Any request for access to personal data from a public authority (judicial authority, police, administration or regulator, in Morocco or abroad) is handled under the following rules, whether it concerns the data of our users, for which we are the controller, or data we process on behalf of our customers as a processor (see our DPA):
•Form and channel: we act only on written requests that are based on applicable law, issued by a competent authority and addressed to
[email protected]. We give no public authority direct, bulk or indiscriminate access to our systems, nor do we provide any encryption keys or backdoors.
•Legality review: before any disclosure, every request is reviewed by the company's legal representative, assisted by outside counsel where needed: competence of the authority, legal basis relied on, necessity and proportionality of the measure, scope of the data sought. A request from an authority of a country outside the European Union and the European Economic Area is honoured only on the basis of an international agreement, such as a mutual legal assistance treaty, or of a procedure recognised by applicable law (Article 48 GDPR); a request from a Moroccan authority is assessed under Law No. 09-08 and the applicable rules of Moroccan procedure.
•Challenge: we seek clarification, ask for the scope to be narrowed, or refuse any request that is unlawful, overly broad or legally deficient, and we use the legal remedies available. While a challenge is pending, we disclose no data unless legally compelled to do so.
•Data minimisation: we disclose only the minimum data strictly necessary to answer a valid request. Message content is disclosed only where the legal instrument expressly requires it.
•Notification: before any disclosure, we inform the customer concerned and, for the data of our own users, the person concerned, unless the law prohibits it. Where it is prohibited, we make best efforts to obtain a waiver and notify as soon as the prohibition lapses.
•Emergencies: where there is an imminent threat to a person's life or physical integrity, a strictly limited disclosure may be made; it is documented and reviewed afterwards under the same rules.
•Documentation: every request is recorded in an internal register — date, authority, legal basis, scope requested, legality assessment and legal reasoning, persons involved, response given, data disclosed, notification given or withheld and why — kept for 5 years.
•Transparency: we publish the number of requests received each year. As of 10 September 2026, EnvoiSMS.ma has received no request from a public authority concerning personal data in the preceding 12 months.
•Scope: these rules apply equally to data we receive through Meta's WhatsApp Business Platform APIs.