Privacy policy

The short version

• This site sets no cookies. There is no analytics, no tracking pixel, no advertising and no profiling.
• Nothing you type is stored on this website. The contact form is relayed straight to our inbox by email; there is no database behind it.
• Three third parties see data when you visit: our host, our email relay if you write to us, and Google, because the page fonts load from Google's servers.
• We are based in Morocco. If you write to us from Europe, your message comes to us there.
• We do not sell personal data and we never will.

Who is responsible

MarByte SARL (MarByte), a company incorporated under the laws of the Kingdom of Morocco, decides why and how the personal data described below is processed. We are the controller (responsable du traitement) within the meaning of Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and, for people in the European Union, of the General Data Protection Regulation (GDPR).

• Email: contact@marbyte.com

What this policy covers

This policy covers this website only. It does not cover the Windchill systems we build, migrate or operate for customers. In that work we act on the customer's documented instructions as a processor, and what happens to the personal data inside their PLM system is governed by the services agreement and data-processing terms we have signed with them, not by this page.

When you use the contact form

The form asks for your name, your email address, your company, a topic and your message. Name, email and message are required; the rest are optional. The form also records the language of the page you sent it from, so we can reply in it. There is also a hidden field that real browsers leave empty and spam robots tend to fill in. If it arrives filled in, the submission is discarded.

What we do with it. We read your enquiry and reply to it, and we use the same details for the follow-up conversation about the work you are asking about.

Why we are allowed to. Where you are asking about working with us, the processing is necessary to take steps at your request before entering into a contract (Article 4 of Law No. 09-08; Article 6(1)(b) GDPR). For any other enquiry we rely on our legitimate interest in answering people who write to us (Article 4 of Law No. 09-08; Article 6(1)(f) GDPR).

Where it goes. The form posts to an address on our own domain. A small program running at our host validates it and hands it to Resend, which delivers it to our mailbox as an ordinary email. The message is not written to any database on this website, and no copy of it stays here.

Please do not send us sensitive material through this form. It is a public web form, not a secure channel. Keep out health data and other sensitive data, and keep out your employer's confidential, classified or export-controlled technical data. If you need to send us something of that kind, ask us first and we will agree a proper channel.

When you just read the site

Our host, Cloudflare, processes the technical data that every web request carries: your IP address, the date and time, the page you asked for, the response status, your browser's user-agent string and the referring page. This is what makes it possible to serve the site, keep it available and detect abuse, and it rests on our legitimate interest. We have request logging enabled for the contact-form endpoint, so those requests are retained by Cloudflare on our behalf for a short period and are used only to investigate errors and abuse.

When you open the bare address of the site, our host reads the languages your browser says it prefers and sends you to the matching language version. That preference is used for that one response and is not stored.

Fonts

The typefaces used on this site are loaded from Google's font servers. That means your IP address and basic browser information reach Google LLC when a page loads. We rely on our legitimate interest in a consistent, readable site. Google describes its own handling of that data in its privacy policy. If you would rather this did not happen, a content blocker that blocks Google Fonts will leave the site fully readable in your system typeface.

Who else receives data

Beyond these, we disclose personal data only where the law requires it, or where it is necessary to establish or defend a legal claim. We do not sell personal information, we do not share it for advertising, and we do not hand it to data brokers.

Sending data across borders

We are established in Morocco, and the providers listed above are in the United States. Data therefore crosses borders in two ways.

• From Europe to us. If you are in the European Economic Area, the United Kingdom or Switzerland and you write to us, your message is transferred to Morocco so that we can answer it. Where there is no adequacy decision for that transfer, it takes place because it is necessary to take steps at your request before a contract (Article 49(1)(b) GDPR) or, once we work together, under the standard contractual clauses in our agreement.
• To our providers. Transfers to the providers above rely on the European Commission's standard contractual clauses in our agreements with them, on their certification under the EU-US Data Privacy Framework where they hold one, and, for transfers from Morocco, on the conditions of Articles 43 and 44 of Law No. 09-08.

Ask us and we will tell you which mechanism applies to a specific provider.

How long we keep things

• Enquiries. Your message stays in our mailbox while we are dealing with it and for 24 months after our last exchange, then it is deleted. If the enquiry turns into an engagement, the correspondence is kept for as long as the customer relationship lasts and for whatever period tax and commercial law then requires.
• Server logs. Retained by Cloudflare for a short period under their standard settings, then discarded.
• On this website. Nothing. There is no database and no stored submission to delete.

Your rights

Under Law No. 09-08 you have the right to be informed, to access the personal data we hold about you, to have it corrected or deleted, and to object, on legitimate grounds, to its processing, and without having to give a reason to its use for prospecting. If the GDPR or UK GDPR applies to you, you also have the right to have our processing restricted, to receive your data in a portable form, and to object to any processing we base on legitimate interest. Where we have asked for your consent, you can withdraw it at any time without affecting what we did before you did so.

Write to contact@marbyte.com. We will reply within one month. We may need to ask a question to confirm who you are, and we will not charge you for a request.

You also have the right to complain to a supervisory authority: in Morocco, the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP, www.cndp.ma); in the EEA, the data protection authority of the country you live or work in; in the United Kingdom, the Information Commissioner's Office. We would rather you came to us first, but that is entirely your choice.

Children

This is a business-to-business site. It is not directed to children and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us something through this site, tell us and we will delete it.

Security

The site is served only over HTTPS and sends a content security policy and related protective headers with every page. Access to the mailbox that receives enquiries is limited to the people who need it. No system is perfectly secure, which is the reason for the warning about sensitive material above.

Changes to this policy

When the site changes in a way that affects your data, we update this page and change the date below. If a change is significant and we hold your contact details, we will tell you directly.

Legal notice

Details of who publishes this site are in the legal notice. The terms it is provided on are in our terms of use, and what happens to money already paid is in ourrefund policy.