This Privacy Policy describes the practices of CAPTISIA SARL AU, publisher of the Castizen platform (hereinafter "we", "our" or "the Platform") regarding the collection, use, storage and protection of your personal data, in accordance with applicable Moroccan legislation on the protection of personal data.

This policy informs you about data processing. Use of the Platform does not constitute consent to optional measurement or advertising services.

1 — Data Controller

The data controller for personal data processing is:

Company name: CAPTISIA SARL AU
Brand: Castizen
ICE : 003105154000076
RC : 8395
TP : 39801942
IF : 52553716
Registered office: Quartier Othmane, Rue Bathae, Magasin N°179, Bouznika, Morocco
Contact email: contact@castizen.com

2 — Data Collected

We collect different categories of data depending on your role on the Platform:

Identification data (Talents & Clients):

Last name, first name, email address, phone number
Date of birth, gender, city of residence
Profile photo and portfolio media (Talents)
Company name, ICE, business address (Clients)

Identity verification data (KYC):

Copy of National Identity Card (CIN) or passport
For minors: guardian's CIN and parental authorization
Verification selfie (if required)

Transactional data:

Booking history, amounts, commissions
Payment proofs (transfer receipts)
Bank details (RIB) for paying Talent fees

Geolocation data:

GPS coordinates collected only during Check-in at the shooting location
This data is temporarily stored and used exclusively to validate the Talent's presence
This processing of geolocation data is limited to strict necessity (presence validation) and is carried out in compliance with Moroccan personal data protection legislation.

Technical data:

IP address, browser type, operating system
Pages visited, browsing duration, cookies
Login and activity logs

3 — Processing Purposes

Your personal data is processed for the following purposes:

User account management (registration, authentication, profile)
Identity verification (KYC) to secure transactions
Connecting Talents with Clients
Automatic generation of Service Contracts
Payment management, escrow, and fee disbursement
Presence validation via GPS Check-in
Sending notifications (booking, payment, dispute)
Fraud prevention and bypass detection
Optional audience measurement and, under separate consent, advertising conversion measurement
With your optional consent, we use your WhatsApp number to send Castizen casting announcements and/or commercial photo and video studio offers, according to your separate choices. We retain the date, source, language, version and wording of your choice as evidence. You can withdraw consent at any time in your communication preferences or ask us to stop messaging you. Number verification is not marketing consent. These choices are separate from messages needed for your account, applications and bookings.
Compliance with legal and regulatory obligations

Each purpose rests on a legal basis within the meaning of Law no. 09-08: performance of the contract between us (account management, matching, Service Agreements, payments, talent fees, service notifications); a legal obligation (identity verification, invoicing, accounting retention, responding to requests from the authorities); our legitimate interest in protecting the Platform and its users (fraud prevention, security, access logging); and your consent, which you may withdraw at any time (GPS position recorded at Check-in, audience measurement and advertising described in section 8).

4 — Data Security and Storage

We implement appropriate technical and organizational measures to protect your data:

SSL/TLS encryption for all communications
Encryption of sensitive data at rest (KYC documents, bank details)
Restricted access to personal data, limited to authorized personnel
Secure authentication with password hashing (bcrypt)
Automatic NSFW protection for uploaded content
Regular backups and disaster recovery plan
Logging of access and modifications to sensitive data

Retention period:

Active account data: retained for the entire duration of service use
After account deletion, if you have never been booked for an assignment: your account and all your data are destroyed immediately
After account deletion, if you have already been booked for an assignment: your identity is erased immediately — e-mail, phone number, address, photos, videos, identity documents and bank details are destroyed. Only your signed contract, the amounts, your name and your national ID number are kept, under accounting obligations
KYC documents: retained for the duration required by applicable regulations
Geolocation data (Check-in): deleted 90 days after the service
Check-in photo: destroyed 90 days after the end of the service, once the booking no longer binds either party. An open dispute suspends this destruction until it is resolved, because this photo proves the Talent showed up.
Transactional data: retained for 10 years in accordance with accounting obligations
Administration action log: retained for 24 months, then erased automatically every month. Payment and refund proofs are excluded and follow the accounting retention period.
WhatsApp logs: kept. They record the messages we sent you — their date, their type and the number they went to — so we can answer a delivery dispute and meet our obligations. You may ask us to delete them at any time at contact@castizen.com.

