Internal note: this text is a draft and must be reviewed by a lawyer before final publication. The English version is a translation and must be reviewed too. Fill in all the details in square brackets.

Data controller

Controller: [COMPANY NAME], trading under the brand Un Viaje a Marruecos.
Tax ID: [TAX ID/ICE]
Address: [FULL ADDRESS]
Contact email: [EMAIL]
Telephone: +212 611 24 38 01

This policy explains how we process the personal data of people who visit this website, ask us for information or book a trip with us. We apply Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data and, where applicable because we address people located in the European Union, Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

What data we process

Data from contact and quote forms

When you write to us through the form, by email or on WhatsApp, we process the data you give us: first name, surname, email address, telephone number, country, approximate dates, number of travellers and any information you include in your message.

Booking data

If you book a trip, we also process the data needed to organise it: the full name of each traveller, passport number and expiry date, nationality, flight details, accommodation preferences and, if you share them with us, information about allergies, diet or reduced mobility. This last category is used only to adapt the services and with your explicit consent. We also process payment data (amounts, dates and references), but we do not store full card details, which are handled directly by the payment provider.

Browsing and analytics data

If you accept it in the cookie banner, we collect statistical information about how the website is used (pages visited, type of device, source of the visit and approximate location) through Google Analytics, managed via Google Tag Manager. See the Cookie policy for more details.

Purposes and legal bases

Answering your enquiries and preparing quotes: the legal basis is your consent and the taking of pre-contractual steps at your request.
Managing your booking and providing the services contracted: the legal basis is the performance of the travel contract.
Complying with legal obligations, such as accounting, tax or guest registration at accommodation: the legal basis is compliance with a legal obligation.
Analysing use of the website to improve it: the legal basis is your consent, which you can withdraw at any time.
Sending you information about new trips or offers: only if you expressly agree. You can unsubscribe at any time.

Recipients of the data

To organise your trip we need to pass some data to the suppliers who provide the services: accommodation, camps, transport companies, guides and activity providers. We only share the data strictly necessary for each service.

We also work with technology providers that process data on our behalf, such as website hosting, email, messaging tools and Google (Analytics and Tag Manager). Some of these providers may be located outside Morocco or the European Union. In those cases we seek to ensure that appropriate safeguards are in place, such as the standard contractual clauses approved by the European Commission, and we comply with the requirements of Morocco's National Commission for the Control of Personal Data Protection (CNDP).

We do not sell your data or pass it to third parties for commercial purposes.

Retention period

Enquiries and unconfirmed quotes: for as long as necessary to reply to you and up to a maximum of [PERIOD, e.g. 2 years] from the last contact.
Booking data: for the duration of the contractual relationship and, afterwards, for the periods required by tax and accounting legislation and to deal with any claims.
Analytics data: according to the period configured in Google Analytics, which we state in the Cookie policy.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent, without affecting the lawfulness of processing carried out before. To do so, write to us at [EMAIL] stating which right you wish to exercise and attaching a document that proves your identity.

If you consider that we have not handled your request properly, you can lodge a complaint with the CNDP in Morocco or, if you live in the European Union, with the data protection authority in your country, such as the Spanish Data Protection Agency (AEPD).

Security

We keep your data in services with restricted access and encryption, and it is only consulted by staff who need it to handle your booking or enquiry. If we ever detect a security problem that affects you, we will tell you.

Minors

We do not knowingly collect data from minors without the authorisation of their parents or guardians. On family or student trips, the minors' data is provided to us by the responsible adult.

Changes to this policy

We may update this policy to reflect changes in the law or in our services. We will always show the date of the last update.

Last updated: [DATE]

Privacy policy