Skip to Content
APPLICATION POINTAGE

Privacy policy — Pointage application

Last updated: 6 August 2026

1. Objet

This policy describes the personal data processed by the mobile application Pointage (iOS and Android), published by Karizma Conseil (hereinafter "Karizma", "we").

Pointage is a professional application intended for employees of Karizma client companies . It records the start and end of work shifts ("clock-ins"), with proof of presence consisting of a photograph and a geographic position, and then transmits these records to the management system (Odoo) of the employing company.

L'application is not intended for the general public : its use requires an account provided by the employer and a device that has been authorised in advance.

2. Publisher identity and contact

Karizma Conseil — Lotissement FLORIDA, Center Park, Rue Zoulikha Nasri, Imm. 6, 4th floor, N° 35 — 20520 Casablanca, Morocco · +212 522 103 925.

Personal data contact: contact@karizma.ma. Any question or request concerning your data may be sent to this address.

3. Who is responsible for what

The application implements deux traitements distincts, falling under two different controllers.

3.1 Autorisation de l'appareil — responsable : Karizma

Before any use, the device must be enrolled with Karizma's authorisation service ("KZM Hub"). Karizma is responsable de ce traitement.

3.2 Pointages — responsable : l'entreprise employeuse

Clock-ins are transmitted directement from the application to your employer's Odoo system. They do not pass through Karizma's servers and Karizma does not access them as part of this processing. Your employer is the data controller ; Karizma acts as a sous-traitant, within the limits set by its contract.

For any request concerning your clock-ins (access, rectification, erasure), please contact your employer first.

4. Data processed

4.1 When authorising the device (transmitted to Karizma)

This data is sent only once, when the device is enrolled:

  • your company's Odoo instance address;
  • your login identifier;
  • a unique device identifier, randomly generated on your phone the first time it is opened (it is neither an advertising identifier nor a serial number);
  • the name and model of the device, so that an administrator can recognise it;
  • your name, email address and telephone number, as recorded in your employer's system.

Purposes: to verify that the device is authorised to access the service, to allow an administrator to approve or refuse the request, to revoke a lost or stolen device, and to prevent fraudulent use.

4.2 When clocking in (transmitted to your employer)

  • the employee identifier and, where applicable, the site or project concerned;
  • the direction of the clock-in (in or out) and its timestamp;
  • the geographic position (latitude and longitude) recorded at the time of the clock-in;
  • a photograph (selfie) taken at the time of the clock-in;
  • the identifier of the employee responsible for the entry and the entry mode used.

Purposes: to record working time, establish proof of presence at the workplace, and feed payroll and activity tracking.

Important clarifications:

  • The position is recorded only at the moment you clock in, when the application is open and in the foreground. No background tracking is carried out, no journey is recorded and no geographic area is monitored.
  • The photograph is resized and compressed on your device before any transmission.
  • The camera is used exclusively to read badges and to take the clock-in photograph. The application does not access your photo gallery.
  • If you decline the location permission, clocking in remains possible — it is then recorded without a position.

4.3 Data kept only on your device

The following information is stored localement, in the secure area of the operating system (iOS Keychain / Android Keystore), and is never transmitted to Karizma :

  • your Odoo login credentials, including your password, in order to keep your session open;
  • your saved credentials for biometric login, if you enable it;
  • the technical device authorisation keys;
  • your display preferences (theme, language).

The application also keeps, in its private storage area, an file d'attente hors ligne : when the network is unavailable, clock-ins and their photographs are saved on the device, then transmitted as soon as the connection returns. Photographs are automatically deleted from the device once transmitted.

4.4 Ce que l'application ne collecte pas

  • No biometric data. Facial or fingerprint recognition is handled entirely by your phone's operating system. The application only receives a "success" or "failure" result: no fingerprint and no face template is read, stored or transmitted.
  • No advertising tracker, no analytics tool, no third-party crash-reporting tool.
  • No advertising, sous quelque forme que ce soit.
  • Aucune revente, location ou cession commerciale of your data.
  • No access to your contacts, your messages, your microphone or your photo gallery.

