Compliance guide for Maweid customers

Lagrichi Digital Solutions (United Kingdom) operates the Maweid platform. We contract with businesses in the UK and internationally. You (the business using Maweid) are usually the data controller for your clients' and staff personal data. Maweid is your processor: we host and process that data on your instructions under the DPA (/legal/dpa). Which country's law applies to you as controller depends on where your business is established and where your clients are — not where our servers are. You may need to comply with more than one regime at once.

Wherever you operate, these steps reduce risk: • Accept Maweid Partner terms and DPA — we process your clients' data as your processor; you remain the controller. • Tell people why you collect data (booking, CRM, reminders) in language they understand. • Have a lawful basis for each purpose (contract for appointments; separate consent for marketing where required). • Use the built-in booking privacy notice and consent checkbox on your public page. • Only enable email, SMS, or WhatsApp you actually need; no spam or purchased lists. • Keep data accurate; export or delete records you no longer need (Clients CSV, Appointments export where available). • Before closing Maweid, export data, cancel Stripe billing, and email support for account deletion. • Document cross-border transfers — Maweid uses cloud providers listed at /legal/subprocessors. • Register or notify your local data authority only if your country's law requires it (this is separate from Lagrichi Digital Solutions' UK ICO registration as platform operator).

Law 09-08 and CNDP practice apply to controllers in Morocco. • French and/or Arabic notices help. • Honour access, correction, and deletion requests. • Assess transfers when client data is processed outside Morocco (typical with SaaS). Work with local counsel on CNDP steps.

If you are in France or the wider EEA, or target clients there, EU GDPR applies to you as controller. • Privacy notice with purposes, legal bases, retention, and rights. • Data Processing Agreement with Maweid (/legal/dpa) documents our processor role. • Transfers outside the EEA need appropriate safeguards (Standard Contractual Clauses, adequacy, or local rules). • Clients may complain to their supervisory authority (in France: CNIL).

UK GDPR and the Data Protection Act 2018 apply if you are UK-established or offer services to people in the UK. • Similar controller duties to the EEA: transparency, lawful basis, security, rights. • ICO complaints: ico.org.uk. Lagrichi Digital Solutions' own obligations as UK platform operator are in /legal/privacy.

If you operate in the UAE (including Dubai free zones) or handle UAE residents' data, federal UAE Personal Data Protection Law (PDPL) and related rules may apply, along with sector or free-zone requirements. • Provide clear notice and a lawful basis; document cross-border transfers (common with global SaaS). • Honour access, correction, and deletion requests within applicable timeframes. • Marketing and WhatsApp need particular care — obtain valid consent where required. Other GCC states may have their own laws; confirm with local counsel if you expand beyond the UAE.

Maweid is cloud-hosted. Data may be processed in the UK, EEA, US, and other regions where our subprocessors operate (/legal/subprocessors), including Stripe and hosting providers. Lagrichi Digital Solutions uses UK GDPR transfer tools (IDTA / UK Addendum to SCCs) with providers where required. You, as controller, must also ensure lawful transfer for your clients' data under your local law (EU GDPR, Morocco 09-08, UAE PDPL, etc.). Our DPA and subprocessor list are designed to help you document processor arrangements — not to replace your own transfer assessment.

This guide is not legal advice. Laws change and differ by country, emirate, and sector. Consult qualified counsel in each market you serve (e.g. Morocco, France, UAE, UK). Platform questions: support@lagrichidigital.com Data subject requests about your clients: you respond as controller; we assist via the DPA when you ask.