Privacy Policy
Introduction
The Institute for Advanced Studies at Mohammed VI Polytechnic University (IAS UM6P) is committed to protecting the privacy and personal data of everyone who interacts with our institution — including residency applicants, program participants, website visitors, event attendees, and correspondents.
This Privacy Policy describes how we collect, use, store, share, and protect personal data in accordance with Moroccan Law n° 09-08 of February 18, 2009, on the protection of individuals with regard to the processing of personal data (Loi relative à la protection des personnes physiques à l'égard des traitements des données à caractère personnel), implemented by Decree n° 2-09-165 of May 21, 2009, and enforced by the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).
This Policy applies to personal data processed by IAS UM6P in connection with: (i) the academic residency application and selection process; (ii) the management of active and past residencies; (iii) events, seminars, and programs; (iv) the IAS website (ias.um6p.ma) and associated digital services; and (v) general institutional communications.
By submitting a residency application, registering for an event, or using our website, you acknowledge that you have read and understood this Policy. Where your consent is required as a legal basis for processing, we will obtain it separately and explicitly.
Identity of the Data Controller
In accordance with Article 1 of Law n° 09-08, the data controller is the entity that determines the purposes and means of processing personal data:
| Institution | Institute for Advanced Studies (IAS) — Mohammed VI Polytechnic University (UM6P) |
| Legal Status | Public university institution established under Moroccan law, registered with the relevant Moroccan authorities |
| Address | UM6P Campus, Lot 660, Hay Moulay Rachid, Ben Guerir 43150, Morocco |
| General Contact | ias@um6p.ma |
| Telephone | +212 604 942 547 |
| Website | ias.um6p.ma |
| CNDP Declaration | Processing activities have been declared to the CNDP in compliance with Articles 12–18 of Law n° 09-08, where applicable |
For any questions, requests, or complaints relating to the processing of your personal data, please contact us at ias@um6p.ma.
Data We Collect
We collect personal data in accordance with the principles of relevance, adequacy, and proportionality established by Article 3 of Law n° 09-08 — we collect only what is strictly necessary for the purposes described in this Policy.
A. Residency Applicants
- Identity data: Full name, date of birth, gender, nationality, country of residence, identification document details
- Contact information: Email address, phone number, postal address
- Academic & professional credentials: Curriculum vitae, academic degrees and transcripts, institutional affiliations, professional positions held
- Research project data: Research proposal or project description, work samples, artistic portfolio, publications list
- Reference information: Names, institutional affiliations, and contact details of referees; content of letters of recommendation
- Portrait / photograph: Profile photo submitted with the application, used for internal processing and, if accepted, institutional directory
- Language proficiency: Languages spoken and level of proficiency
- Financial data (post-selection only): Bank account details collected solely when a fellowship stipend is awarded, after the selection process is complete
- Emergency contact: Name and contact details of a designated emergency contact person
IAS UM6P does not intentionally collect sensitive data as defined by Article 3 of Law n° 09-08 (racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, sexual orientation). If any such data appears in application materials (e.g., a research proposal on health topics), it is treated with heightened confidentiality and processed only to the extent necessary for evaluation purposes, following prior authorization from the CNDP where required.
B. Website Visitors
- Technical data: IP address, browser type and version, operating system, referring URL
- Browsing data: Pages visited, time spent on pages, links clicked, session duration
- Cookie data: See Section 09 for full details
- Contact form submissions: Name, email address, message content
C. Event & Program Participants
- Registration data: Full name, email address, institutional affiliation, dietary/accessibility requirements (where provided voluntarily)
- Event recordings: Photographs and video recordings made during IAS events. Participants are informed in advance; specific consent is obtained for identifiable recordings used in communications materials
D. Newsletter & Communications Subscribers
- Name and email address, collected with explicit consent via a double opt-in mechanism
Purposes & Legal Basis
We process personal data only for specified, explicit, and legitimate purposes (Article 3, Law n° 09-08). The legal bases applicable to each processing activity are as follows:
| Purpose of Processing | Data Involved | Legal Basis |
|---|---|---|
| Receiving and managing residency applications | All application data (Section 03A) | |
| Academic evaluation and selection by the Scientific Committee | Application materials, references, portfolio | Contractual |
| Communicating application decisions | Identity, contact information | Contractual |
| Onboarding and residency management (housing, access, schedule) | Identity, contact, emergency contact | Contractual |
| Institutional directory and public profile (accepted residents) | Name, portrait, affiliation, research area | |
| Fellowship stipend payment | Bank account details, identity | Contractual |
| Alumni community and follow-up communications | Name, email, research updates | |
| Event registration and management | Registration data | Contractual |
| Photography and video during events (communications use) | Image and voice recordings | |
| Newsletter and institutional communications | Name, email address | |
| Website analytics and performance improvement | Browsing data, cookies | Legitimate Interest |
| Security and fraud prevention | Log files, IP addresses | Legitimate Interest |
| Compliance with legal obligations (accounting, audit) | Financial records, administrative data | Legal Obligation |
IAS UM6P does not use automated decision-making or profiling that produces legal effects or similarly significant impacts on applicants or participants. All selection decisions are made by a human Scientific Committee. You are not subject to any decision based solely on automated processing (Article 10, Law n° 09-08).
