Privacy Policy

Effective 4 October 2026.

1. Who we are

“Golzak” is a brand used by two independent companies under the same owner, which cooperate under an intercompany arrangement:

• GOLZAK UK LTD, a private limited company registered in England and Wales under number 13649050, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom (“Golzak UK”). Golzak UK publishes the golzak.com website, operates the customer portal (portal.golzak.com), publishes the Golzak mobile applications, and sells and invoices services paid by card (Stripe) or cryptocurrency.
• GOLZAK SARL AU, a Moroccan limited liability company with a sole shareholder, Commercial Register of Fès no. 60041, ICE 001562263000028, IF 3371989, registered office N°8 rue Omar Ibn Kaltoum, avenue El Kattani, Agdal, offices 29, 5th floor, 30000 Fès, Morocco (“Golzak Morocco”). Golzak Morocco is the registrar of .ma domain names accredited by the ANRT, employs our staff in Morocco, sells and invoices services paid by Moroccan bank transfer, cash or locally issued card (CMI), and technically hosts the golzak.com website on behalf of Golzak UK.

Which company is responsible for your data? The company named on your order and invoice is your contracting party. It is the data controller for your account, orders, billing and support. Golzak UK is the controller for the golzak.com website (cookies, analytics, contact forms) and for the mobile apps, which have their own privacy policies. Our customer portal only collects payments; your legal invoice is issued by the company you paid, from its own accounting system. When Golzak UK provides the customer portal to Golzak Morocco, it acts as Golzak Morocco’s processor, and when Golzak Morocco hosts the golzak.com website, it acts as Golzak UK’s processor. When you register a .ma domain through Golzak UK (or another reseller), Golzak Morocco receives the registrant data as the accredited registrar and passes it to the ANRT.

↑ Back to contents

2. What we collect

• Account and contact data: name, company name, postal address, country, e-mail, telephone, ICE/tax ID for businesses, login credentials (stored hashed), language.
• Domain registrant data: registrant and contact details. For .ma domains, the ANRT requires a national ID (CIN), passport or residence permit number, or the company’s tax/ICE identifier.
• Order and billing data: products, invoices, payment method, amount and date. Card numbers are entered directly with our payment providers (Stripe, CMI) and are never stored by Golzak.
• Support and communications: tickets, e-mails, chat, call notes and quote requests.
• Technical data: IP address, browser and device data, logs of access to our portal and servers, security events.
• Website and marketing data: cookies and similar technologies (see section 13), newsletter subscriptions and opt-outs, and the campaign identifiers attached to a form submission.
• Job applicants: CV, contact details and interview notes you send us.
• Hosted content: files, websites, e-mails and databases you store on our hosting. We process this content only on your instructions, as your processor. You remain responsible for the personal data your own visitors or customers give you. Our Data Processing Addendum applies to this content.

↑ Back to contents

3. Why we use it and on what legal basis

Where we rely on legitimate interests, we have balanced them against your rights. You may object at any time to processing based on legitimate interests, and we will stop unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims. Objections to direct marketing are always honoured.

How we ask for your consent. Our forms on golzak.com and in our client portal (contact, quote, support, newsletter, appointment booking and checkout) include a checkbox that is never pre-ticked. A required box confirms that you have read this policy and agree to the processing of your data to answer your request or provide the services you order. On the contact, quote and support forms and at checkout, a separate, optional box lets you choose to receive our offers by e-mail; you can still send your request without ticking it. The answers you give on our website forms are saved with your request, and your newsletter or mailing-list choice is recorded with your contact details. You can withdraw your consent at any time, using the unsubscribe link in each e-mail or by writing to privacy@golzak.com. This does not affect processing carried out before you withdrew it.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. We use an AI writing assistant (Anthropic’s Claude API) to help draft replies to commercial enquiries. A Golzak team member supervises its use, and the provider does not use our data to train its models.

