Privacy Policy

Protecting your personal data is important to us. This policy explains what data we process when you use this website, why, and which rights you have. It follows the EU General Data Protection Regulation (GDPR), the German TDDDG, Moroccan Law 09-08 (supervised by the CNDP) and, for California residents, the CCPA/CPRA.

1. Controller

United Behavioral and Cognitive Group SARL (UBCG SARL), Rue Imam Chafii, Quartier Hivernage, Marrakech 40020, Morocco. Email: hello@ubcg.net. Privacy contact: privacy@ubcg.net.

2. Hosting and server logs

This website is hosted by STRATO AG, Pascalstraße 10, 10587 Berlin, Germany. When you visit it, the server temporarily processes technical data (IP address, date and time, requested page, browser and device information). The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). Logs are deleted automatically after a short period. All fonts and icons are served from our own server — no external font or CDN requests are made.

3. Contact and inquiry forms, WhatsApp

If you send an inquiry, we process your name, email, optional phone number, company, topic, message and preferred reply channel to answer your request (Art. 6(1)(b) and (a) GDPR). Data is stored until your request is handled and then for as long as legal retention duties or legitimate interests require; inquiries are deleted automatically after the retention period set by us. If you click the WhatsApp button, you leave this website and open WhatsApp (Meta Platforms Ireland Ltd.); their privacy policy applies from that moment. We receive only what you send us.

4. Newsletter

We send the newsletter only after you subscribe and confirm by email (double opt-in). We store your email address, language, time of subscription and confirmation. You can unsubscribe at any time using the link in each email (Art. 6(1)(a) GDPR).

5. Shop and payment

Payments are handled by the payment providers you choose (for example Stripe Payments Europe Ltd. or PayPal (Europe) S.à r.l. et Cie, S.C.A.) on their own pages. We do not see or store your card data. For orders we process the data needed to fulfil the contract (Art. 6(1)(b) GDPR) and keep accounting records as required by law (Art. 6(1)(c) GDPR).

6. Cookies, analytics and session replay

Strictly necessary storage (for example remembering your cookie choice) does not require consent. Analytics tools — such as Google Analytics 4, Smartlook, Microsoft Clarity or Matomo — are loaded only after you consent in the cookie banner (§ 25 TDDDG, Art. 6(1)(a) GDPR). With Smartlook and similar tools, form inputs are masked. Where providers transfer data to the USA, this is based on the EU–US Data Privacy Framework or standard contractual clauses. You can withdraw or change your consent at any time via “Cookie settings” in the footer. Details: see the Cookie Policy.

7. Recipients

Recipients may be our hosting provider, email delivery, payment providers and — if you consent — analytics providers, each bound by data processing agreements where required.

8. International transfers

We operate from Morocco, Germany and the USA. Transfers between these locations rely on adequacy decisions, standard contractual clauses or your consent, as applicable.

9. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), the right to withdraw consent at any time, and the right to lodge a complaint with a supervisory authority — in Morocco the CNDP, in Germany the authority of your federal state. Under Moroccan Law 09-08 you may access, rectify and object to the processing of your data. California residents have the right to know, delete and correct personal information and to opt out of “sale” or “sharing”; we do not sell or share personal information for cross-context behavioural advertising. Contact: privacy@ubcg.net. We respond within 30 days.

10. Security

We use HTTPS with HSTS, strict security headers, hardened sessions, two-factor authentication for administrators, access logging and regular updates. No system is perfectly secure; if you find a vulnerability, please see /.well-known/security.txt.

11. Children

This website is not directed at children under 16 and we do not knowingly collect their data.

12. Changes

We update this policy when our services or legal requirements change. Last updated: November 2026.