5 — Data Recipients

Your personal data may be shared with the following recipients:

Platform Users: public profile information (name, photo, skills) is visible to other users for matchmaking purposes.
Contracting parties: in the context of a confirmed booking, certain data (name, contact) is shared between the Talent and Client bound by a Service Contract.
Technical service providers: website, database and e-mail hosting: o2switch (France); card payments: YouCan Pay (Morocco); service WhatsApp messages: Meta Platforms Ireland Limited (Ireland). These providers are selected for their compliance with data protection requirements; those established outside Morocco therefore process your data there.
Measurement and advertising providers: only after your choice, certain technical data and events may be sent to Google (Analytics and Tag Manager), Microsoft (Clarity), Meta (Pixel and Conversions API), and TikTok (Pixel), according to the categories accepted.
Automated technical services: technical error reporting: Sentry (Functional Software, Inc., United States). These checks are automated: no person at these providers looks at your content.
Competent authorities: in case of judicial requisition or legitimate request from Moroccan authorities, in accordance with the law.

Castizen does not sell or rent your personal data. Optional transfers to measurement and advertising providers occur only according to the choices described in section 8.

6 — Data Hosting

Castizen Platform data is hosted on secure servers. In case of data transfer outside Morocco, we ensure the host offers an adequate level of protection, in accordance with applicable Moroccan data protection legislation.

Host: o2switch — shared server, SSL certificate
Location: France: your data is hosted outside Morocco, in a European Union country subject to the GDPR
Backups: Daily encrypted backups with 30-day retention

7 — Your Rights

In accordance with applicable Moroccan legislation on the protection of personal data, you have the following rights:

Right of access: obtain confirmation that your data is being processed and receive a copy.
Right of rectification: request correction of inaccurate or incomplete data.
Right of objection: object, on legitimate grounds, to the processing of your data.
Right of deletion: request deletion of your data, subject to legal retention obligations.

To exercise your rights, send your request by email to contact@castizen.com attaching a copy of your ID. We commit to responding within 30 days.

These rights are granted to you by Law no. 09-08 on the protection of individuals with regard to the processing of personal data. The authority responsible for enforcing it in Morocco is the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). If our answer does not satisfy you, you may refer the matter directly to them at www.cndp.ma.

Declaration with the CNDP

Castizen's declaration with the CNDP is being prepared. No receipt number can therefore be published at this time. It will appear on this page as soon as it is registered, together with the status of the authorisations requested for the processing operations that require them: data concerning minors, the GPS position recorded at Check-in, and the hosting outside Morocco described in section 6.

8 — Cookies

The Platform uses cookies necessary for operation and security:

Session and authentication
Language, theme, and storage of your privacy choices
CSRF protection, fraud prevention, and security

The following optional services remain disabled until the current preference version contains explicit permission:

Audience measurement: Castizen internal statistics, Google Analytics and Microsoft Clarity. Clarity provides heatmaps and masked recordings on a limited list of public pages; it is excluded from authenticated accounts, onboarding, KYC, payments and token-bearing URLs.
Advertising and conversions: Google Tag Manager, Meta Pixel, Meta Conversions API and TikTok Pixel. Depending on the event, these services may receive the IP address, browser, conversion data and hashed or pseudonymous identifiers. Hashing does not make these identifiers anonymous.

Google Tag Manager is a remotely managed container. In production, Castizen requires an approved container ID and version marker before loading it, but the Platform code cannot guarantee or pin the remote content published by Google.

You can accept audience measurement only, also accept marketing, or reject all. Marketing also enables measurement because the approved Google Tag Manager container may include both types of tag.

Preferences are stored for no more than twelve months for the stated policy version. A version change requires a new choice. A previous acceptance is never automatically converted into consent for new providers or purposes.

The “Manage my cookies” button, always available on the Platform, lets you change or withdraw permission. Withdrawal reloads the page without the relevant tag and removes cookies accessible from Castizen; data already received by a provider remains subject to its retention periods and your rights with that provider.

These international providers may process data outside Morocco through their infrastructure and under their terms. Castizen does not sell or rent your personal data.

9 — Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Any changes will be published on this page with the update date. In case of substantial changes, users will be notified via the Platform or by email.

For any questions regarding this Privacy Policy, please contact us at : contact@castizen.com

Also see our Terms of Use.