↑ Back to contents

4. Who receives your data

We share data only as needed for the purposes above, with:

• the other Golzak company, under the intercompany agreement (customer portal, website hosting, .ma reselling and data processing terms);
• domain registries and registrars: ANRT (.ma, Morocco) and Enom, LLC (other extensions, USA). Some registrant data may appear in public WHOIS/RDAP directories according to registry rules;
• hosting and software providers: CrocWeb Inc. (servers and customer portal, Canada), Odoo S.A. (separate ERP/CRM databases for each company, Belgium, servers in France), Cloudflare, Inc. (security and content delivery, USA), Amazon Web Services, Inc. (e-mail delivery, USA), Celonis SE / Make (workflow automation, Germany), Anthropic, PBC (AI assistant, USA);
• payment providers and banks: Stripe (for Golzak UK), CMI and Moroccan banks (for Golzak Morocco), and Cryptomus (if you choose to pay with cryptocurrency);
• on golzak.com: Google (Analytics, Tag Manager, Ads) and Meta Platforms (Meta Pixel), for audience measurement and advertising;
• our accountants and legal advisers, and public authorities or courts where the law requires it.

We do not sell your personal data.

↑ Back to contents

5. International transfers

Your data may be processed in Morocco, the United Kingdom, the European Union (France, Belgium, Germany, Ireland), Canada and the United States. For transfers outside the UK or EU we rely on adequacy decisions (EU, UK and Canada), on the UK International Data Transfer Addendum and EU Standard Contractual Clauses included in our providers’ data processing agreements, and, where applicable, on the EU-US Data Privacy Framework and its UK Extension. For data controlled by Golzak Morocco, transfers abroad are notified to the CNDP and carried out under the authorisation regime of Articles 43 and 44 of Law 09-08.

↑ Back to contents

6. How long we keep it

• Customer account and contract data: for the duration of the contract, then 5 years (limitation period).
• Invoices and accounting records: 10 years (Moroccan Commercial Code) or 6 years (UK Companies Act), as applicable to the issuing company.
• .ma identity numbers: for the life of the domain plus 1 year.
• Support tickets and account activity logs: for the duration of your account and contract, then 5 years.
• Prospects and newsletter contacts: 3 years after our last contact with you, or until you opt out. Your opt-out is kept so that we can respect it.
• Job applicants: 2 years, unless you ask us to delete your application sooner.
• Proxy server logs (apps): up to 7 days, then deleted automatically.
• App accounts: until you delete your account, or 2 years after your last use of the app.

↑ Back to contents

7. Mobile apps (Blue Proxy, Proxynel, Vantom VPN)

The Blue Proxy, Proxynel and Vantom VPN apps are published on Google Play by GOLZAK UK LTD, which is the controller of the data described in this section.

• Account (optional): if you sign in with Google, we receive your e-mail address, name, profile picture and a user identifier (Firebase Authentication), and use them to link your subscription to your account.
• Purchases: subscriptions are sold through Google Play. We receive the purchase token, product and subscription status from Google Play; we never receive your payment card details.
• Advertising: the free versions show ads served by Google AdMob and Meta Audience Network. These providers collect your device’s advertising ID and app set ID, your IP address (used to estimate your approximate location), device information and your interactions with ads, for advertising, measurement and fraud prevention. In the EEA, the UK and Switzerland, the free versions of our apps are funded by personalised advertising. Before any ad is shown, Google’s consent tool (certified under the IAB Transparency & Consent Framework) asks for your consent. If you do not wish to consent, you can use the ad-free subscription (Blue Proxy+ or Proxynel+) instead. You can change your choice at any time in the app’s privacy settings.
• Analytics and app quality: we use Google Analytics for Firebase, Firebase Crashlytics, Performance Monitoring, Remote Config, Cloud Messaging (push notifications) and, in Proxynel, In-App Messaging. They collect app interactions, crash logs, diagnostics, device information and a push-notification token.
• Proxy service: your traffic is encrypted between the app and our proxy servers. To run the service, prevent abuse and comply with the law, our servers record your IP address, the date and time, your account or session identifier and the destination website (for HTTPS sites only the domain name, never the content of pages). These logs are kept on the server for a maximum of 7 days and then deleted automatically. We never sell your browsing history.
• Security: Proxynel uses Google Play Integrity to detect modified apps and fraud; Blue Proxy sends anonymous connection-quality diagnostics to our servers.
• Website permissions: Proxynel does not access your location, camera or microphone for itself. If a website you visit asks for them, the app shows a prompt; if you allow it, the data goes only to that website, not to Golzak.

