Privacy Policy & Personal Data Protection

Vext Technologies SARL ("Vext") processes all personal data in rigorous compliance with Moroccan Law No. 09-08 enacted by Dahir No. 1-09-15 of 22 Safar 1430 (February 18, 2009) on the protection of individuals with regard to personal data processing, and its implementing Decree No. 2-09-165 of May 21, 2009. Automated data processing operations operated by Vext have been duly declared to and authorized by the National Commission for Data Protection (CNDP). For clients, partners, and prospects based in the European Union, Vext also upholds the protective standards set forth in Regulation (EU) 2016/679 (GDPR).

In accordance with the principle of data minimization (Article 3 of Law 09-08), we only collect data strictly necessary for our engineering and platform deliverables: • Professional Identification Data: Full name, business email, phone number, company name, and job title submitted via consultation scheduling, contact forms, or technical dispatches. • Technical & Telemetry Logs: Public IP addresses, HTTP request timestamps, user-agent strings, visited endpoints, and latency telemetry gathered for system cyber-defense (DNSSI Directive compliance). • Voice Audio Streams (Vext Voice): Audio recordings, SIP/RTP call metadata (call duration, caller/callee IDs, codec flags), and real-time transcripts generated exclusively in the contractual execution of telephony AI services for client organizations. • Authentication Data (Vext Auth): Destination phone numbers, delivery timestamps, and carrier receipt statuses for OTP tokens (SMS, WhatsApp, Voice), with irreversible one-way cryptographic hashing of token codes.

Pursuant to Article 4 of Law No. 09-08, each data processing operation is anchored in a defined lawful basis: 1. Performance of a Contract or Pre-contractual Measures (Art. 4-b): Preparing architectural proposals, executing engineering sprints (Track 01), provisioning Vext Voice and Vext Auth runtime platforms (Track 02), and customer technical support. 2. Explicit Consent of the Data Subject (Art. 4): Subscribing to technical journals or opting in to non-essential analytical cookies via our consent framework. 3. Legal and Regulatory Compliance (Art. 4-c): Maintaining commercial books and accounting records for 10 years (Article 26 of the Moroccan Commercial Code), tax filings, and lawful telecom audit trails. 4. Legitimate Commercial & Security Interests (Art. 4-e): Hardening infrastructure against Distributed Denial of Service (DDoS) attacks, unauthorized intrusion prevention (Law No. 07-03 amending the Moroccan Penal Code), and network reliability engineering.

Vext enforces an airtight data isolation policy regarding enterprise voice streams: • 100% Client Ownership: All call recordings, audio streams, and generated transcripts remain the exclusive and unencumbered intellectual property of the contracting client. • STRICT ZERO THIRD-PARTY MODEL TRAINING WARRANTY: Vext never, under any circumstances, utilizes customer phone calls, voice transcripts, or operational data to train or fine-tune public foundation models (such as OpenAI, Anthropic, Google, or Meta models). • Isolated Tenant Sandboxing: Real-time media streams are encrypted with SRTP and TLS 1.3, isolated at the database layer with customer-managed keys (CMK), and processed in sovereign Moroccan compute enclaves without residual storage.

Production databases, telemetry pipelines, and voice orchestration engines are hosted on sovereign infrastructure within the territory of the Kingdom of Morocco or within ISO/IEC 27001 and SOC 2 Type II certified European facilities authorized by CNDP guidelines. Under Articles 43 and 44 of Moroccan Law 09-08, no personal data is transferred across Moroccan borders to non-adequate foreign jurisdictions without prior formal authorization from the CNDP or binding contractual safeguards approved by the Commission.

Personal data is retained solely for the statutory duration required for its specific operational purpose: • Sales inquiries & prospect files: 3 years following the date of last mutual communication. • Contracts, purchase orders & commercial invoices: 10 years pursuant to Article 26 of Law No. 15-95 (Moroccan Commercial Code). • Network connection logs & security audit trails: 1 year from logging date in compliance with ANRT and DGSSI cyber regulations. • Telephony voice recordings & transcripts: Retained strictly per customer SLA (default 30 days, with immediate automated purging upon tenant demand). • OTP verification logs: Expired and permanently purged immediately upon validation or expiration (within 10 minutes).

Pursuant to Article 23 of Moroccan Law No. 09-08, Vext implements institutional-grade defense controls: • Encryption at Rest: AES-256-GCM encryption across all databases, snapshots, and block storage tiers. • Encryption in Transit: Mandatory TLS 1.3 with Perfect Forward Secrecy (PFS) ciphers for all web endpoints and APIs; SRTP for live RTP audio. • Zero-Trust Network Architecture: Logical tenant segregation, web application firewalls (WAF), real-time intrusion monitoring, and isolation between development and production. • Identity & Access Management: Principle of least privilege (PoLP) and enforced hardware multi-factor authentication (MFA) on all administrative interfaces.

Under Law No. 09-08, individuals whose personal data is processed hold enforceable statutory rights: • Right of Access (Article 7): The right to obtain confirmation as to whether personal data is being processed, along with clear and intelligible communication of the data held. • Right of Rectification (Article 8): The right to demand that incomplete, inaccurate, or outdated data be updated, corrected, or erased. • Right of Opposition (Article 9): The right to object, on legitimate grounds, to the processing of personal data, as well as the unconditional right to object free of charge to any commercial prospecting or marketing use.

To exercise any statutory right under Moroccan Law 09-08, you may submit a formal request to our Data Protection Officer: • By Electronic Mail: [email protected] • By Registered Post: Vext Technologies SARL, Data Protection Department, Linkcity, Main Street, Casablanca, Morocco. Please include your full name, business email, and the specific right you wish to exercise, accompanied by a valid government identification document (CIN or Passport) to prevent identity fraud. We will respond within thirty (30) business days following receipt of the complete dossier.

If you consider that your personal data has been handled in breach of Moroccan Law No. 09-08, you hold the legal right to lodge an official complaint with the national supervisory authority: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) • Physical Address: Boulevard Annakhil, Immeuble Les Patios, 3rd Floor, Hay Riad, Rabat, Morocco • Telephone: +212 (0) 537 57 11 24 • Official Web Portal: www.cndp.ma • Regulatory Inquiries: [email protected]