Privacy & Security Policy

BARRA — Opportunities & Talent Platform

Effective date: March 23, 2026 — Last updated: March 23, 2026 — Version 1.0

IMPORTANT: By using BARRA, you agree that your personal data may be used for platform improvement, personalisation of your experience, and commercial and marketing purposes, in accordance with this policy.

1. DATA CONTROLLER

BARRA SARL — Barraa 200, Casablanca, Morocco

Email: privacy@barraa.tech | Phone: +212 6 00 00 00 07

Data Protection Officer (DPO): dpo@barraa.tech

2. DATA WE COLLECT

2.1 Information You Provide

At registration (all profiles):

• Full name, email address, phone number
• Password (encrypted with bcrypt)
• Profile photo, date of birth, city of residence
• Platform role (student, young professional, company)

For students:

• University and current programme
• Education level, skills, and areas of expertise
• Digital CV, project portfolio (GitHub, Behance, LinkedIn links)
• Innovative project ideas
• Hourly availability and preferred geographical area
• Diplomas, certifications, and ratings from professionals/companies

For young professionals:

• Profession and industry sector
• Status (employed, entrepreneur, parent)
• Banking or Mobile Money details (Wafacash, Orange Money, Wave) for payment
• Posted barras, payment history, and ratings given to students

For companies:

• Company name and legal form
• CNSS number and ICE (Common Enterprise Identifier)
• Industry sector, company size
• Posted opportunities, talent search criteria, sponsored projects

2.2 Automatically Collected Data

Technical data: IP address, geolocation (with consent), device type, OS, browser, device UUID, pages visited, visit duration, cookies, connection logs, and application performance data.

Usage & engagement data: barras consulted/posted, applications sent, academic opportunities viewed, chat messages, project interactions, gamification interactions, search history, navigation behaviour, response rates, and notification actions.

Location data: Precise geographical position (with consent) for geographic matching, map display, and nearby opportunity recommendations.

Payment data: Transaction history, chosen payment method, payment confirmation references.

Rating & reputation data: Ratings received/given, gamification ranking, badges earned, completion and response rates.

2.3 Third-Party Data

• Social login (Google, LinkedIn, Facebook): name, photo, email, public profile information
• External integrations: GitHub (public repos, languages), Behance (creative portfolio), LinkedIn (professional profile, recommendations)
• Payment operators: Wafacash, Orange Money, Wave (payment confirmation), Stripe (secure payment token)
• Academic partners: University enrolment validation (with consent)

3. HOW WE USE YOUR DATA

3.1 Service Delivery

• Create and manage your account
• Facilitate automatic matching between students and barras/opportunities
• Process payments and generate receipts
• Enable chat communication
• Display profiles, CVs, portfolios, and projects
• Organise hackathons and events
• Manage the mutual rating and gamification systems

3.2 Platform Improvement & Personalisation

• Intelligent matching algorithm: analyse preferences, skills, location, and history to improve recommendations
• Content personalisation: show tailored opportunities and barras
• Behavioural analysis: study navigation and interactions to optimise the interface
• New feature development based on user needs
• Anonymised statistical studies on student employment trends

3.3 Commercial & Marketing Purposes

IMPORTANT: Your data is used for commercial purposes, including:

• Personalised commercial offers (opportunities, sponsored hackathons)
• Targeted advertising based on your skills, university, and behaviour
• Promotion of BARRA premium services
• Newsletters with curated opportunities
• Sharing aggregated, anonymised data with partner companies for market research

You can opt out at any time via Settings > Privacy > Marketing, or by contacting optout@barraa.tech.

4. DATA SHARING

4.1 With Other Users

Your public profile (CV, skills, university, ratings, badges) is visible to other users. Your full contact details are only visible after explicit consent or application submission.

4.2 With Service Providers

• Hosting: AWS or Microsoft Azure (servers in Morocco or Europe)
• Payments: Wafacash, Orange Money, Wave, Stripe, CMI
• Communication: Gmail/SMTP, Twilio (SMS), Firebase Cloud Messaging
• Mapping: Google Maps Platform
• Analytics: Google Analytics, Mixpanel, Hotjar (with consent)
• AI services: matching recommendation algorithms

4.3 With Commercial Partners

With your explicit consent, your profile may be shared with recruiting companies, hackathon organisers, academic partners, and sponsors. You can disable this at any time via Settings > Privacy > Partner Sharing.

4.4 International Transfers

Some providers (Google, Stripe, AWS) may transfer data outside Morocco. We ensure appropriate safeguards are in place (EU standard contractual clauses).

5. COOKIES & SIMILAR TECHNOLOGIES

5.1 Cookie Types

• Essential cookies: authentication, security, language preferences — cannot be disabled
• Performance cookies: Google Analytics, Mixpanel — can be disabled via Settings > Cookies
• Functionality cookies: saved filters, notification preferences, search history
• Advertising cookies: Facebook Pixel, Google Ads, LinkedIn Insight Tag — require explicit consent
• Geolocation cookies: position storage for geographic matching — require consent

5.2 Cookie Management

Manage preferences via Settings > Cookies and Privacy, or through your browser settings. Note: disabling essential cookies will prevent BARRA from functioning properly.

5.3 Similar Technologies

We use LocalStorage and IndexedDB for temporary search storage, data caching, and offline synchronisation. On mobile, device identifiers (IDFA on iOS, AAID on Android) may be used for analytics and fraud prevention.

6. THIRD-PARTY LINKS

BARRA may contain links to third-party websites (GitHub, Behance, LinkedIn, partner universities). We are not responsible for their privacy practices. We encourage you to read their privacy policies.

7. POLICY CHANGES

We may modify this policy at any time. For substantive changes, we will notify you by email and in-app notification 15 days before the effective date. Continued use after notification constitutes acceptance. If you decline, you may delete your account without penalty.

For data retention periods, your rights, and security measures, please refer to our Data Protection Policy.

CONTACT

BARRA SARL — Barraa 200, Casablanca, Morocco

Privacy: privacy@barraa.tech | DPO: dpo@barraa.tech

Marketing opt-out: optout@barraa.tech | Abuse: abuse@barraa.tech

Phone: +212 6 00 00 00 07 | Hours: Monday–Friday, 9am–6pm (GMT+1)

© 2026 BARRA SARL — Connecting talent with opportunities