MARAZ Origins (hereinafter "MARAZ", "we", "our") attaches great importance to the protection of your personal data and respect for your privacy. This Privacy Policy explains how we collect, use, share and protect your personal information when you visit our marazorigins.com website and use our services.

This policy applies to all personal data we collect via our website, our physical stores (Dakar, Abidjan, Kigali), our social networks, our customer service and any other communication channel with MARAZ Origins.

By using our site and services, you accept the practices described in this Privacy Policy. If you do not accept these practices, please do not use our site or services.

MARAZ Origins is the data controller of your personal data. We are committed to processing your data in accordance with the European Union's General Data Protection Regulation (GDPR), Senegalese Law No. 2008-12 of January 25, 2008 on the protection of personal data, and all other applicable data protection legislation.

We collect different types of personal data depending on the nature of your interaction with MARAZ Origins:

Identification data: Last name, first name, date of birth, gender, postal address, telephone number, email address, account identifiers.

Order data: Purchase history, products viewed, shopping cart, product preferences, usual size.

Payment data: Credit card information (via our secure payment provider), bank details for transfer, Mobile Money information. We never store your complete banking data on our servers.

Delivery data: Delivery and billing addresses, specific delivery instructions, delivery history.

Navigation data: IP address, browser type, operating system, pages visited, visit duration, source (referrer site), actions performed on the site, cookie data.

Communication data: History of your exchanges with our customer service (emails, chats, phone calls), your reviews and comments on our products, your responses to our satisfaction surveys.

Social network data: If you log in via Facebook, Instagram or another social network, we may collect your public profile information that you have authorized to share.

Location data: With your consent, we may collect geolocation data to offer you the nearest stores or localized offers.

We use your personal data for the following purposes, based on appropriate legal grounds:

Order processing: Account management, processing and delivery of your orders, billing, payment management, after-sales service. Legal basis: execution of sales contract.

Commercial communication: Sending our newsletter, information on our new products, promotional offers, event invitations. Legal basis: consent (you can unsubscribe at any time).

Improvement of our services: Analysis of navigation data to improve site ergonomics, personalization of your experience, product recommendations, statistical studies. Legal basis: legitimate interest.

Customer service: Answering your questions, managing complaints, technical assistance, satisfaction follow-up. Legal basis: contract execution and legitimate interest.

Fraud prevention: Transaction verification, detection of fraudulent behavior, protection of our systems. Legal basis: legitimate interest and legal obligation.

Legal obligations: Compliance with our accounting, tax and legal obligations, response to requests from competent authorities. Legal basis: legal obligation.

Targeted marketing: With your consent, display of personalized ads on our site and third-party sites, remarketing. Legal basis: consent.

Our site uses cookies and similar technologies to improve your browsing experience, analyze traffic and personalize content.

A cookie is a small text file stored on your computer or mobile device when you visit our site. It allows you to remember your preferences and recognize your device during future visits.

Types of cookies used:

Essential cookies: Necessary for site operation (shopping cart, account login, security). They cannot be disabled. Legal basis: legitimate interest.

Performance cookies: Collection of anonymous information on site usage (pages visited, errors encountered) via Google Analytics. Legal basis: consent.

Functionality cookies: Memory of your preferences (language, currency, display size). Legal basis: consent.

Advertising cookies: Display of personalized ads, measurement of campaign effectiveness, remarketing via Facebook Pixel, Google Ads. Legal basis: consent.

Cookie management: During your first visit, a banner asks for your consent to use non-essential cookies. You can change your preferences at any time via the "Cookie Management" link at the bottom of the page. You can also configure your browser to refuse cookies, but some site features may no longer work properly.

Cookie retention period: Session cookies are deleted when you close your browser. Persistent cookies remain on your device for a maximum of 13 months, in accordance with GDPR.

Your personal data is never sold to third parties. We may share your data only in the following cases:

Service providers: We work with trusted providers to help us manage our business: web host (secure servers), payment provider (Stripe, PayPal), carriers (DHL, FedEx, UPS), email service (Brevo), analytics tools (Google Analytics), customer service. These providers have access to your data only to perform their tasks and are contractually required to protect it and not use it for other purposes.

Legal obligations: We may disclose your information if required by law or in response to a legitimate request from authorities (police, justice, tax administration).

Protection of our rights: We may use and disclose your data to assert our rights, protect our property, ensure the safety of our users or investigate fraud.

International transfers: Some of our providers may be located outside Senegal or the European Union. In this case, we ensure that appropriate safeguards are in place (standard contractual clauses, European Commission adequacy decision, Privacy Shield certification for the United States) to protect your data in accordance with GDPR.

Merger or acquisition: In the event of merger, acquisition, asset transfer or receivership procedure, your personal data could be transferred to the successor entity. We would inform you in advance.

In accordance with GDPR and Senegalese data protection law, you have the following rights regarding your personal data:

Right of access: You can request access to all personal data we hold about you, obtain a copy of this data and information on its processing.

