Privacy Policy

1. Who we are

Qodeep Systems is the trade name of Achraf Malki, a registered Moroccan auto-entrepreneur based in Rabat, Morocco (ICE: 003862040000017). He is the controller of the personal data described in this policy.

Contact: contact@qodeep.com.

CNDP declaration receipt no.: pending.

2. What we collect, why, and for how long

If you visit the website. Our host's server logs record technical data: IP address, browser, pages requested and time. We use it to deliver the site and keep it secure. Legal basis (UK GDPR): legitimate interests, running a secure website. We keep it for the short period set by our hosting provider.

If you use our contact form. We collect your name, email, company (optional), budget range and message, to reply and, if you ask, prepare a proposal. Legal basis (UK GDPR): legitimate interests in answering enquiries, and steps you request before a contract. We keep it for 24 months after our last exchange.

If you book a call. We collect your name, email, booking answers, time zone and meeting details, to arrange and hold the call you booked. Legal basis (UK GDPR): steps you request before a contract. We keep it for 24 months after our last exchange.

If we write to your business first. We collect the details described in section 3, to send a relevant business proposal. The legal basis is set out in section 3. We keep them for 12 months after our last contact.

If you become a client. We collect contact and billing details, contracts, invoices, payment records and project messages, to deliver the services, invoice and meet our legal duties. Legal basis (UK GDPR): contract and legal obligation. We keep invoices, contracts and payment records for 10 years, and project messages and other records for 3 years after the engagement ends.

Giving us your details is voluntary. Without your name and email, though, we cannot reply to you or hold a call.

We do not sell personal data. We do not use it for advertising, profiling or automated decisions.

3. If we write to your business first

What we collect. We may contact organisations we believe could benefit from our services. For this we collect:

• the company's name;
• its published general business email address, such as info@ or enquiries@;
• public details about the company and its website.

We never email personal addresses. For UK limited companies, we may also note the directors' names shown on the public Companies House register, so that we can address you correctly if we speak.

Where it comes from. Public sources only:

• the company's website;
• public ad libraries (Google, Meta);
• official registers such as Companies House;
• technology-lookup services;
• job listings.

We never buy contact lists.

How we use it. Only to send a relevant, individually prepared business proposal.

Our legal basis. For UK organisations, it is our legitimate interest in offering our B2B services. Elsewhere, we rely on the basis the local law allows, such as information the company has made public itself.

How long we keep it. Up to 12 months after our last contact, unless you become a client.

Your right to object. You can object at any time: reply "no" to any of our emails, or write to contact@qodeep.com. We stop within 24 hours at the latest. We keep only a minimal "do not contact" entry, so that you are never contacted again.

4. Who receives data

Providers that process data for us:

We use AI assistants (Anthropic, OpenAI, Google) to help draft and organise our work. We may use the text of your message to draft a reply. We never put source code, credentials, contracts or confidential client data into them.

Independent controllers (they process data under their own policies):

• Google (Calendar, Meet) processes booking details.
• Payment providers we use with clients, such as Payoneer and Wise, process payment data.

We may also share data where the law requires it, or to establish, exercise or defend legal claims.

5. Data outside your country

We operate from Morocco. Our providers may process data in other countries, including the United States and the European Union.

Provider safeguards. Where a provider offers a recognised transfer safeguard, such as the UK International Data Transfer Addendum, we rely on it.

From Morocco. Transfers are covered by our CNDP filing (reference: pending).

Ask us. You can ask us for details of the safeguard used.

Client systems. When we work on data inside a client's own systems, we follow the data-processing and transfer terms agreed in our contract with that client.

6. Cookies

We do not use analytics or advertising cookies. Our site sets one cookie, NEXT_LOCALE. It is strictly necessary: it remembers the language you chose (English or French), and it lasts for your browser session, until you close your browser.

Our booking page embeds Cal.com, which may set cookies on its own domain to make bookings work. See Cal.com's privacy policy.

7. Your rights

Right to object. You can object at any time to processing based on our legitimate interests, and to our marketing emails. It is free and you don't need to give a reason.

Everyone. You can ask to access, correct or delete your data by writing to contact@qodeep.com.

In the UK. You also have the rights to restrict processing and to data portability, and to withdraw any consent you gave.

In Morocco. You have the rights of access, rectification and opposition (Law 09-08).

Wherever you live, we honour your local data rights.

How we respond. We answer within one month. For complex requests, we can extend this by up to two more months; if so, we tell you why.

8. Complaints

To us first. Write to contact@qodeep.com with the subject "Privacy complaint". We acknowledge every complaint within 30 days and deal with it without undue delay.

To a regulator. You can also complain to:

• the UK Information Commission (the UK data-protection regulator);
• Morocco's CNDP (cndp.ma);
• the data-protection authority in your country.

9. Security

We use protections suited to the risk, including access controls, multi-factor authentication on our accounts and encrypted (HTTPS) connections. On client projects, our practice is to work on staging copies and not to keep production data on our own devices. No system is completely secure.

10. Changes

We will update this policy when our practices change, and show the date at the top.