Privacy Policy
Herculex Flooring Factory (“Herculex”, “we”) takes the protection of your personal data seriously. This policy explains what data we collect on herculexfactory.com and its related services (visualizer, forms, order pages, reseller portal, affiliate area), why, for how long, who receives it and how to exercise your rights.
It is drawn up in accordance with Moroccan Law No. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data and its implementing texts, under the supervision of the National Commission for the Control of Personal Data Protection (CNDP). Where you are located in the European Union or the European Economic Area, the General Data Protection Regulation (EU) 2016/679 (GDPR) also applies.
1. Data controller
The data controller is:
- Company name
- Herculex Flooring Factory
- Address
- Salé, Morocco
- Phone
- +212 661 73 49 55
- info@herculexfactory.com
For any question about your personal data, write to info@herculexfactory.com (subject “Personal data”).
2. Data we collect
We only collect the data needed for the service you request. Required fields are marked in each form; without them we cannot process your request.
- Browsing: IP address, device and browser type, pages viewed, date and time (technical logs kept by our hosting provider), and your language choice (stored in your browser).
- “Visualize at home” tool: e-mail, city, phone (optional), the photo of your room, and the decor and laying pattern selected. The photo is used only to produce the render and is not kept on our servers. To prevent abuse we keep a counter linked to an encrypted fingerprint (hash) of your e-mail and IP address.
- Contact and request forms (contact, wall panels, become a reseller, download updates, Herculex Academy): name, company, city, phone or WhatsApp, e-mail, message, business activity, trade register/ICE numbers (optional); for the Academy, age and experience level.
- Orders (consumer order pages and partner pages): name, phone, e-mail (optional), city, site address, products, quantities, amounts, pickup or delivery, recorded payments and estimates.
- Sample requests: company, name, phone, e-mail, delivery address and business activity.
- Reseller portal: company name, representative’s name, store address, years in business, website, e-mail, phone, chosen pack, electronic signature of the agreement and date of acceptance, password (stored only in irreversible encrypted form), orders, volumes, payments and invoices. Once a reseller is approved, its listing (trade name, city, address, phone, WhatsApp, location) is published on the public reseller map.
- Affiliate area: login e-mail, encrypted password, attributed orders, commissions and payouts.
- Conversations by WhatsApp, phone or e-mail: the content of your messages.
We do not collect sensitive data within the meaning of Law No. 09-08 (racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health, etc.).
3. Why we use it
- Answering your requests and getting back to you (pre-contractual steps taken at your request, legitimate interest).
- Producing your render with the visualizer and sending it to you with our documentation (your request; your consent when you leave your contact details).
- Processing your orders: estimate, confirmation, production, delivery or pickup, invoicing, after-sales service and warranty (performance of the contract; legal accounting and tax obligations).
- Managing the reseller network: applications, accounts, orders, reseller map (performance of the authorized reseller agreement).
- Running the affiliate program: attributing orders placed from a partner’s page and calculating the partner’s commission (performance of the contract with the partner).
- Reviewing applications to the Herculex Academy (pre-contractual steps).
- Keeping our services secure: fraud and abuse prevention, limiting login attempts (legitimate interest).
- Counting visits to partner pages as an overall total, without individual profiles (legitimate interest).
- Keeping you informed about our news, only if you have agreed. In line with Article 10 of Law No. 09-08, we do not send marketing by e-mail or automated calls without your prior consent, and every message lets you unsubscribe.
We do not sell your data, we do not run targeted advertising, and we take no decision producing legal effects concerning you based solely on automated processing.
4. Who can access it
- Authorized Herculex staff, according to their role. The factory production screen never shows customers’ names or contact details.
- Our authorized resellers, only if you ask to be put in touch with one of them.
- Our affiliate partners: for an order placed from a partner’s page, the partner only sees the customer’s first name and city, the products, the area ordered and their commission. Never the phone number, e-mail or address.
- Our technical service providers, acting on our behalf and on our instructions:
- Netlify, Inc. (United States): website hosting, server functions, data and form storage, notification e-mails;
- Google LLC (United States): generating visualizer renders (room photo and chosen decor) and automatically reading business documents sent to Herculex (requests for quotation, estimates, bank statements);
- OpenStreetMap Foundation (United Kingdom): map background on the “Find a reseller” page and geolocation of reseller addresses; the mapping library is loaded from the unpkg content delivery network;
- ntfy.sh: internal notifications on the team’s phones (order number and amount, without the customer’s name or phone number).
- Meta Platforms (WhatsApp), when you choose to write to us on WhatsApp; those conversations are governed by WhatsApp’s privacy policy.
- Carriers, for delivery (name, phone, address).
- Our advisers (accountant, lawyer), bound by professional secrecy, and public authorities where the law requires.
5. Transfers outside Morocco
Some of our providers are located outside Morocco, in particular in the United States. These transfers are made in accordance with Articles 43 and 44 of Law No. 09-08: to a country ensuring an adequate level of protection, with CNDP authorization, or where the transfer is necessary to provide the service you request or you have expressly consented to it.
For people located in the European Union, these transfers are covered by appropriate safeguards within the meaning of the GDPR: the European Commission’s standard contractual clauses offered by our providers or, where they are certified, the EU–U.S. Data Privacy Framework.
6. How long we keep it
- Requests, contacts and prospects (forms, visualizer): 3 years after our last exchange.
- Photos sent to the visualizer: not kept beyond generating the render.
- Anti-abuse counters (encrypted fingerprints): 24 months at most.
- Orders, estimates, invoices and payments: 10 years, in line with accounting obligations (Law No. 9-88).
- Reseller and affiliate accounts: for the duration of the relationship, then 5 years (commercial limitation period), subject to accounting records kept for 10 years.
- Academy applications: 2 years.
- Technical logs: as set by our hosting provider, usually a few weeks.
After these periods, data is deleted or anonymized.
7. Security
We protect your data with appropriate technical and organizational measures: encrypted connection (HTTPS) across the whole site, passwords stored only in irreversible encrypted form, secure session cookies, role-based access, unlock codes on management devices, limits on login attempts, and minimal data display (factory screen, partners). If a data breach is likely to put you at risk, we will inform the CNDP and, where the law requires, the people concerned.
8. Your rights
Under Law No. 09-08 you have the right to information, the right of access to your data, the right to rectification and the right to object, on legitimate grounds, to the processing of your data, and free of charge and without giving reasons to its use for marketing.
If the GDPR applies to you, you also have the rights to erasure, to restriction of processing, to data portability, and the right to withdraw your consent at any time.
To exercise your rights, write to info@herculexfactory.com. We may ask you to prove your identity. We reply within 30 days.
You may lodge a complaint with the CNDP (www.cndp.ma) or, if you live in the European Union, with the data protection authority of your country.
10. Minors
Our services are intended for adults. An application to the Herculex Academy submitted by someone under 18 must be accompanied by the consent of their legal guardian. We do not knowingly collect data about children without that consent.
11. Third-party links and services
Our site contains links to third-party services (WhatsApp, Instagram, partners’ websites). Their use is governed by their own privacy policies.
12. Changes to this policy
We may update this policy, in particular to reflect changes to our services or to the law. The date of the last update appears at the top of this page; if we make an important change, we will say so clearly on the site.