---
name: lawve-ai/morocco-ecommerce-compliance-audit-omar-laftouh
source: https://app.decimal.ai/s/lawve-ai-morocco-ecommerce-compliance-audit-omar-laftouh@1/SKILL.md
source_sha256: c4e6efe8e4aa
---

# Legal Compliance Audit — Moroccan E-commerce (Law 09-08 & Law 31-08)

## When to use this skill

Use this skill when a user asks to audit, check, or assess the legal compliance of a Moroccan
e-commerce website, specifically regarding:
- personal data protection (Law 09-08)
- consumer contract obligations and mandatory disclosures (Law 31-08)

**Out of scope**: Meta/Google advertising compliance (covered by a separate skill), law of other
countries, definitive legal advice, marketplaces/multi-vendor platforms (not yet covered by this
methodology), informal commerce without a website (selling only through a Facebook/Instagram
page + WhatsApp, without formalized Terms & Conditions or privacy policy — not covered here, as
this methodology assumes the existence of a website). The results of this audit are a structured
starting point, to be validated by a professional before any contentious action.

## Audit methodology

The audit always follows the same order, from the most visible/quick-to-check items to the more
specific ones. For each site audited, duplicate `assets/grille-audit-site-web.xlsx` and fill in
the Status column (Compliant / Non-compliant / To correct / To verify) as you go.

### How to collect the information

The information needed for the audit is not all in one place — do not limit the check to the
footer. Browse the entire site: homepage, footer, menu/sidebar, and a selection of product pages,
to gather the elements required by each item in the grid. If an element remains unclear or cannot
be found after this review (e.g. CNDP number never displayed, ambiguous return procedure), flag
it as "To verify with the client" rather than guessing or defaulting to non-compliant.

### How to rate each item (Compliant / Non-compliant / To correct)

- **Compliant**: the element is present and correct (e.g. right of withdrawal mentioned with the
  correct 7-day period).
- **Non-compliant**: the element is absent or entirely missing (e.g. no mention of the right of
  withdrawal anywhere on the site).
- **To correct**: the element is present but incorrect or incomplete (e.g. right of withdrawal
  mentioned but with a 3-day period instead of 7) — in this case, specify what needs to change,
  not just flag the issue.

Some elements are non-negotiable (e.g. right of withdrawal, seller identity, consent for data
collection): their absence should always be treated as High priority, regardless of context.
Others tolerate some flexibility depending on the client's context (e.g. intellectual property
terms of use, Low priority) — the priority already indicated in the grid reflects this
distinction.

### 1. Foundational documents — Terms & Conditions and Privacy Policy

First check whether the site has a **Privacy Policy** and **Terms & Conditions** (often in the
footer). Their mere presence is not enough: verify that they are genuinely tailored to the site
(not an irrelevant generic copy-paste) and that they cover, point by point:

**Privacy Policy (Law 09-08)** — check each of these points separately:
- Is the customer informed that their data is being collected (message before or during checkout)?
- Is it specified that this data is used only to process the order, with no undisclosed reuse
  (marketing follow-up, resale to a third party)?
- Is the customer informed they can request deletion of their data?
- Is there a mention of how collected data is secured (phone number, address)?
- Explicit consent for browsing data (unchecked checkbox by default, cookie banner before
  trackers are activated)
- Data retention period specified
- If the site uses foreign tools (Meta Pixel, Google Analytics): mention of a transfer of data
  abroad

**Terms & Conditions (Law 31-08)** — check each of these points separately, not as a single block:
- Seller identity and contact details clearly visible
- Total price displayed including tax
- **Delivery time AND delivery fees** both communicated before checkout (both, not just one)
- Payment terms specified before checkout (e.g. cash on delivery vs. bank transfer)
- **Right of return**: period specified (7 clear days), clear procedure, **return costs**
  specified (who bears them), **exceptions** listed (personalized products, perishable goods,
  unsealed software, services already started)
- Terms & Conditions written specifically for this site (not a generic template copied without
  adaptation)

### 2. Product pages

Once the foundational documents have been checked, verify the consistency of the information
shown on product pages themselves: price, delivery times, availability — this information should
match what the Terms & Conditions state.