Vantom VPN

Vantom VPN uses Android's VpnService to create an encrypted WireGuard tunnel between your device and a Vantom server in the country you choose (currently the United States, the United Kingdom and Germany). The tunnel runs only when you turn it on, and your traffic then reaches the internet through that server.

• Account: the app works without signing in: it creates an anonymous account with a random Firebase user identifier. If you choose to link your Google account, we also receive your e-mail address, name and profile picture.
• Device: a random device identifier, the platform, your device's WireGuard public key and a push-notification token used to end sessions. To protect the service from abuse, the app proves it is unmodified and running on a genuine Android device using Android key attestation; we receive a device public key and its attestation certificate, which contain no personal data.
• Connection records: for each session, the country and server used, start and end time, the private tunnel address assigned to you, the time of the last WireGuard handshake and the total bytes sent and received. They are deleted automatically 30 days after the session ends. Before that, we combine them into anonymous daily totals per country (number of connections, connected time and data volume) that contain no account or device identifiers; we keep these totals to decide which locations to offer.
• No browsing logs: we never record the websites or apps you use through the VPN, your DNS queries or the content of your traffic.
• Service request logs: our control servers (Cloudflare) log each request the app makes to our service, including your IP address, the time, the request and technical details such as the app version and device, to keep the service secure, prevent abuse and improve it. While connected, your DNS queries are resolved by Cloudflare (1.1.1.1) and Google (8.8.8.8) public resolvers; we do not log them.
• Providers: Google Firebase (sign-in, Crashlytics, Analytics, Cloud Messaging, In-App Messaging), Cloudflare (control servers and database), DigitalOcean (VPN servers) and Google Fonts (the app downloads its typefaces once from Google's font servers, which see your IP address; the fonts are then cached on your device). Vantom VPN currently shows no ads; if ads are added, this section and section 8 will be updated before release and you will be asked for consent where the law requires it.
• Deleting your account: in the app, open your profile and tap Request account deletion, or use our account deletion page or write to privacy@golzak.com. We delete your account, devices, keys and connection records from all Golzak systems within 30 days and confirm by e-mail.

Deleting your account: you can request deletion of your app account and associated data on our account deletion page or by writing to privacy@golzak.com from the e-mail linked to your account. We delete your account, user identifier and profile data within 30 days. We keep purchase records for as long as tax law requires (up to 6 years) and proxy logs expire automatically after 7 days. Uninstalling the app does not cancel a Google Play subscription.

↑ Back to contents

8. Advertising and analytics

We use Google Analytics, Google Tag Manager, Google Ads (conversion measurement and remarketing), Meta Pixel and Hotjar (Contentsquare SAS) on golzak.com, and Google AdMob and Meta Audience Network in our apps. These partners may use cookies, device identifiers and similar technologies to collect information about your use of our services and other sites and apps, and to measure and personalise ads. Learn how Google uses information from sites or apps that use our services.

You can opt out at any time:

• through our cookie banner on the website, or the privacy settings in our apps;
• Google: My Ad Center and the Google Analytics opt-out add-on;
• Meta: your Meta ad preferences;
• industry tools: NAI, DAA and Your Online Choices;
• on Android: Settings > Google > Ads, to delete or reset your advertising ID.

Hotjar records anonymised usage and heatmaps only after you accept analytics cookies; text typed in form fields is masked.

↑ Back to contents

9. Domain registration data

To register a domain we must pass the registrant’s details to the registrar and registry. Generic domains (.com, .net, etc.) are registered through eNom, LLC (Tucows group), an ICANN-accredited registrar, which acts as an independent controller for this data under ICANN’s Registration Data Policy. The data is sent to the registry, deposited with a data escrow agent designated by ICANN, and made available through WHOIS/RDAP services, where personal data of individuals is generally redacted; registrars disclose it to third parties with a legitimate interest according to ICANN rules. For .ma domains, the data is sent to the ANRT, which publishes it in the .ma WHOIS as provided by its naming decision.