Data Retention
Personal data is retained for no longer than is necessary for the purpose for which it was collected, in compliance with Article 3 of Law n° 09-08. The following retention periods apply:
Retained for the duration necessary to respond to any appeal or query. After this period, application files are securely deleted or anonymized. Applicants who consent to being considered for future cycles may have their data retained for up to 3 additional years.
Full application and residency file retained for institutional record-keeping, academic reference, and potential disputes. After the 5-year period, non-essential data is deleted and only anonymized statistics are kept.
Name, contact details, and research profile maintained in the alumni network with ongoing consent. You may withdraw consent and request deletion at any time.
In accordance with Moroccan accounting and fiscal regulations, financial records including payment details are retained for 10 years from the date of the transaction.
Anonymized after 13 months. Raw log files containing IP addresses are deleted after 6 months.
Consent records are kept for 3 years after unsubscription for legal compliance purposes. Active subscriber data is kept as long as the subscription remains active.
Sharing Your Data
IAS UM6P does not sell, rent, or trade personal data to any third party under any circumstances. Data may be shared only in the following controlled circumstances, in compliance with Article 4 of Law n° 09-08 (information to data subjects) and Articles 24–26 (subcontracting).
Within IAS UM6P and UM6P Group
- IAS administrative staff: Application coordinators, program managers, finance team — access is restricted to data necessary for their function
- Scientific Selection Committee: Anonymized or identified application materials shared for evaluation purposes, under strict confidentiality
- UM6P administration: Limited data shared with the university for legal compliance, payroll, and campus access management
Academic and Research Partners
- Where a residency involves collaboration with a partner institution, limited identity and project data may be shared with that institution's designated coordinator, provided prior written consent is obtained from the resident
- Publication of research outputs is governed by separate publication agreements
Authorized Service Providers (Subcontractors)
- Web hosting and IT infrastructure: Cloud hosting providers processing data on our behalf under Data Processing Agreements
- Email delivery services: For institutional communications and newsletters
- Application management platform: If a third-party system is used for processing applications
- Analytics providers: Anonymized website traffic data
All service providers are contractually bound by confidentiality and data protection obligations equivalent to those under Law n° 09-08.
Legal and Regulatory Authorities
- Personal data may be disclosed to Moroccan judicial, police, or regulatory authorities when required by applicable law, court order, or legal process
- We will inform you of any such disclosure where legally permitted to do so
IAS UM6P does not process personal data for commercial profiling, advertising purposes, or share data with commercial third parties for their own marketing use. Your data is used exclusively for the academic and institutional purposes described in this Policy.
International Transfers
As an international academic institution, IAS UM6P collaborates with partner universities, research institutions, and scholars worldwide. This may involve transferring personal data to countries outside Morocco.
Pursuant to Articles 43 and 44 of Law n° 09-08, a transfer of personal data to a foreign country is permitted only if that country ensures an adequate level of protection for privacy, fundamental freedoms, and rights, or if one of the following conditions applies:
- Adequacy decision: The CNDP or Moroccan government has determined that the destination country provides adequate protection
- Explicit consent: You have given your explicit and informed consent to the transfer, after being informed of the risks
- Contractual necessity: The transfer is necessary for the performance of a contract between you and IAS UM6P (e.g., international collaborative residency)
- Standard contractual clauses: The transfer is governed by contractual clauses approved by the CNDP providing appropriate safeguards
- CNDP authorization: The transfer has received prior authorization from the CNDP where required
When a resident is affiliated with a European or North American university, limited data (name, contact, research summary) may be shared with their home institution's residency coordinator. When IT systems hosted on cloud infrastructure located outside Morocco are used, appropriate Data Processing Agreements with CNDP-equivalent safeguards are in place.
In April 2025, the European Commission formally recognised Morocco as providing adequate protection for personal data under GDPR Article 45 (Decision 2025/665). This means that EU-based researchers, institutions, and partners who transfer personal data to IAS UM6P do not require additional safeguards (such as Standard Contractual Clauses). This recognition reflects the robustness of Loi 09-08 and the CNDP's independent supervisory function. The adequacy decision is subject to periodic review by the Commission.
You have the right to request information about any international transfers of your personal data and the safeguards in place by contacting us at ias@um6p.ma.
Your Rights
Under Law n° 09-08, you have the following rights regarding your personal data. We will respond to all verified requests within 30 days of receipt.
Right of Access
You may request confirmation that we process your data, and obtain a copy of the personal data we hold about you, including the purpose, categories, and recipients.
Art. 15–17 · Loi 09-08Right to Rectification
You may request correction of inaccurate or incomplete personal data that we hold about you, and we will notify any third-party recipients of the correction.