### 3. Seller disclosures (Law 31-08)

Check separately:
- Seller name and contact visible (website, or Instagram/WhatsApp bio if activity is partly
  informal)
- A dedicated address or channel for customer complaints (email or number distinct from the
  general sales contact)
- Trade register (RC) registration — medium-term priority, not an immediate blocker
- Tax identification number — medium-term priority

### 4. Sector-specific authorizations (ONSSA / Ministry of Health)

Check whether the type of product sold requires a specific authorization — only relevant if the
client sells in a concerned sector:
- **Food supplements / imported food**: ONSSA authorization mandatory before any sale (risk:
  seizure, criminal prosecution, customs seizure)
- **Medicines**: sale strictly reserved to pharmacies (risk: illegal practice of pharmacy) — flag
  as absolute top priority if detected, regardless of the rest of the audit
- **Cosmetics**: case to be examined individually, do not conclude automatically

### 5. CNDP declaration

Check for the presence of a **CNDP declaration receipt number** (mandatory as soon as personal
data is collected). Medium-term priority (official process), useful for long-term
recommendations, even though it does not block day-to-day sales.

### 6. Consent banner (cookies / pixels)

Check for a functional consent banner before advertising trackers are activated (Meta Pixel,
Google Analytics) — in accordance with Art. 4 of Law 09-08.

### 7. Checkout process

Check separately:
- Is the customer informed of delivery times and fees **before** placing the order?
- Is a **complete order summary** presented **before** final confirmation (Art. 31, Law 31-08)?
- Is a **written confirmation** sent to the customer at delivery (its absence extends the
  withdrawal period to 30 days)?
- Are payment terms (cash on delivery, bank transfer, etc.) specified before the order?

### 8. Right of withdrawal

Check that the legal withdrawal period (7 clear days from receipt, extended to 30 days if the
mandatory information was not confirmed in writing) is clearly stated, along with its procedure
and exceptions (personalized products, perishable goods, unsealed software, services already
started).

### 9. Dispute resolution

The level of expectation depends on the size of the site:
- **Large platforms**: a more formal dispute resolution mechanism is expected (structured
  complaint procedure, possibly mediation).
- **Small e-commerce businesses**: a clear, functional contact available in case of a problem is
  sufficient (visible email or phone number) — no formal mechanism required.

### When information cannot be publicly verified

If an element cannot be confirmed from outside the site (e.g. actual existence of a CNDP
declaration, exact content of a supplier contract), flag it as "To verify with the client" rather
than defaulting it to Compliant or Non-compliant.

## Deliverables

1. **Completed grid** (`assets/grille-audit-site-web.xlsx` duplicated and filled in) — status per
   item, with the legal reference already indicated in the grid.
2. **Prioritized summary**: group non-compliant items by priority (High / Medium / Low, already
   indicated in the grid), not just a flat list.
3. **Concrete recommendations**: for any non-compliance related to the Terms & Conditions or the
   Privacy Policy, propose a replacement clause based on
   `assets/CGV_Template_Maroc_V3.docx` and `assets/Politique_Confidentialite_Maroc_V2.docx` as a
   starting point — adapt the bracketed placeholders (`[Company name]`, `[RC number]`, etc.) to
   the audited client rather than copying them as-is.

## Included resources

- `assets/grille-audit-site-web.xlsx` — 14-item Website audit grid, with legal reference and
  priority level for each item.
- `assets/CGV_Template_Maroc_V3.docx` — Terms & Conditions template compliant with Law 31-08,
  with fields to customize (in brackets).
- `assets/Politique_Confidentialite_Maroc_V2.docx` — Privacy Policy template compliant with Law
  09-08, with a reminder of the prior CNDP declaration obligation.