Privacy Policy

1. Data controller

Updated on 16 July 2026. This policy explains how Ste Tamesta SARL, operating Instafood, processes the data needed for the site, the application, orders and the loyalty programme, in accordance with Moroccan Law 09-08. European rights also apply where the GDPR is territorially applicable.

Ste Tamesta SARL (Instafood) · RC 95883 · ICE 001431924000021. Registered office: Projet Hiba, tranche II, Immeuble 6, Magasin N°7, Tamesna, Témara. Establishment: Centre Commercial Al Mougar, 2nd floor, 90 avenue Mehdi Ben Barka, Souissi - Hay Riad, Rabat. Email: contact@instafoodma.com · Phone: +212 537 65 35 54.

2. Data and purposes

Name, phone, email and account identifier serve to create the account, identify the customer and confirm and track an order (performance of the requested service). Address and delivery details serve to check eligibility and carry out delivery. Basket, amount, service mode, status and history serve to produce, hand over, assist and justify the order (performance of the contract and accounting obligations). InstaGold points and operations administer the loyalty programme. IP address, minimised technical logs, device and security events serve to prevent fraud, diagnose errors and secure the service (legitimate security interest). The Analytics preference measures the audience only after your agreement (revocable consent).

We ask for no sensitive data. Comment fields must not contain medical, banking or official-identity information, or any data unnecessary for the order.

3. Mandatory data

Fields marked as mandatory are essential to fulfil the order or provide the requested feature. Without them, the service concerned cannot be delivered.

4. Recipients and processors

Access is limited to authorised staff according to their role. The main technical processors may include Netlify (hosting and functions), Supabase (database and authentication), Resend (transactional emails when activated) and mapping services used to validate an address. They receive only the data needed for their task.

Activating a processor involving a transfer of data outside Morocco is conditional on verifying contractual safeguards and completing the applicable CNDP formalities. No customer data is sold.

5. Retention periods

Order data: operational duration, then archiving for the applicable accounting, tax or litigation periods. Customer account: until deletion of the account or expiry of the inactivity period defined by Instafood, subject to legal obligations. Security logs: short and proportionate, normally twelve months at most unless an incident justifies targeted retention. Analytics consent: six months at most before renewal. Marketing: until consent is withdrawn or after a reasonable period of inactivity.

6. Security

Internal access is role-controlled, sensitive operations are verified server-side, exchanges are encrypted in transit, and backups, logs and secrets must be administered under restricted-access procedures. No system can promise zero risk; any confirmed incident triggers the appropriate technical and regulatory measures.

7. Your rights

You may request access, rectification or objection under Law 09-08, withdraw a consent and request deletion where no legal obligation prevents it. The other rights provided by the GDPR apply where that text applies to your situation.

Send your request to contact@instafoodma.com. Proportionate proof of identity may be requested only where necessary to avoid disclosing data to a third party. Replies are given within the legal deadlines. You may also refer the matter to the CNDP.

8. Cookies, local storage and Analytics

Essential features use strictly necessary storage. Google Analytics remains blocked until you accept it. Your choice can be changed at any time from the preferences button or the cookies policy.

9. Updates

This policy is revised when processing, processors or applicable requirements change. The date shown at the top indicates the version in force.