Privacy Policy

01 Data Controller

02 Data We Collect

Depending on your interaction with us, we may process the following categories of personal data:

2.1 Data you provide directly

• Identification data: name, surname, job title, company name
• Contact data: email address, telephone number, postal address
• Commercial data: details of services requested, shipment information, payment references
• Communication data: content of messages sent via our contact form or email

2.2 Data collected automatically

• Technical data: IP address, browser type and version, operating system, referring URLs
• Usage data: pages visited, time spent, clicks, navigation path
• Cookie data: see our Cookie Policy for full details

2.3 Data from third parties

• Business contact information provided by partners or clients within the context of a logistics contract
• Publicly available business registry data for due-diligence purposes

03 Purposes & Legal Basis

Where we rely on legitimate interest, you may object at any time (see Section 6).

04 Retention Periods

• Contact form data — 3 years from last interaction, unless a contract is concluded
• Contract data — 10 years from contract end (Spanish Commercial Code art. 30)
• Invoices and fiscal records — 5 years (Spanish General Tax Law art. 66)
• Marketing consent — Until withdrawn or 3 years of inactivity
• Analytics cookies — Up to 13 months (see Cookie Policy)

Once retention periods expire, data is securely deleted or anonymised.

05 Recipients & International Transfers

We share data only when necessary and under appropriate safeguards:

• Carriers and logistics partners — to fulfil transport and warehousing contracts (data processing agreements in place)
• IT service providers — cloud hosting, CRM, email platforms (EU-based or Standard Contractual Clauses applied)
• Accounting and legal advisors — bound by professional confidentiality
• Public authorities — when required by applicable law (tax, customs, judicial orders)

We do not sell personal data. Where transfers occur outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy decisions.

06 Your Rights

Under GDPR you have the following rights, exercisable free of charge:

• Access (Art. 15) — Obtain a copy of your data and information about processing
• Rectification (Art. 16) — Correct inaccurate or incomplete data
• Erasure (Art. 17) — Request deletion ("right to be forgotten") where applicable
• Restriction (Art. 18) — Limit processing in certain circumstances
• Portability (Art. 20) — Receive your data in a machine-readable format
• Objection (Art. 21) — Object to processing based on legitimate interest or for direct marketing
• Withdraw consent — At any time without affecting prior processing
• Not to be subject to automated decisions (Art. 22) — We do not use solely automated decision-making with legal effects

To exercise your rights, contact us at contact@outlitna.ma with proof of identity. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.

07 Security Measures

We apply technical and organisational measures proportionate to the risk, including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for data at rest on our servers
• Role-based access controls and multi-factor authentication for staff
• Regular security audits and penetration tests
• Data breach detection procedures with 72-hour AEPD notification capability
• Annual staff training on data protection

08 Minors

Our services are directed exclusively to businesses and professionals. We do not knowingly collect personal data from individuals under 16 years of age. If we become aware of such collection, we will delete the data immediately.

09 Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email (to active clients) and a notice on this page. The "Last updated" date at the top always reflects the current version. Your continued use of our services after changes constitutes acceptance.

10 Contact & Complaints

For any data protection matter:

Supervisory authority: Agencia Española de Protección de Datos (AEPD) — www.aepd.es