Privacy policy
Last updated: 26 September 2026
This policy explains what personal information PoTiTo collects, why we collect it, and what control you have over it.
1. Who we are
PoTiTo is an independent online retailer operated by Abderrahman Khachi, based in Boujdour, Morocco. We are the data controller for the personal information described in this policy.
- Trading name: PoTiTo
- Operator: Abderrahman Khachi
- Address: Quartier Ennour Rue El Foul NR 05, Boujdour 71000, Morocco
- Email: support@potito.shop
2. What we collect
Depending on how you interact with our store, we may collect:
- Contact details - your name, email address and telephone number, used to answer enquiries and process your order
- Order information - the products you bought, order details, transaction records and delivery information
- Delivery information - your shipping and billing address
- Payment information - we receive the minimum needed to process payment. Full card details are handled by our payment provider and are never stored on our systems
- Technical information - your IP address, browser type, device and operating system, and pages you visit
- Communications - anything you send us through email or a contact form
- Marketing preferences - whether you have chosen to receive marketing email
We do not collect payment card details ourselves. Our payment provider handles all card data.
3. Why we use it
- To process and fulfil your order
- To arrange shipping and delivery
- To take payment through our payment provider
- To send order confirmations, dispatch notices and delivery updates
- To respond to support requests and enquiries
- To maintain the security of our site and prevent fraud or abuse
- To meet legal, accounting, tax and regulatory obligations
- To improve our website, products and customer experience
- To send marketing email where you have consented or where otherwise permitted by law
4. Legal bases for processing
Where data protection law requires us to identify a lawful basis, we rely on:
| Basis | Used for |
|---|---|
| Contract | Processing and fulfilling your order, and answering your enquiries |
| Legal obligation | Tax, accounting and regulatory record keeping |
| Legitimate interests | Site security, fraud prevention, customer service and improving our business, where your rights do not override ours |
| Consent | Marketing email and any non-essential cookies, where consent is required |
5. Who we share it with
We share personal information only where necessary to operate our store, fulfil your order and support you:
- Shopify, which provides our ecommerce platform and hosting
- Payment providers, which process all transactions
- Shipping and fulfilment partners, which deliver your order and process returns
- Analytics services, which help us understand how the site is used
- Professional advisers or authorities, where disclosure is required by law
We do not sell your personal information.
6. International transfers
Our store is hosted on Shopify infrastructure and our products ship from warehouses in Germany and the United States. This means some of the service providers above process your information outside Morocco, including in the United States and the European Economic Area.
Where your information is transferred outside your country we rely on the appropriate safeguards required by applicable data protection law.
7. How long we keep it
We keep order and transaction records for as long as we are legally required to, typically six to ten years for tax and accounting purposes. If you ask us to delete your account we will remove your data, except for records we must keep for legal reasons.
8. Your rights
Where the law applies to you, you may have the right to:
- request access to the personal information we hold about you
- ask us to correct information that is inaccurate or incomplete
- ask us to delete your information
- restrict certain processing of your information
- object to certain processing, including direct marketing
- request a portable copy of certain information
- withdraw consent where processing relies on it
To exercise any of these rights, email us at support@potito.shop. We will respond within one business day and may need to verify your identity first.
9. Cookies
We use cookies and similar technologies to make the store work, remember your preferences, understand how the site is used, and improve it.
Some cookies are strictly necessary for the site to function and cannot be disabled. Where required by law, non-essential cookies such as analytics or marketing cookies are subject to your consent, which you can withdraw at any time through your browser settings.
10. Security
We use reasonable technical and organisational measures to protect your information, including encryption in transit and restricting access to the people who need it in order to fulfil your order.
No method of transmission or storage is completely secure. If we become aware of a breach affecting your data we will notify you and the relevant regulator as required by law.
11. Children
Our store is not intended for children who cannot lawfully enter a purchase contract. We do not knowingly collect personal information from children where we are not permitted to do so.
12. Changes to this policy
We may update this policy to reflect changes in our business or in the law. The current version is always on this page with its last-updated date.
13. Complaints
If you have a concern about how we have handled your information, email us first at support@potito.shop and we will try to resolve it.
Depending on where you live you may also have the right to complain to your local data protection authority, such as the CNDP in Morocco, the Information Commissioner's Office in the United Kingdom, or the relevant authority in your US state.