Logo BoxCom

BOXCOM PRIVACY POLICY

Effective date: | Last updated:

Introduction

Boxcom ("we," "our," or "us") is a digital marketing and PR agency based in Casablanca, Morocco. We are committed to protecting the personal data we handle in the course of our business activities. This Privacy Policy explains what data we collect, how we use it, how we protect it, and what rights you have over your personal data.

1. Who We Are

Boxcom is a digital marketing and public relations agency founded in Casablanca in 2014. We provide services including PR, social media management, content creation, digital advertising, lead generation, WhatsApp marketing, and web development to clients in Morocco and internationally.

In the course of our work, we process personal data in several capacities: as a data controller for our own internal databases, and as a data processor on behalf of our clients when executing campaigns and lead generation activities.

2. What Personal Data We Collect

Depending on the context of our relationship with you, we may process the following categories of personal data:

  • Media and journalist contacts: name, professional email address, phone number, media outlet, and area of specialization (our proprietary database)
  • Lead generation: names, email addresses, and phone numbers collected via smart forms, landing pages, and lead magnets on behalf of our clients, always with explicit opt-in consent
  • WhatsApp marketing: phone numbers used for conversational campaigns, collected with prior consent
  • Paid social and retargeting audiences: behavioral and interest data processed through Meta, TikTok, and LinkedIn advertising platforms, in accordance with those platforms' data policies
  • Client and prospect contacts: name, professional email address, job title, company name, and phone number
  • Community management: names and messages of individuals who interact with our clients' social media accounts
  • Website visitors: IP address, browser type, pages visited, and cookies via our website analytics tools
  • Job applicants: name, email, CV, and professional background

We do not collect sensitive personal data such as health data, political opinions, or financial information in our standard business operations.

3. How and Why We Use Your Data

We process personal data for the following purposes:

  • Managing our media and journalist database for PR outreach on behalf of our clients
  • Collecting and qualifying leads through opt-in forms and lead magnets on behalf of our clients. Each campaign landing page includes a dedicated privacy notice specific to the project, ensuring data subjects are fully informed at the point of collection. All campaigns are conducted in compliance with applicable regulations, including Morocco's CNDP Law 09-08, the EU General Data Protection Regulation (GDPR) for campaigns targeting individuals in the European Union, and other applicable local regulations depending on the target market
  • Executing WhatsApp marketing campaigns using consented contact lists
  • Running paid social, retargeting, and lookalike audience campaigns on behalf of our clients
  • Managing community interactions on social media platforms on behalf of our clients
  • Communicating with current and prospective clients about our services
  • Managing our contractual relationships and fulfilling our service obligations
  • Improving our website and understanding user behavior through analytics
  • Responding to inquiries submitted through our contact form or by email
  • Complying with our legal and regulatory obligations

Our legal basis for processing personal data is generally: the performance of a contract, our legitimate interests as a business, compliance with legal obligations, or your explicit consent where applicable. For all lead generation activities conducted on behalf of clients, consent is captured at the point of collection through a project-specific privacy notice on each campaign landing page.

4. How Long We Retain Your Data

We retain personal data only for as long as necessary for the purpose for which it was collected:

  • Media contacts: retained as long as they remain active in their professional role, and reviewed annually
  • Lead generation data: retained for the duration of the client campaign. Each campaign operates under a project-specific privacy notice, and data is collected exclusively on an opt-in basis. Upon contract termination, data is deleted or returned to the client as agreed
  • WhatsApp marketing contacts: retained only for the duration of the campaign, with opt-out honored immediately
  • Client data: retained for the duration of the contract and up to 5 years thereafter, in accordance with Moroccan legal requirements
  • Prospect data: retained for up to 3 years from the last meaningful interaction
  • Website analytics data: retained for up to 26 months

5. How We Store and Protect Your Data

We store personal data using the following platforms, all of which provide industry-standard security:

  • Odoo: our primary CRM and business management platform, which stores contact and client data with encryption at rest and in transit (TLS/SSL)
  • Google Workspace: used for email and document collaboration, with encryption in transit and at rest, and access controls
  • Meta, TikTok, and LinkedIn advertising platforms: audience data processed directly within those platforms under their respective data processing agreements

Access to personal data is restricted to Boxcom staff members who require it to perform their duties. We do not sell personal data to any third party.

Boxcom conducts lead generation and marketing campaigns for clients across Morocco, Africa, Europe, the Gulf, and North America. Depending on the target audience and geography, we apply the relevant data protection framework, including Morocco's Law 09-08 (CNDP), the EU General Data Protection Regulation (GDPR), and other applicable local regulations. For all campaigns, data subjects provide free, informed, and explicit consent prior to any data collection, through a project-specific privacy notice attached to each campaign landing page. Opt-out requests are honored immediately and without condition.

7. Your Rights

You have the following rights regarding your personal data:

  • Right to access: you can request a copy of the personal data we hold about you
  • Right to correction: you can ask us to correct any inaccurate or incomplete data
  • Right to deletion: you can ask us to delete your personal data, subject to our legal retention obligations
  • Right to object: you can object to us processing your data for direct marketing purposes
  • Right to restrict processing: you can ask us to limit how we use your data in certain circumstances
  • Right to data portability: you can request your data in a structured, commonly used format
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at the details below. We will respond within 30 days.

8. Data Breach Response

In the event of a personal data breach, Boxcom has an internal process to assess, contain, and notify affected parties as required by applicable law. Our privacy contact is responsible for coordinating the response and, where legally required, notifying the relevant supervisory authority (including the CNDP in Morocco or the relevant EU data protection authority) and any affected individuals in a timely manner.

9. Third Parties and Data Sharing

We do not sell your personal data. We may share data with trusted third-party service providers (such as Odoo, Google, Meta, TikTok, and LinkedIn) solely to operate our business and deliver our services, under appropriate data processing terms. We do not transfer personal data outside of our operational tools without ensuring appropriate safeguards are in place.

10. Cookies

Our website may use cookies to improve your browsing experience and gather analytics. You can control cookie preferences through your browser settings. A detailed cookie notice may be provided separately on our website.

11. Contact and Privacy Officer

For any questions, requests, or concerns regarding this Privacy Policy or your personal data, please contact our designated Privacy Officer:

  • Name: Kawtar Lamali
  • Role: Privacy Officer, Boxcom
  • Email: k.lamali@box-com.com
  • Address: 3 Rue El Jihani, Quartier Racine, Casablanca, Morocco 20250

12. Updates to This Policy

We may update this Privacy Policy from time to time. The most recent version will always be available on our website at www.box-com.com/privacy-policy. We encourage you to review it periodically.