This page summarises how ZENVESTA S.A.R.L. collects and processes personal data as part of Maly, in accordance with Law No. 09-08 and its implementing Decree No. 2-09-165, under the supervision of the National Commission for the Control of Personal Data Protection (CNDP). It summarises the “Gestion des données personnelles Maly” document dated 15 September 2026.
Last updated: 16 September 2026.ZENVESTA acts as data controller for user accounts, partner firm applications, administrative and technical logs, and marketing enquiries.
For invoicing, client, expense and accounting document data entered by a client organisation, ZENVESTA acts as data processor: the controller is then the client organisation itself, and rights requests are addressed to it in the first instance.
User accounts: performance of the contract. Partner firm applications: consent. Administrative logs: legal obligation. Support and transactional emailing: legitimate interest. Marketing and commercial enquiries: consent.
You have rights of access, rectification and objection. There is no right to delete accounting documents: anonymisation takes its place, preserving accounting integrity and the audit trail.
These rights are exercised in writing to contact@maly.ma or by post to the registered office of ZENVESTA. Where your organisation is the controller of the data concerned, the request should be addressed to your organisation.
Accounting documents and the electronic signature audit trail (Law 53-05): 10 years, archived, with no automatic purging.
Profiles: for the life of the account, with anonymisation on request (right to object). Rejected partner applications: 12 months. Technical logs and transactional emails: 12 months. Administrative audit logs: 5 years. Consents are logged and versioned, never purged.
ZENVESTA uses processors: Supabase (database, authentication, storage), Brevo (transactional emails), Stripe or CMI (payments), WhatsApp and SMS channels, and AI providers in BYOK mode.
OCR processing is carried out internally, locally on Maly’s infrastructure.
Any transfer outside Morocco is subject to authorisation by the CNDP (Articles 43 and 44); the mapping is maintained in the Maly Compliance console.
Security: encryption in transit and at rest, strong authentication, role-based access control and Row Level Security, backups, a dedicated audit log and immediate access revocation.
ZENVESTA never sells its Users’ personal data.
contact@maly.ma — 05 23 34 42 16 — 332 Boulevard Brahim Roudani, Résidence Rayhane, Floor 5, Apartment 21, Maarif, Casablanca.
For the full detail, see the “Gestion des données personnelles Maly” policy (15 September 2026). Where there is any inconsistency, this policy prevails over the general terms of service.