disclosures may occur in the following cases:
Technical sub-processors — hosting providers, CRM tools, email platforms, online payment solutions. These providers act under contract and are bound by strict confidentiality obligations.
Competent authorities — only on judicial requisition or legal obligation imposed by Moroccan law.
Academic partners — only with your explicit consent and in the context of dual-degree programmes or international accreditations.
No transfer of data to third countries is carried out without contractual safeguards equivalent to the level of protection under Law 09-08.
Article 05
Retention periods
Your data is retained for the period strictly necessary for the purposes for which it was collected:
| Data category | Retention period |
|---|---|
| Unsuccessful applications | 2 years from the last interaction |
| Active student data | Duration of programme + 5 years |
| Graduate (alumni) data | 10 years (unless opposed) |
| Billing data | 10 years (accounting obligation) |
| Marketing prospecting data | 3 years from the last active contact |
| Website connection logs | 12 months |
Upon expiry of these periods, data is deleted or irreversibly anonymised.
Article 06
Your rights
In accordance with Law No. 09-08, you have the following rights regarding your personal data:
Right of access
Obtain confirmation that your data is being processed and receive a copy of it.
Right to rectification
Have your inaccurate or incomplete data corrected.
Right to erasure
Request deletion of your data (subject to legal obligations).
Right to object
Object to the processing of your data for commercial prospecting purposes.
Right to data portability
Receive your data in a structured, machine-readable format.
Right to restriction
Obtain suspension of processing in certain cases provided for by law.
To exercise any of these rights, send your request by email to contact@hec.ac.ma specifying your identity and the right you wish to exercise. A response will be provided within a maximum of 30 days. If the response is unsatisfactory, you may lodge a complaint with the CNDP (www.cndp.ma).
Article 07
Cookies and trackers
The HEC Rabat website uses cookies and trackers to improve your browsing experience and measure website audience. The categories used are as follows:
You may modify your cookie preferences at any time via your browser settings or the cookie management panel available on the website. The maximum lifetime of cookies is 13 months.
Article 08
Data security
HEC Rabat implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of your personal data against any unauthorised access, loss, alteration or disclosure.
These measures include in particular: encryption of sensitive data in transit (HTTPS/TLS protocol), access control with strong authentication for authorised personnel, regular backups and system redundancy, as well as regular staff training on information security best practices.
In the event of a data breach likely to result in a high risk to your rights and freedoms, HEC Rabat undertakes to inform you as soon as possible and to notify the CNDP in accordance with its legal obligations.
Article 09
Policy changes
HEC Rabat reserves the right to modify this Privacy Policy at any time to reflect changes in law, regulation or internal practices.
Any material change will be notified by email to the persons whose data we process, with reasonable prior notice before taking effect. The date of the last update is indicated at the top of this document.
We encourage you to review this page regularly to stay informed of any updates.
Article 10
Contact and Data Protection Officer
For any questions relating to this Privacy Policy, the exercise of your rights, or to report a security incident, you may contact our data protection officer:
Data Protection Officer — HEC Rabat
Your dedicated point of contact for any request relating to your personal data. Response guaranteed within 30 business days.
If you believe your rights have not been respected after contacting us, you have the right to lodge a complaint with the National Commission for the Control of Personal Data Protection (CNDP) — www.cndp.ma