Right of rectification: You can request correction of inaccurate or incomplete data. You can also update your information directly from your customer account.

Right to erasure ('right to be forgotten'): You can request deletion of your data in certain circumstances (withdrawal of consent, objection to processing, unnecessary data, unlawful processing).

Right to restriction of processing: You can request restriction of processing of your data in certain cases (contest accuracy, unlawful processing, objection to processing).

Right to portability: You can request to receive your data in a structured, commonly used and machine-readable format, and transmit it to another data controller.

Right to object: You can object at any time to processing of your data for marketing, profiling or legitimate reasons. You can unsubscribe from our marketing communications via the unsubscribe link in each email.

Right to withdraw your consent: When processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.

Right to define post-mortem directives: You can define directives regarding the fate of your data after your death.

To exercise these rights, contact us at privacy@marazorigins.com or by mail to: MARAZ Origins, Data Protection Service, [Full address], Dakar, Senegal. We will respond to your request within a maximum of one month. Proof of identity may be requested to verify your identity.

Right to complain: If you believe your rights are not being respected, you can file a complaint with the competent supervisory authority: the Commission for the Protection of Personal Data (CDP) of Senegal or the CNIL in France.

We retain your personal data only for the time necessary for the purposes for which it was collected, in compliance with our legal obligations:

Customer account data: Kept throughout your customer relationship with us, then archived for 3 years from the last activity (login, purchase) to comply with legal and tax obligations.

Order and billing data: Kept for 10 years in accordance with Senegalese accounting and tax obligations.

Payment data: We do not keep your banking data. It is processed directly by our secure payment providers (Stripe, PayPal) certified PCI-DSS.

Navigation data (cookies): Kept for a maximum of 13 months in accordance with GDPR.

Marketing data: Kept for 3 years from the last interaction (purchase, email opening, click) for customers, and 3 years from collection for prospects.

Customer service data: Kept for the time necessary to process your request, then archived for 5 years for evidence purposes in case of dispute.

At the end of these periods, your data is deleted securely or anonymized irreversibly for statistical purposes.

MARAZ Origins implements appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access:

Technical security: SSL/TLS encryption for all communications (HTTPS), firewalls, intrusion detection systems, regular security updates, encrypted backups, secure storage in ISO 27001 certified data centers.

Organizational security: Access to data limited to only employees and providers who need it for their functions, confidentiality obligation, regular training of our teams on data protection, security incident management procedures.

Secure payments: We use PCI-DSS (Payment Card Industry Data Security Standard) certified payment providers. Your banking data never passes through our servers and is not stored with us.

Authentication: Your account is protected by a password. We recommend choosing a strong password and never sharing it. Enable two-factor authentication if available.

Despite our efforts, no system is completely foolproof. In case of data breach likely to result in high risk to your rights and freedoms, we will inform you within 72 hours and notify the competent supervisory authority in accordance with GDPR.

Our site and services are not intended for persons under 18 years of age. We do not knowingly collect personal data from minors without the consent of their parents or legal guardians.

If you are a minor (under 18 in Senegal), you must obtain authorization from your parents or legal guardians before creating an account, placing an order or providing us with personal information.

If we learn that we have collected personal data from a minor without appropriate parental consent, we will take steps to delete this information as soon as possible.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, contact us immediately at privacy@marazorigins.com.

MARAZ Origins reserves the right to modify this Privacy Policy at any time to reflect changes in our practices, our services, legal requirements or for other operational reasons.

In case of substantial modification, we will inform you by email (at the address associated with your account) and/or by visible notification on our site, at least 30 days before the new conditions take effect.

The updated version of the Privacy Policy will always be available on this page, with the date of last update indicated at the top of the document. We encourage you to regularly consult this page to stay informed of our data protection practices.

By continuing to use our services after the changes take effect, you accept the revised Privacy Policy. If you do not accept the changes, you must stop using our services and ask us to delete your account.

Last updated: February 10, 2026

For any questions regarding this Privacy Policy, the exercise of your rights or the processing of your personal data, you can contact us:

Data Protection Officer (DPO) email: privacy@marazorigins.com

Customer service email: contact@marazorigins.com

Phone: +221 XX XXX XX XX (Monday to Saturday, 9am-6pm GMT)

Mail: MARAZ Origins, Personal Data Protection Service, [Full address], Dakar, Senegal

We are committed to responding to your request within a maximum of one month from its receipt. This period may be extended by two additional months if necessary, taking into account the complexity and number of requests. In this case, we will inform you of this extension and the reasons for the postponement within one month from receipt of the request.

If you are not satisfied with our response or if you believe we are not complying with our data protection obligations, you can file a complaint with the competent supervisory authority:

Senegal: Commission for the Protection of Personal Data (CDP) - www.cdp.sn

France: National Commission for Information Technology and Liberties (CNIL) - www.cnil.fr

European Union: See list of supervisory authorities on www.edpb.europa.eu