01 Controller & processor
When a merchant collects personal data from its customers through a Kayroo store, the merchant is the data controller and Kayroo is the processor. Kayroo processes that data only to provide the Services and on the merchant's documented instructions, consistent with Law 18-07.
02 Merchant obligations
The merchant must have a lawful basis to collect customer data, provide its own privacy notice, respond to customer rights requests, and only instruct lawful processing.
03 Kayroo obligations
Kayroo keeps customer data confidential, applies appropriate security measures, uses only vetted sub-processors under equivalent obligations, assists the merchant with rights requests and security incidents within reason, and deletes or returns customer data on termination subject to legal retention.
04 Sub-processors & transfers
Kayroo may engage sub-processors (hosting, email, delivery, AI) bound by data-protection terms. Where processing occurs outside Algeria, safeguards consistent with Law 18-07 are applied.