5. Legal bases

  • Autorisation de l'appareil : the legitimate interest of Karizma and the client company in securing access to the service.
  • Recording of working time: performance of the employment contract and compliance with the employer's legal obligations.
  • Proof of presence (photograph and position): the employer's legitimate interest in verifying actual presence at the workplace.

6. Permissions requested on your device

  • Appareil photo — badge reading, clock-in photograph. If refused: photo clock-in becomes impossible.
  • Localisation (en cours d'utilisation uniquement) — position at the time of the clock-in. If refused: the clock-in is recorded without a position.
  • Face ID / empreinte digitale — quick login, optional. If refused: login with username and password.

These permissions can be withdrawn at any time in your phone settings.

7. Destinataires

  • Your employer — recipient of all clock-ins, through its own Odoo system.
  • Karizma — recipient only of the device authorisation data (article 4.1), acting as the employer's technical service provider.
  • Hosting providers — the KZM Hub authorisation service is hosted on the Karizma One platform; clock-ins are hosted on your employer's Odoo instance.
  • Administrative or judicial authorities, in the event of a lawful request.

No other disclosure to third parties is made.

8. Transfers outside Morocco

The authorisation service (KZM Hub) is hosted on the sovereign Karizma One platform. Clock-ins are hosted on your employer's Odoo instance, at the location defined by the contract between your employer and Karizma. Where hosting is located outside Morocco, the transfer is governed by the contractual safeguards agreed with the hosting provider concerned.

9. Retention periods

  • Device authorisation data: for the duration of use of the service; deleted after the device is revoked.
  • Clock-ins (timestamp, position, photograph) in Odoo: period set by the employer, consistent with its legal obligations to retain payroll data.
  • Photographs pending on the device: until transmission, then immediate deletion.
  • Local session and credentials: until logout or uninstallation of the application.

10. Security

  • all communications travel over HTTPS ;
  • credentials and keys are kept in the secure area of the operating system (iOS Keychain / Android Keystore);
  • authorisation keys are issued once only and the server keeps only a empreinte cryptographique, never the value itself;
  • a device can be revoked remotely by an administrator, which immediately cuts off its access;
  • clock-in photographs are erased from the device as soon as they are transmitted.

Uninstalling the application erases all local data, including the session and any pending clock-ins not yet transmitted.

11. Your rights

In accordance with loi n° 09-08 on the protection of individuals with regard to the processing of personal data, and — where applicable — with the RGPD, you have the rights of access, rectification, objection on legitimate grounds, erasure (within the limits of the retention obligations borne by the employer), restriction of processing and portability where applicable.

How to exercise them:

  • for pointage data (times, positions, photographs): contact your employer, responsable de ce traitement ;
  • for autorisation de l'appareil data: write to contact@karizma.ma.

A response will be provided within 30 days.

12. Account and data deletion

L'application does not allow you to create an account : your account is opened by your employer in its own system. Consequently, deleting it is also the responsibility of your employer.

You may nevertheless at any time:

  • log out from the application, which erases the session and the credentials stored on the device;
  • uninstall the application, which deletes all local data;
  • request revocation of your device and erasure of the associated enrolment data, by writing to contact@karizma.ma (subject: "Pointage device revocation");
  • request deletion of your clock-in data from your employer.

13. Mineurs

The application is intended exclusively for employees and is not aimed at minors under the age of 16. No data is knowingly collected from them.

14. CNDP declaration

Processing notified to the CNDP — contact: contact@karizma.ma

15. Complaints

If you consider that your rights are not being respected, you may refer the matter to the Moroccan National Commission for the Control of Personal Data Protection (CNDP) — www.cndp.ma — or, for persons residing in the European Union, the supervisory authority of their country of residence.

16. Changes to this policy

This policy may be updated to reflect legal or functional developments. The date of the last update appears at the top of the document. In the event of a substantial change, users will be informed within the application.

Pointage application privacy policy — Karizma Conseil. This English version is provided for information; the French version prevails.