Privacy Policy

1. Data controller

Essaouira Experience, Essaouira Medina, 44000 Essaouira, Morocco, is the controller of the data collected via essaouiraexperience.com. Contact: contact@essaouiraexperience.com.

2. Data collected

We only collect the data you voluntarily provide through our forms: first name, email address, phone number, preferred date, number of people and message. These fields are strictly necessary to process your request.

Your IP address is never stored in clear text: it is turned into an irreversible fingerprint, used only to limit automated submissions and abuse.

3. Purposes and legal bases

Your data is processed to answer your request and organise the booked service (pre-contractual measures and performance of the contract), to meet our accounting obligations (legal obligation) and to protect the site against spam (legitimate interest).

We do not send newsletters and do not carry out unsolicited marketing.

4. Retention period

Requests that do not lead to a booking are anonymised after 24 months. Data linked to an invoiced service is kept for 10 years to meet accounting and tax obligations.

5. Recipients

Your data is accessible to our internal team and, only where indispensable to deliver your booking, to the provider concerned (guide, driver, accommodation). We never sell or rent your data to third parties.

6. Cookies and analytics

The website works without advertising cookies or third-party trackers. Only one technical cookie stores the language you selected. No consent is therefore required for this strictly necessary cookie.

If anonymous analytics are enabled, they run without individual identification and without transferring data for advertising purposes.

7. Security

The website is served entirely over HTTPS. Admin access is protected by authentication, attempt rate limiting and strict security headers. Passwords are stored as irreversible hashes.

8. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. To exercise it, write to contact@essaouiraexperience.com: we reply within 30 days.

People residing in the European Union may lodge a complaint with their data protection authority. In Morocco, the competent authority is the CNDP.

9. Transfers outside Morocco

Our servers and email delivery services may be located in the European Union. Any transfers are covered by appropriate contractual safeguards.

10. Changes

This policy may change. The last update date appears at the top of this page; any substantial change will be flagged on the homepage.