Skip to content

Privacy policy

Last updated: 17 October 2026

This text is a draft prepared for Rentoth. It must be reviewed by a lawyer registered in Morocco before it is relied on.

This policy explains how Othmane TIBARI processes personal data through Rentoth and its website www.rentoth.com, in line with loi 09-08 on the protection of individuals with regard to the processing of personal data.

Rentoth plays two roles. It is the controller for the data of its own customers (the agencies), for the account, sign-in and security data of the agencies' users, and for the data of prospects and website visitors. It processes the data of the agencies' customers (the renters) only on behalf of each agency, which is the controller of that data.

1. Who is responsible

Othmane TIBARI (private individual), Marrakech, is the controller for the processing described in section 3. CNDP receipt and authorisation numbers: [to be completed]. For any question, write to privacy@rentoth.com.

2. The data concerned

  • Agency users: name, email, phone, role, sign-in history and the actions they take in the Service.
  • Agencies: legal and tax identifiers (ICE, RC, IF), bank and billing details, invoices and payments.
  • Prospects: the details they choose to send when they request a demo. Only a way to reach them is needed; everything else is optional.
  • Website visitors: technical data needed to deliver the pages and keep them secure (IP address, browser, pages requested).
  • Renters, on behalf of the agencies: identity and contact details, ID and driving licence numbers, bookings, contracts, the image of their signature with the time and IP address of signing, payments and deposits, and any photos of a returned car.
  • Vehicle geolocation, on behalf of the agencies that switch it on: position, speed, direction, ignition, kilometres and time of the last signal of the agency's cars, read from the agency's own tracking platform or sent by its trackers to Rentoth's tracking server.

3. Why the data is used

  • To provide the Service to the agencies and support them: performance of the contract.
  • To invoice, collect and keep accounting records: legal obligations.
  • To secure the Service, prevent fraud and misuse, and keep technical logs: legitimate interest.
  • To answer demo requests and follow up with prospects: pre-contractual steps they requested.
  • Rentoth does not sell personal data, does not use it for advertising, and does not use advertising or audience-measurement cookies.

4. Renters' data

Each agency decides which renter data it records and why. Rentoth processes that data only to provide the Service to the agency, following its instructions, and does not use it for any other purpose.

A renter who wants to access, correct or oppose the processing of their data should contact the agency they rented from. Rentoth helps the agency answer these requests.

Geolocation: Rentoth reads and shows the position of an agency's cars only once that agency has its own prior authorisation from the CNDP and has switched on the geolocation clause of its contracts, and records no position during a rental recorded in Rentoth whose contract does not carry that clause (a tracker that sends to Rentoth's own tracking server is paused until that rental ends). Rentoth never uses this data for itself, its team does not view positions, and it sends no command to any vehicle.

5. Who receives the data

Only the people at Rentoth who need the data for their work can access it. The Service relies on the following providers, which process data on its behalf: Vercel Inc. (USA); Hetzner Online GmbH (Germany); MongoDB, Inc. (MongoDB Atlas) (USA); Cloudinary Ltd. (USA / Israel); Google LLC (Google Fonts, Gmail, Google Analytics) (USA); ImprovMX Inc. (email forwarding) (USA / France); OpenStreetMap Foundation (United Kingdom). Emails to agencies and renters (sign-in, booking and contract signing messages) are sent through Brevo (Sendinblue SAS, France).

For geolocation, the data comes from the tracking platform the agency chose and contracted with (Wialon, Traccar, Navixy, GPSWox or flespi, possibly outside Morocco), which the agency covers in its own formalities. Trackers that send directly to Rentoth reach its tracking server, hosted with the same provider as the Service's API.

Data may also be disclosed to the authorities when the law requires it.

6. Transfers outside Morocco

Some of these providers store or process data outside Morocco, in the countries shown next to their names. For its own processing, Othmane TIBARI carries out these transfers under articles 43 and 44 of loi 09-08, with the declaration or authorisation the CNDP requires (references: [to be completed]).

For renters' data, each agency, as the controller, covers these transfers in its own formalities with the CNDP.

7. How long the data is kept

  • Agency and user accounts: for the length of the subscription, then thirty days for the export, then deleted.
  • Invoices and accounting records: ten years, as commercial law requires.
  • Prospects: up to three years after the last contact.
  • Technical logs: up to twelve months.
  • Renters' data: as long as the agency keeps it in the Service, and deleted at the end of the agency's subscription, after the export period.
  • Photos of a returned car: they may be deleted after a period set by the platform, never less than twelve months after the end of the rental.
  • Vehicle positions: 7, 30 or 90 days, as each agency chooses (30 by default); a car's last known state while its tracker stays linked; the raw data received by Rentoth's tracking server, 7 days; tracking alerts, 90 days; the log of who viewed positions, 12 months.

8. Security

Data is encrypted in transit. Access is protected by personal credentials, session cookies that page scripts cannot read, roles that limit what each user can do, and separation between agencies. Data is backed up regularly.

9. Your rights

Under loi 09-08, you have the right to be informed, to access your data, to have it corrected or deleted, and to object to its processing for legitimate reasons. You can also object at any time, free of charge and without giving a reason, to the use of your data for prospecting. To exercise these rights, write to privacy@rentoth.com with proof of your identity. We answer within the time the law sets.

You can also file a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), www.cndp.ma.

10. Changes

This policy may change. The date at the top shows the last update. Agencies are told about any significant change.