Privacy Policy

Morocco Beauty Spots ("MBS", "we", "us", "our") is a licensed private-tour operator based in Marrakech, Morocco. We design and operate private itineraries across Morocco and are the data controller for any personal data you submit through this website.

Legal entity and registered address: Morocco Beauty Spots, 123 Rue de la Liberté, Gueliz, 40000 Marrakech, Morocco. Privacy contact: contact@moroccobeautyspots.com. For general booking enquiries you can always reach us via the contact page.

We only collect what is needed to answer your enquiry, build your itinerary, and operate the website.

Contact form submissions — your name, email, optional phone, optional travel dates, and the message you send us.

Trip planner submissions — the same as above plus trip preferences (group size, dates, interests, budget band, departure city).

Newsletter signups — your email address only, with your explicit consent.

Server logs — when you visit the site, our servers automatically receive your IP address, user-agent string, referring URL, and the page requested. This is standard for any website.

Bot protection — submissions through our forms pass through Cloudflare Turnstile, which issues a short-lived token to verify you're not an automated bot. The token contains no personal information.

We do not collect payment information through the website. When you confirm a booking, deposit and balance payments are handled via a separate secure channel agreed with you directly.

We use the data you give us to:

Respond to your enquiry within 24 hours (our standard service promise).

Design a private itinerary tailored to your group, dates, and interests.

Send you the booking documents (proposal, deposit invoice, final itinerary, voucher).

Coordinate logistics with your driver, guides, and accommodation providers while your trip is in progress.

Send you our newsletter, only if you have explicitly subscribed.

Detect and prevent fraud and abuse of the forms.

We do not sell, rent, or share your data with advertisers, data brokers, or marketing networks. Ever.

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

Performance of a contract — to plan, confirm, and deliver the private trip you have booked.

Pre-contractual steps — to respond to your enquiry and prepare a proposal.

Consent — for newsletter subscriptions, which you can withdraw at any time by clicking the unsubscribe link.

Legitimate interest — for keeping minimal server logs to protect the site against abuse, and for follow-up communication directly related to your enquiry.

We share the minimum data needed with the following processors, each bound by a data-processing agreement:

Supabase — our database and authentication provider. Your enquiry and planner data is stored here. Data region: EU (Frankfurt).

n8n — our workflow automation platform, which routes new enquiries to our team and sends acknowledgement emails. Self-hosted on our own infrastructure.

WhatsApp Business API (Meta) — only when you explicitly continue the conversation via WhatsApp. Your phone number and message history are then subject to Meta's privacy policy in addition to ours.

Cloudflare — for edge caching, DDoS protection, and Turnstile bot detection. Cloudflare may briefly process IP-level metadata.

Email delivery provider — Supabase for sending booking confirmations and the newsletter.

We also share itinerary details with the drivers, guides, and accommodation partners involved in your trip, strictly as needed to operate the trip.

Some of our processors store or process data outside the European Economic Area (EEA). When this is the case, we rely on either an adequacy decision under GDPR Article 45 or on Standard Contractual Clauses (SCCs) under Article 46 to ensure equivalent protection.

If you would like a copy of the SCCs that govern a specific transfer, contact us using the address in section 13.

We don't keep data longer than we need to:

Booking enquiries that don't convert — 24 months from the last contact, then deleted.

Confirmed bookings — kept for the duration of the trip plus 7 years, to comply with Moroccan tax and accounting law.

Newsletter subscribers — until you unsubscribe.

Server logs — 30 days, then rotated out.

You can always ask us to delete your data sooner (see section 8).

Under GDPR (and equivalent regional regulations), you have the right to:

Access the personal data we hold about you.

Rectify inaccurate or incomplete data.

Erase your data (the "right to be forgotten"), subject to legal-hold exceptions.

Restrict processing in certain circumstances.

Object to processing based on legitimate interest.

Data portability — receive your data in a machine-readable format.

Lodge a complaint with your local data protection authority. In Morocco, that is the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).

To exercise any of these rights, email us at contact@moroccobeautyspots.com. We respond within 30 days.

Our services are intended for adults planning travel. We do not knowingly collect personal data from anyone under 16 years old. If you are a parent or guardian and believe your child has provided us with personal data, contact us and we will delete it.

We use the bare minimum of cookies:

Strictly necessary cookies — for site functionality, security (Cloudflare, Turnstile), and saving your locale preference.

We do not use third-party advertising or behavioural-tracking cookies. We do not run Facebook Pixel, Google Analytics user-tracking, or similar marketing trackers on visitors.

Our site appears in Google Search Console and other measurement tools, but those tools read data from Google's index — they do not drop cookies on your browser when you visit us.

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or the law. Material changes will be flagged on this page and, where appropriate, communicated to users who have given us their email address.

The "Last updated" date at the top of the page reflects the most recent revision.

Questions about this policy, your data, or your rights? Email us at contact@moroccobeautyspots.com, or write to us via the contact page. For general questions about private Morocco trips, the FAQ is the fastest answer for most travellers.