Privacy notice
Last updated — 23 September 2026
This notice explains what personal data Sou9y collects, why, how long it is kept, and the rights you have over it, under Algeria's law 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data.
Who is responsible
The data controller is Sou9y, which operates the Sou9y marketplace in Algeria.
The declaration of this processing to the National Authority for the Protection of Personal Data (ANPDP) is in progress. The reference will be published here once issued.
For any question about your data: privacy@sou9y.dz.
What we collect
We collect only what is needed to identify you, deliver to you, and keep our commercial records.
- Account: name, email address, and your password as an irreversible hash. If you use Google, we receive your name and email — never your Google password.
- Delivery: recipient name, phone number, wilaya, commune and address. These are copied onto each order at the moment you place it.
- Orders and auctions: items, amounts, statuses, bids, auction outcomes, and any tracking number the carrier gives the seller.
- Sellers: store name, business phone, wilaya and delivery fees. A seller's phone is never shown publicly.
- Technical: IP address and server logs, used for security and abuse limits.
We collect no payment card data at all: payment is cash on delivery, directly between you and the seller.
Why we process it
- To create and secure your account.
- To process your orders and let the seller deliver and call you.
- To run auctions: validate bids, decide the winner, and enforce the payment and delivery deadlines.
- To tell you in the app how your orders, bids and auctions are progressing.
- To meet our accounting and commercial obligations.
- To prevent fraud and abuse of the service.
What is required
Name, email and password are required to create an account. Recipient name, phone and address are required to place an order: without them the seller cannot deliver. You can browse Sou9y without providing any of this; you simply cannot order or bid.
Transfer outside Algeria
The site is hosted with an international infrastructure provider and listing photos are stored with an international image provider, so your data may be processed on servers outside Algeria, solely to operate the service. Any transfer falling under article 44 of law 18-07 requires the prior authorisation of the ANPDP.
How long we keep it
| Data | Kept for | Reason |
|---|---|---|
| Account (name, email, phone, addresses) | Until the account is closed | — |
| Orders and related records | 10 years | Code de commerce, art. 12 |
| Auctions, bids and sales | 10 years | Same basis as orders |
| Failures to complete a sale, and suspensions | 2 years | Covers the one-year window, with margin |
| Sign-in sessions | Deleted on sign-out or expiry | — |
| Technical logs | 1 years | Security and abuse prevention |
Your rights
Law 18-07 gives you the right to access your data, have it corrected if it is inaccurate, object to its processing on legitimate grounds, and have it erased where the law allows.
- Access and correction: your profile and address book can be edited at any time from your dashboard.
- Erasure: you can close your account yourself from Settings. Your identity is removed immediately; past orders are kept in anonymised form for the legal period.
- Anything else: write to privacy@sou9y.dz. We answer within a reasonable time.
You may also refer the matter to the ANPDP if you believe your rights have not been respected.
Security
- Passwords are stored as an irreversible hash, never in clear text.
- Traffic to and from the site is encrypted (HTTPS).
- Access is limited by role: a seller sees only their own orders.
- Photo uploads are signed server-side and confined to that seller's own folder.
Changes
If this notice changes materially, the date above is updated and the change is announced in the app.