How Taxii.ma collects, uses, protects, and respects the personal data of everyone who uses our platform — drivers, passengers, and business partners.
Plain-language summary: Taxii.ma is a demand visibility tool, not a ride-booking app. We never match passengers to specific drivers, never share personal contact details between users, and never sell your data. A passenger's location is always blurred to street level (~50 m). Driver identity documents are stored in Morocco and never leave the country.
Taxii.ma is a mobile and web platform operated by Bitmovin, a company registered in Morocco. Our primary service area is Marrakech, Morocco, with planned expansion to other Moroccan cities.
For the purposes of Moroccan data-protection law (Law 09-08), we act as the data controller for information collected through the Taxii.ma driver app, passenger app, and business portal.
A declaration has been filed with the Commission Nationale de contrôle de la Protection des Données à caractère Personnel (CNDP) in parallel with the launch of this service, in compliance with Article 12 of Law 09-08. An authorisation request for the international transfer of data to Europe has also been submitted under Article 43 of Law 09-08.
You can reach us at: contact@taxii.ma
We collect only the minimum information needed to run the service. The table below sets out exactly what we collect, from whom, and why.
| Data Type | From Whom | Description | Identifiable? |
|---|---|---|---|
| Sign-in identity | Drivers & Passengers | Name, email address, and profile photo provided by Google or Apple at login. We do not store passwords. | Personal |
| Driver live location | Drivers (while app is open) | GPS coordinates sent every few seconds while the driver has the app open and is marked "available". Used only to power the heatmap — never shown individually to passengers. | Personal |
| Passenger demand signal | Passengers | A single tap records that someone needs a taxi at approximately their location. The exact GPS pin is immediately blurred to ~50 m (street-level hex cell). The result is a street-level demand count, not a personal pin. | Not linked to identity |
| Driver identity documents (KYC) | Drivers (onboarding only) | A copy of the driver's national ID card or professional taxi licence, uploaded once during onboarding. Reviewed by our team to confirm the driver is a licensed taxi operator. | Sensitive — Morocco only |
| Business contact details | Hotels, receptions, partners | Name, email, and organisation name used to create a business account on the Data Sources portal. Used for group taxi requests on behalf of guests. | Personal |
| Group transport requests | Business partners | Time, approximate pick-up location, and number of passengers for a group request. Not linked to any individual guest name. | Not personal |
| App usage & diagnostics | All users | Crash reports, session duration, and feature interaction events. Used only for stability and improvement. Cannot be linked back to individual users in analytics. | Aggregated only |
We do not collect payment card details, phone numbers (there is no SMS login), or any health or financial information.
Every use of your data maps to a specific, limited purpose:
| Purpose | Data Used | Legal Basis (Law 09-08) |
|---|---|---|
| Create and manage your account | Sign-in identity | Contract performance |
| Show the live demand heatmap to drivers | Passenger demand signals (blurred), driver live location | Contract performance |
| Calculate and display estimated wait times | Blurred demand location, anonymised nearby driver density | Contract performance |
| Verify that drivers are licensed taxi operators | Driver KYC documents | Legitimate interest (platform safety); CNDP declaration filed |
| Route group transport requests to available drivers | Business request details, partner account | Contract performance |
| Improve and fix the platform | Aggregated diagnostics | Legitimate interest |
| Manage driver subscriptions | Driver account, subscription status | Contract performance |
| Comply with legal obligations | As required by applicable law | Legal obligation |
We want to be explicit about the things this service is designed to avoid:
We limit sharing to what is necessary to operate the service. We never sell data.
| Recipient | What They Receive | Why |
|---|---|---|
| Amazon Web Services (AWS Europe) | Pseudonymised operational data (demand signals, driver positions) | Cloud infrastructure hosting our main server. Servers are located in Europe. This transfer is subject to CNDP authorisation under Article 43 of Law 09-08 — see note below. |
| Google / Apple (sign-in providers) | Only the identity token used to verify your sign-in | Authentication only. We do not send any additional data to them. |
| Our authorised staff | Driver KYC documents (in Morocco only), admin dashboard | Reviewing licence documents and managing the platform. |
| Law enforcement / regulatory authorities | Data as required by a valid legal order | Legal obligation under Moroccan law. We will notify you where legally permitted. |
🌍 Cross-border data transfer — Article 43, Law 09-08
The transfer of personal data to Europe via Amazon Web Services is the subject of an express authorisation request submitted to the CNDP in accordance with Article 43 of Law 09-08.
Le transfert de données à caractère personnel vers l'Europe fait l'objet d'une demande d'autorisation expresse auprès de la CNDP conformément à l'article 43 de la loi 09-08.
All third-party processors are bound by data-processing agreements and are required to use your data only for the purpose for which it was shared.
| Data Type | Retention Period |
|---|---|
| Driver live location pings | Held in memory for up to 5 minutes; never written to permanent storage beyond what is needed for the active heatmap. |
| Passenger demand signals (blurred) | Active demand signals expire after 30 minutes. Aggregated demand counts are kept for up to 12 months for service improvement. |
| Driver KYC documents | Retained for the duration of the driver's active account, plus 5 years after account closure (Moroccan commercial record-keeping requirements). |
| Account data (name, email) | For the life of the account, plus 30 days after deletion to allow for recovery. Fully purged after 30 days. |
| Business partner account & requests | For the life of the account, plus 12 months after closure. |
| Crash reports and diagnostics | 90 days, then automatically deleted. |
We apply technical and organisational safeguards proportionate to the sensitivity of the data we hold:
If we become aware of a data breach that is likely to affect your rights, we will notify the CNDP within the legally required timeframe and notify affected users without undue delay.
Under Moroccan Law 09-08, and consistent with principles recognised in the GDPR (applicable to data stored on our AWS infrastructure in Europe), you have the following rights:
Request a copy of all personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your account and associated personal data (subject to legal retention obligations).
Object to processing based on legitimate interests at any time.
Request that we restrict how we use your data while a dispute is pending.
Receive your data in a machine-readable format and transfer it elsewhere.
To exercise any of these rights, contact us at contact@taxii.ma. We will respond within 30 days. If you are not satisfied, you have the right to lodge a complaint with the CNDP (www.cndp.ma).
Taxii.ma is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has created an account, please contact us at contact@taxii.ma and we will delete the account promptly.
The Taxii.ma apps use the following third-party services, each governed by their own privacy policies:
We do not use any advertising networks, social media tracking pixels, or analytics services that share data with third parties.
We may update this policy as the service evolves. When we make material changes, we will notify you by an in-app notice or by email (for registered users) at least 14 days before the new policy takes effect. The "Last updated" date at the top of this page always reflects the most recent version.
Continued use of Taxii.ma after the effective date of a new policy constitutes acceptance of the updated terms.
We take every inquiry seriously. You can reach our privacy point of contact through any of the channels below. We will respond within 30 days.
📧 Email: contact@taxii.ma
🏢 Address: LOTISSEMENT 25 MARS BLOC C N°415 LAAYOUNE, Morocco
For complaints: Commission Nationale de contrôle de la Protection des Données à caractère Personnel (CNDP) — www.cndp.ma