↑ Back to contents

10. Fraud and abuse prevention

To protect our users, our networks and third parties, we use automated checks:

• Google Play Integrity, to detect modified apps and fraudulent purchases;
• monitoring of proxy usage patterns, such as traffic volume and failed sign-ins, to detect abuse, spam and attacks;
• anti-bot protection by Cloudflare on our websites;
• payment fraud screening by our payment providers.

These checks may lead us to suspend an account. A member of our team reviews any suspension you contest. We do not make decisions with legal or similarly significant effects based solely on automated processing.

↑ Back to contents

11. US state privacy rights

If you live in a US state with a consumer privacy law (such as California):

• What we collect: the categories in sections 2 and 7: identifiers, commercial information, internet activity, approximate location and inferences for advertising.
• Selling and sharing: we do not sell personal information for money. Disclosing identifiers to advertising partners for cross-context behavioural advertising may count as “sharing” or “selling” under these laws.
• Your rights: you may opt out of this, and request access to, correction or deletion of your information, using the privacy settings in our apps, the cookie banner, or by writing to privacy@golzak.com. You may use an authorised agent.

Opt-out signals. Our website treats a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of your personal information, and as a refusal of optional cookies for that browser. Because there is no common standard for “Do Not Track”, we do not respond to that signal. Use the Do Not Sell or Share My Personal Information options described here, or the privacy settings in our apps.

Appeals. If we decline your request, you may appeal by replying to our decision or writing to privacy@golzak.com with the subject “Privacy appeal”. We will respond within 45 days. If you are not satisfied, you may contact your state Attorney General.

We will not discriminate against you for exercising your rights. We do not knowingly sell or share data of persons under 16.

↑ Back to contents

12. Your rights

You may request access to, rectification or erasure of your data, and may object to its processing, including for direct marketing at any time and free of charge. Under the UK GDPR you may also request restriction of processing and data portability, and withdraw consent at any time. Write to privacy@golzak.com or to the postal address of the company concerned. We reply within one month, and may ask you to verify your identity.

You may lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) for Golzak UK, or with Morocco’s Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP, www.cndp.ma) for Golzak Morocco. Residents of the EU may also contact their local supervisory authority. The processing operations of Golzak Morocco are being declared to, and submitted for authorisation by, the CNDP in accordance with Law 09-08.

How we handle requests. To protect your data, we verify your identity before acting on a request, usually by asking you to write from the e-mail linked to your account or to confirm account details. An authorised agent may act for you with your signed permission, and we may ask you to confirm the request directly. We do not charge for requests unless they are manifestly unfounded or excessive.

↑ Back to contents

13. Cookies

golzak.com uses strictly necessary cookies (session, security, language and shopping cart), which do not need consent. It also uses analytics cookies (Google Analytics, via Google Tag Manager) and advertising cookies and pixels (Google Ads, Meta Pixel) to measure our audience and the performance of our campaigns. You can refuse optional cookies through the cookie banner, block them in your browser settings, or opt out at adssettings.google.com and in your Meta ad preferences.

↑ Back to contents

14. Security

We protect your data with encrypted connections (HTTPS/TLS), access restricted to authorised staff, individual accounts with strong passwords and two-factor authentication where available, logging, backups, and contracts with each provider that cover confidentiality and security. No system is completely secure. If a breach is likely to put your rights at risk, we will notify you and the competent authority as required by law.

↑ Back to contents

15. Children

Our services are intended for persons aged 18 or over. We do not knowingly collect data from minors, and we delete any such data once we become aware of it. We do not knowingly show personalised advertising to anyone under 16.

↑ Back to contents

16. Changes

We may update this policy. We will inform customers by e-mail or through the portal of any material change before it takes effect. The effective date is shown at the top.

↑ Back to contents

17. Contact

Data protection contact for both companies: privacy@golzak.com.
GOLZAK UK LTD, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.
GOLZAK SARL AU, N°8 rue Omar Ibn Kaltoum, av. El Kattani, Agdal, bureaux 29, 5e étage, 30000 Fès, Morocco.

↑ Back to contents

See also our Terms of Service, Acceptable Use, Refund and .ma policies.