Guest Wi-Fi and personal data in Morocco: Law 09-08, the CNDP and consent

Offering free Wi-Fi with a login page is a great way to know your guests. It also means you are collecting personal data: phone numbers, emails, names, sometimes birthdays, plus the record of each connection. This guide explains the main rules in plain words. It is general information, not legal advice; for your exact situation, ask a lawyer or the CNDP.

The law: 09-08 and the CNDP

Morocco's Law 09-08 protects individuals with regard to the processing of their personal data. It is overseen by the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel). Before processing personal data, a business generally has to declare the processing to the CNDP, or ask for its authorisation in some cases. A guest Wi-Fi with a login is such processing.

Consent, done properly

• Separate the two questions. Accepting the Wi-Fi terms is required to get online. Agreeing to receive offers is optional and must be its own box.
• No pre-ticked boxes. Consent must be an action by the guest.
• Say who and what. Name the venue, the channel (WhatsApp, SMS, email) and that guests can unsubscribe at any time.
• Keep proof. Record the wording shown, the language, the date and the choice made. If anyone asks, you can show exactly what each guest agreed to.

Wispot stores a consent record for each guest with the exact text they saw, and puts an unsubscribe link in every message.

Guests' rights

Under Law 09-08, as under the GDPR, people can ask to access their data, correct it, and object to its use, including for marketing. In practice:

• Give a contact address on the welcome page, such as privacy@yourvenue.
• Be able to find a guest by phone or email, export what you hold, and delete it.
• Stop all messages the moment someone unsubscribes.

Connection logs

Wi-Fi providers commonly keep connection records (which device connected, when, and how much data it used) for a period, so they can answer lawful requests. Wispot keeps them for 365 days by default, and the period can be changed in the account's privacy settings. Check with your adviser what applies to your venue.

Guests from Europe, venues in Europe

If your venue is in the EU, the GDPR applies. It can also apply to a Moroccan venue that targets EU residents. The principles are the same: a lawful basis (consent for marketing), clear information, the rights above and secure storage. A data processing agreement with your Wi-Fi provider is expected.

A short checklist

1. Declare the processing to the CNDP, or check that it is covered.
2. Separate Wi-Fi terms from marketing consent, with no pre-ticked box.
3. Keep a consent record for each guest.
4. Show a privacy contact and answer requests quickly.
5. Honour unsubscribes at once.
6. Sign a data processing agreement with your provider.

Wispot's CNDP declaration and data processing agreement pages explain what we provide. For what to do with a consented list, read our Wi-Fi marketing guide.