This policy explains what personal data OnePower collects on onepower.ma, why, and the rights you have under Law No. 09-08 on the protection of individuals with regard to the processing of personal data. The data controller is [to complete: Company legal name], [to complete: Registered address]. This processing has been declared to the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) under number [to complete: CNDP declaration / authorisation number].
1. What we collect
- Orders: name, phone number, delivery address and city, email address (optional for products, needed for coaching), what you ordered, and order notes.
- Account: email, password (stored encrypted, never readable by us), and your order history.
- Coaching clients: the profile you fill in (age, sex, height, weight, activity level, goals, training experience, injuries or health notes you choose to share), your check-ins, measurements and progress photos, and the plans your coach writes for you. Health-related information is sensitive data: we only collect it with your explicit consent, given when you fill in your profile, and only to run your coaching.
- Coach applications: name, contact details, experience and the CV you upload.
- Contact form and WhatsApp: your name, contact details and message.
- Technical data: IP address (used to limit abuse such as repeated login or code attempts) and the cookies described in our Cookie Policy.
2. Why we use it
- To process, confirm and deliver your orders and to collect cash on delivery (performance of the contract).
- To run your account and your coaching plan (performance of the contract and, for health data, your consent).
- To answer your messages and requests.
- To keep the site secure and prevent fraud (our legitimate interest).
- To keep invoices and order records as the law requires (legal obligation).
We do not sell your data and do not use it for advertising without your consent.
3. Who sees it
- OnePower staff who handle orders and customer service.
- Your coach, for coaching clients only: coaches see the profile, check-ins and photos of the clients they follow. Progress photos and CVs are stored in a private area that only you, the coaching team and administrators can open.
- Delivery partners, who receive your name, phone and address to deliver your parcel.
- Technical providers that run the site for us: our web host (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) and our email delivery service, Resend (servers in the United States), which sends order and account emails. These transfers outside Morocco are made under the conditions of Law No. 09-08.
- Authorities, when the law requires it.
4. How long we keep it
- Order and invoice records: 10 years, as required for accounting records.
- Accounts, coaching profiles, check-ins and progress photos: for as long as you keep your account. Ask us at any time and we delete them (order records excepted, see above).
- Coach applications and contact messages: for as long as we need them to answer you, and deleted on request.
5. Your rights
You have the right to access, correct and delete your data, and to object, for legitimate reasons, to its processing (Articles 7 to 9 of Law No. 09-08). You can withdraw your consent to the processing of your health data at any time; your coaching will then stop. To use these rights, write to [email protected] with proof of identity. We answer within 30 days. You can also file a complaint with the CNDP (www.cndp.ma).
6. Security
The site uses limited and logged access for staff and coaches, rate limits on logins and codes, encrypted passwords and a private storage area for photos and CVs. No method is perfectly secure; if a breach affecting you happens, we will tell you.
7. Minors
The site is meant for adults. Coaching is only for people aged 18 and over; under-18s need a parent’s or guardian’s agreement to order.
8. Contact
For any question about this policy: [email protected], +212 770 667720, or by post at [to complete: Registered address].