--- title: "Privacy Policy | HEC Rabat" description: "Learn how HEC Rabat collects, uses and protects your personal data in compliance with Law No. 09-08." url: https://hec.ac.ma/en/politique-de-confidentialite/ language: en --- [Home](https://hec.ac.ma/)›Privacy Policy # Privacy _Policy_ Your data belongs to you. This policy explains precisely how HEC Rabat collects, uses and protects your personal information in compliance with Law No. 09-08. Last updated: January 2026 10 articles Compliance with Law 09-08 & CNDP Contents - 01 Data controller - 02 Data collected - 03 Purposes of processing - 04 Data sharing - 05 Retention periods - 06 Your rights - 07 Cookies & trackers - 08 Data security - 09 Policy changes - 10 Contact & DPO **Law 09-08 Compliance** Processing declared with the CNDP — the National Commission for the Control of Personal Data Protection. **Data never sold** Your personal data is never transferred, rented or sold to third parties for commercial purposes. **Full transparency** You may exercise your rights at any time — access, rectification, erasure — by simple written request. Article 01 Data controller The data controller for your personal data is: #### HEC Rabat - École des Hautes Études de Commerce Higher education institution — Moroccan limited liability company (SARL), operating since 1989. 4, rue Tulipa, Hay Riad, Rabat — Morocco [contact@hec.ac.ma](mailto:contact@hec.ac.ma) [+212 5 37 67 12 76](tel:+212537671276) Article 02 Data collected HEC Rabat collects only the data strictly necessary for the purposes described in this policy. Data is collected directly from you via: Contact and information request forms available on the website, application forms for training programmes, registrations for events, webinars or information sessions, and exchanges by email or phone with our teams. The categories of data collected include: identification data (surname, first name, date of birth), contact data (email, phone, address), professional data (employer, position, industry, experience) and academic background data (qualifications, institutions). No sensitive data (ethnic origin, political or religious beliefs, health data) is collected or processed by HEC Rabat, except where expressly required by law. Article 03 Purposes of processing Your data is processed for the following purposes, each based on a distinct legal ground: Purpose Legal basis **Application processing and enrolment management** Contract performance **Academic and administrative student management** Contract performance **Communication about our programmes and events (newsletter, emails)** Consent **Improving our services and website experience** Legitimate interest **Legal and regulatory obligations (accounting, audits)** Legal obligation **Anonymised statistics and reporting** Legitimate interest Article 04 Data sharing HEC Rabat never sells, rents or transfers your personal data to third parties for commercial purposes. Limited disclosures may occur in the following cases: Technical sub-processors — hosting providers, CRM tools, email platforms, online payment solutions. These providers act under contract and are bound by strict confidentiality obligations. Competent authorities — only on judicial requisition or legal obligation imposed by Moroccan law. Academic partners — only with your explicit consent and in the context of dual-degree programmes or international accreditations. No transfer of data to third countries is carried out without contractual safeguards equivalent to the level of protection under Law 09-08. Article 05 Retention periods Your data is retained for the period strictly necessary for the purposes for which it was collected: Data category Retention period **Unsuccessful applications** 2 years from the last interaction **Active student data** Duration of programme + 5 years **Graduate (alumni) data** 10 years (unless opposed) **Billing data** 10 years (accounting obligation) **Marketing prospecting data** 3 years from the last active contact **Website connection logs** 12 months Upon expiry of these periods, data is deleted or irreversibly anonymised. Article 06 Your rights In accordance with Law No. 09-08, you have the following rights regarding your personal data: #### Right of access Obtain confirmation that your data is being processed and receive a copy of it. #### Right to rectification Have your inaccurate or incomplete data corrected. #### Right to erasure Request deletion of your data (subject to legal obligations). #### Right to object Object to the processing of your data for commercial prospecting purposes. #### Right to data portability Receive your data in a structured, machine-readable format. #### Right to restriction Obtain suspension of processing in certain cases provided for by law. To exercise any of these rights, send your request by email to [contact@hec.ac.ma](mailto:contact@hec.ac.ma) specifying your identity and the right you wish to exercise. A response will be provided within a maximum of 30 days. If the response is unsatisfactory, you may lodge a complaint with the CNDP (www.cndp.ma). Article 07 Cookies and trackers The HEC Rabat website uses cookies and trackers to improve your browsing experience and measure website audience. The categories used are as follows: Essential **Technical and functional cookies** Necessary for the operation of the website (session, language preferences, security). Cannot be disabled. Analytics **Audience measurement cookies** Used to measure traffic and analyse browsing behaviour in an anonymised manner (Google Analytics or equivalent). Optional **Personalisation and marketing cookies** Allow us to offer content tailored to your interests, on our website and on social networks. Enabled only with your consent. You may modify your cookie preferences at any time via your browser settings or the cookie management panel available on the website. The maximum lifetime of cookies is 13 months. Article 08 Data security HEC Rabat implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of your personal data against any unauthorised access, loss, alteration or disclosure. These measures include in particular: encryption of sensitive data in transit (HTTPS/TLS protocol), access control with strong authentication for authorised personnel, regular backups and system redundancy, as well as regular staff training on information security best practices. In the event of a data breach likely to result in a high risk to your rights and freedoms, HEC Rabat undertakes to inform you as soon as possible and to notify the CNDP in accordance with its legal obligations. Article 09 Policy changes HEC Rabat reserves the right to modify this Privacy Policy at any time to reflect changes in law, regulation or internal practices. Any material change will be notified by email to the persons whose data we process, with reasonable prior notice before taking effect. The date of the last update is indicated at the top of this document. We encourage you to review this page regularly to stay informed of any updates. Article 10 Contact and Data Protection Officer For any questions relating to this Privacy Policy, the exercise of your rights, or to report a security incident, you may contact our data protection officer: #### Data Protection Officer — HEC Rabat Your dedicated point of contact for any request relating to your personal data. Response guaranteed within 30 business days. [contact@hec.ac.ma](mailto:contact@hec.ac.ma) [+212 5 37 67 12 76](tel:+212537671276) 4, rue Tulipa, Hay Riad — Rabat 10100, Morocco If you believe your rights have not been respected after contacting us, you have the right to lodge a complaint with the National Commission for the Control of Personal Data Protection (CNDP) — **[www.cndp.ma](https://www.cndp.ma)** --- _HTML version: https://hec.ac.ma/en/politique-de-confidentialite/ · Site index for agents: https://hec.ac.ma/llms.txt · Sitemap: https://hec.ac.ma/sitemap-index.xml_