Sends commercial email, in Mauritania

Loi n° 2017-020 du 22 juillet 2017 relative à la protection des données à caractère personnel, arts. 1, 3-11, 17, 26-49 (principes généraux, formalités préalables et obligations du responsable) · Read the law's page

• Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.
• Complete the Personal Data Protection Authority's prior formalities before processing personal data; failing to do so, even negligently, is a criminal offence.
• Declare your processing to the Authority before you start it, unless article 32 exempts it.
• Choose a sub-processor offering sufficient guarantees, bind them by a written act limited to your instructions, and extend the confidentiality duty to anyone who takes part in the sub-processing.
• Get the Authority's authorization before interconnecting files across different public bodies or across private bodies with different purposes, or before processing a national identification number or other general-purpose identifier.
• Do not keep personal data longer than its purpose requires, unless you keep it only for historical, statistical, or scientific treatment, and keep it usable, converting it for durable storage where needed.

Loi n° 2017-020 du 22 juillet 2017, arts. 18, 50-63 (droits de la personne concernée) · Read the law's page

• Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.
• Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.
• Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure.
• Do not access or write information on a user's terminal equipment, and do not condition access to a service on accepting that, without telling the user its purpose and how to object, unless the access only enables the communication or is strictly necessary for a service they expressly requested.
• Give a person, on written request, access to their data in an accessible and intelligible form and its origin, and a copy on payment of no more than the reproduction cost.
• Correct, complete, update, block, or delete a person's data within one month of a written request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, notifying any third party the data was disclosed to, and honour the same request from their heir after their death.

Loi n° 2017-020 du 22 juillet 2017, arts. 64-98 (Autorité de Protection des Données et sanctions) · Read the law's page

• Cooperate with the Authority's on-site inspections, and take all measures needed to facilitate its work rather than opposing its action.
• Comply with an Authority warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of up to ten million ouguiya for a first breach, or up to fifty million ouguiya or five percent of turnover for a repeat breach within five years.
• Expect the Authority to interrupt your processing, lock the data, or ban the processing without prior formal notice where it creates an urgent risk to rights and freedoms.
• Expect a sanction the Authority imposes to be published, at your own expense, on the Authority's president's decision.