Art. 18 · Loi 09-08Right to Erasure
You may request deletion of your personal data where it is no longer necessary for the purposes collected, was processed without legal basis, or where consent is withdrawn.
Art. 18 · Loi 09-08Right to Object
You may object, on compelling legitimate grounds relating to your particular situation, to processing based on legitimate interests or for direct marketing purposes, including profiling.
Art. 19 · Loi 09-08Right to Withdraw Consent
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal. Withdrawal is as easy as giving consent.
Art. 3(a) · Loi 09-08Right to Information
You have the right to be informed, at the time of collection, about the identity of the controller, purposes of processing, whether responses are mandatory, recipients, and your rights.
Art. 13–14 · Loi 09-08Right to Lodge a Complaint
If you believe we have violated your rights, you may file a complaint with the CNDP — Morocco's independent supervisory authority for data protection.
Art. 36–38 · Loi 09-08Opposition to Direct Marketing
You may object at any time and at no cost to your data being used for direct marketing or prospecting purposes — this right applies before any such processing begins.
Art. 19(2) · Loi 09-08To exercise any of the above rights, send a written request to ias@um6p.ma with the subject line "Data Protection Request" along with sufficient identification information to process your request. We will respond within 30 calendar days. We may ask for additional information to verify your identity before processing the request.
Cookies & Tracking Technologies
The IAS website (ias.um6p.ma) uses cookies and similar tracking technologies in accordance with Moroccan regulations and best practices. A cookie is a small text file stored on your device when you visit our website.
When you first visit our website, a consent banner informs you of cookie use and allows you to accept or refuse optional cookies. You may change your preferences at any time via the cookie settings accessible in the website footer. You may also control cookies through your browser settings; however, disabling essential cookies may affect website functionality.
Our website may embed content from YouTube, LinkedIn, and other platforms. When such content is loaded, the respective platform may set its own cookies. IAS UM6P has no control over these cookies — please refer to each platform's privacy policy for more information.
Security Measures
In accordance with Article 23 of Law n° 09-08, IAS UM6P implements appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.
- Encryption in transit: All data transmitted between your browser and our servers is protected by TLS/SSL encryption (HTTPS)
- Encryption at rest: Sensitive data stored in our systems is encrypted at rest
- Access controls: Strict role-based access controls limit who can access personal data; access is granted on a need-to-know basis
- Authentication: Strong authentication mechanisms are required for staff accessing personal data systems
- Pseudonymization: Where possible, application data is pseudonymized during the evaluation process to reduce identification risk
- Regular audits: Security practices and systems are subject to regular internal and external reviews
- Staff training: All IAS staff handling personal data receive training on data protection obligations and best practices
- Incident response: A documented procedure is in place for responding to personal data breaches, including notification to the CNDP and affected individuals where required
While Loi n° 09-08 as currently enacted does not contain a statutory mandatory breach notification requirement at the national level, IAS UM6P voluntarily commits to best-practice breach response: in the event of a personal data breach presenting a risk to the rights and freedoms of individuals, we will notify the CNDP without undue delay and inform affected individuals directly where the breach is likely to result in high risk to them. A legislative reform currently under parliamentary discussion will introduce a mandatory 72-hour CNDP notification obligation — this Policy will be updated when the reform is enacted.
Minors
IAS UM6P's residency programs and associated services are intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect personal data from persons under the age of 18.
If we become aware that personal data has been inadvertently collected from a minor without appropriate parental or guardian consent, we will take immediate steps to delete that data from our systems. If you believe that a minor's data has been submitted to us without appropriate consent, please notify us immediately at ias@um6p.ma.
Policy Updates
IAS UM6P may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory guidance. The most current version will always be published on our website at ias.um6p.ma with the date of the most recent revision clearly indicated.
In the event of material changes that significantly affect your rights or the way we process your data, we will notify you directly (by email, where we hold your contact details) prior to the changes taking effect, and request fresh consent where required.
Your continued interaction with IAS UM6P's services after the effective date of any update constitutes acknowledgment of the revised Policy. Where processing requires consent, we will obtain new consent for any material change to the purposes or scope of processing.
Contact & Supervisory Authority
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us:
| ias@um6p.ma — Subject: "Data Protection Request" | |
| Postal address | Institute for Advanced Studies (IAS), UM6P Campus, Lot 660, Hay Moulay Rachid, Ben Guerir 43150, Morocco |
| Telephone | +212 604 942 547 |
| Response time | We aim to respond to all data protection requests within 30 calendar days |
CNDP — Moroccan Data Protection Authority
If you believe your rights have not been respected after contacting IAS UM6P, you have the right to file a complaint with Morocco's independent supervisory authority. We recommend first contacting us directly, retaining evidence of your request, then filing with the CNDP if unresolved:
Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)
Angle Avenue Annakhil et Rue Abi Regrague, Hay Riad, Rabat 10100, Maroc
Email: contact@cndp.ma
Téléphone: +212 5 37 57 97 11
Site web: www.cndp.ma
Questions About Your Data?
Our team is committed to transparency and to responding to all data-related inquiries within 30 days.