Data Protection Policy

BARRA — Opportunities & Talent Platform

Effective date: March 23, 2026 — Last updated: March 23, 2026 — Version 1.0

This Data Protection Policy complements our Privacy & Security Policy. While the Privacy Policy explains what data we collect and how we use it, this policy details the legal framework, your rights, and the measures we take to keep your data safe.

1. LEGAL FRAMEWORK

BARRA complies with Moroccan law n° 09-08 on the protection of individuals with regard to personal data processing, and with the General Data Protection Regulation (GDPR) for our European users.

2. LEGAL BASES FOR PROCESSING

In accordance with law 09-08, we process your data on the following legal bases:

You can withdraw consent at any time via Settings > Privacy.

3. DATA RETENTION PERIODS

After deletion, your data is permanently erased from production systems and backups within 90 days.

4. YOUR RIGHTS

Under law 09-08, you have the following rights:

4.1 Right of Access

Request a copy of all personal data we hold about you: profile, CV, portfolio, barras history, applications, payments, geolocation, logs, and gamification interactions.

4.2 Right to Rectification

Correct your personal information directly from your BARRA profile, or ask us to do so.

4.3 Right to Erasure ("Right to be Forgotten")

Request deletion of your account and personal data, unless we have a legal obligation to retain it (e.g. tax records of payments).

4.4 Right to Restrict Processing

Request temporary suspension of processing in certain cases (accuracy dispute, processing objection).

4.5 Right to Object

Object to processing for the following purposes:

• Direct marketing (promotional emails, targeted advertising)
• Platform improvement based on legitimate interest
• Sharing with commercial partners

To exercise: Settings > Privacy > Marketing and Data Sharing > Disable.

4.6 Right to Data Portability

Receive your data in a structured, commonly used format and transmit it to another platform.

• Full profile (JSON)
• CV and portfolio (PDF)
• Barras and payment history (CSV)

4.7 Right to Withdraw Consent

For consent-based processing (marketing, non-essential cookies, partner sharing), you can withdraw at any time without affecting prior processing.

4.8 How to Exercise Your Rights

• Email: privacy@barraa.tech
• Post: BARRA SARL, Barraa 200, Casablanca, Morocco
• In-app: Settings > Privacy > My Data and Rights

We will respond within 30 days in accordance with Moroccan law.

4.9 Complaint to CNDP

If you believe your rights have not been respected, you can file a complaint with the National Commission for Data Protection (CNDP):

CNDP — Avenue Allal El Fassi, Madinat Al Irfane, Hay Riad, Rabat

Phone: +212 537 57 73 00 | Email: cndp@cndp.ma | Website: www.cndp.ma

5. DATA SECURITY

5.1 Technical Measures

• Encryption: All data in transit via HTTPS/TLS 1.3
• Passwords: Hashed with bcrypt (never stored in plain text)
• JWT tokens: Secure authentication with automatic expiration
• Firewall & WAF: Protection against network attacks and SQL injection
• Encrypted backups: Daily with 30-day retention
• Service isolation: Microservices architecture with separate Docker containers
• Anonymised geolocation: GPS coordinates rounded (precision reduced to 100m)
• Fraud detection: AI algorithms to identify fake profiles and suspicious activity
• Continuous monitoring: Access logs and real-time intrusion detection

5.2 Organisational Measures

• Limited access: Principle of least privilege
• Training: Staff trained in data protection best practices
• Security policy: 2FA mandatory for administrators
• Regular audits: Quarterly security reviews by external experts
• Penetration testing: Annual pentests
• Incident management: Response plan for data breaches

5.3 Breach Notification

In case of a data breach posing a high risk to your rights and freedoms, we commit to:

• Notify CNDP within 72 hours of discovery
• Directly inform affected users by email and in-app notification
• Take immediate corrective measures (forced password change, compromised account suspension)
• Publish a post-incident transparency report

6. COMMERCIAL USE OF DATA

6.1 Monetisation

• Targeted advertising: Profile-based display ads, video ads, native ads integrated into opportunity feeds
• Barra commissions: 5–10% commission on each platform payment
• Premium subscriptions: Enhanced visibility, priority matching, early hackathon access

6.2 Anonymised Aggregate Data

We may sell or share anonymised data with universities (to adapt programmes), companies (recruitment strategies), and public institutions (employment policies). This data can never identify you individually.

6.3 Profile Sharing with Consent

With explicit consent, your profile may be shared with companies, hackathon organisers, investors, and headhunters. You maintain full control: Settings > Privacy > Profile Visibility > "Visible to recruiters" (Yes/No).

6.4 AI Use

Your data feeds our AI algorithms to improve matching, predict in-demand skills, suggest relevant training, detect fake profiles, and optimise suggested barra pricing. You can request explanations about AI recommendations via contact@barraa.tech.

7. PROTECTION OF MINORS

BARRA is intended for users aged 18 and older. We do not knowingly collect personal data from children under 18. If we discover that a minor has created an account, we immediately suspend it, contact legal representatives, and delete all collected data within 48 hours.

If you believe a minor has created an account, contact us at abuse@barraa.tech.

8. INTERNATIONAL TRANSFERS

Some providers (Google, Stripe, AWS) may transfer data outside Morocco. We ensure appropriate safeguards are in place (EU standard contractual clauses, Privacy Shield certifications).

9. DATA TRANSFERS IN CASE OF MERGER/ACQUISITION

In case of merger, acquisition, or asset sale involving BARRA, your data may be transferred to the new entity. You will be informed by email 30 days before the transfer. The new entity must respect this policy. You have the right to object and request deletion.

10. FINAL PROVISIONS

Language: This policy is drafted in French. In case of translation, the French version prevails.

Applicable law: Moroccan law, notably law n° 09-08.

Jurisdiction: Courts of Casablanca, Morocco.

By using BARRA, you acknowledge that you have read, understood, and accepted this Data Protection Policy.

© 2026 BARRA SARL — Connecting talent with opportunities