Privacy policy

Who is responsible for your data

The data controller is [Company legal name], which runs this website under the brand Morocco Open Trails. It is established in Morocco and offers its trips to visitors in the European Union, the United Kingdom and elsewhere.

• Registered address: [Registered address]

• Registration: [Registration number]

• Contact for any privacy question or request: [Privacy contact email]

We have not appointed a data protection officer, because our activity does not require one. The contact above handles every question about this policy and every request about your data.

The data we collect, form by form

We collect only what you choose to send us and what is needed to run the website safely. You give us this data yourself; we do not buy it or receive it from anyone else. Your name and a way to reach you (email address or WhatsApp number) are needed to answer you; every other field is optional.

• Trip enquiry form (from a trip page): your name; your email address and/or your WhatsApp number with its country code; your country if you give it; the trip and option you ask about; the month or dates; the number of adults and children; your message.

• Tailor-made request form: the same identity and contact data, plus your budget (an amount or a range), your interests, the length of the trip you have in mind, your travel dates and your message.

• Contact form: your name, your email address and/or WhatsApp number, the reason for your message and your message.

• For each form we also record that you accepted this policy, with its version and the time, and the context of the form: the page you sent it from, the button that led you there, the domain of the website that sent you to us, the campaign tags in the link (utm) and whether you used a phone or a computer. This tells us which pages and trips are useful; it is never used to profile you.

• Email and WhatsApp: if you write to us by email or choose WhatsApp, we receive what you write, your email address or WhatsApp number and the name attached to it, and we keep our replies.

• Visit statistics, without cookies: the page viewed, its type and language, the time, the domain of the referring website, the device class and the country of the connection. To count unique visits we compute a pseudonymous code from your IP address and browser with a secret key that changes every day; your IP address itself is never stored, and yesterday's codes cannot be linked to today's. Nothing is recorded if your browser sends "Do Not Track" or "Global Privacy Control", or if you turned statistics off in the cookie settings.

• Your cookie choice: an anonymous record of the choice (a random key hashed on our side, the choice, the versions and the date) without your IP address or browser identity.

• Technical logs of our server, kept for security and troubleshooting; they may contain your IP address and the pages requested.

We do not ask for payment details, identity or passport numbers, health data or any other sensitive data, and we take no payment on this website. Please do not put them in your messages; if you do, we will delete them from our records.

Why we use it and on which legal basis

• Answering your trip enquiry or tailor-made request and preparing the quote and the trip you ask for
  Legal basis: Steps taken at your request before a contract: art. 6(1)(b) GDPR and UK GDPR. Under Moroccan law 09-08, your consent given by sending the form

• Answering a general message
  Legal basis: Our legitimate interest in answering the people who contact us: art. 6(1)(f). Under law 09-08, your consent given by sending the form

• Contacting you on the channel you chose (email or WhatsApp) and keeping the conversation
  Legal basis: Same basis as the request it relates to (art. 6(1)(b) or (f))

• Following up your request inside our team (notes, status, outcome)
  Legal basis: Legitimate interest in organising our replies and our trips: art. 6(1)(f)

• Visit statistics without cookies, which you can turn off
  Legal basis: Legitimate interest in understanding which pages and trips are useful: art. 6(1)(f). You can object at any time (see "Your rights")

• Security: protecting the forms against spam and abuse, keeping server logs
  Legal basis: Legitimate interest in keeping the website and our data safe: art. 6(1)(f)

• Keeping proof of your cookie choice
  Legal basis: Legal obligation and legitimate interest in showing that your choice is respected: art. 6(1)(c) and (f)

• Meeting legal obligations and answering an authority's lawful request
  Legal basis: Legal obligation: art. 6(1)(c)

• Establishing, exercising or defending legal claims
  Legal basis: Legitimate interest: art. 6(1)(f)

Where we rely on legitimate interest, we have weighed it against your rights; the data involved is limited and the use is one you can reasonably expect when you contact a travel company. Where a use is based on your consent, you can withdraw it at any time, without affecting what was done before. We do not make decisions about you by automated means, we do not profile you, we never sell your data and we never use it for advertising.

Who receives your data

• The members of our team who answer requests, each with a personal account and only the access their role needs.

• Hostinger International Ltd (Cyprus), with its affiliate Hostinger UK Limited, our hosting and email provider and our processor: the website, its database, its backups and our emails run on Hostinger servers in the United Kingdom, and the emails we send and receive go through Hostinger's email service, under Hostinger's data processing addendum. Hostinger may use sub-processors, which it lists on its website.

• WhatsApp, only if you choose it: when you tap a WhatsApp button or ask for a WhatsApp reply, the conversation takes place in WhatsApp (WhatsApp Ireland Limited / Meta), which acts as a separate controller under its own privacy policy. We do not control what WhatsApp does with your data. Your email provider and your own device also handle your messages.

• Public authorities, courts and our professional advisers, only when the law requires it or to defend a legal claim.

No other company receives your data. The website loads no third-party script, font, map, video or advertising, and no social-network plug-in.

Where your data is stored and international transfers

Your data is stored in the United Kingdom, on Hostinger servers. The European Commission has recognised that the United Kingdom offers an adequate level of protection (GDPR art. 45), so data of visitors in the European Union can be stored there. Hostinger's data processing addendum also incorporates the European Commission's standard contractual clauses for the cases where they are needed.

Our team works from Morocco and reads and answers your requests from there. Morocco is not covered by an adequacy decision of the European Commission or of the United Kingdom. We collect your data directly from you; for the access from Morocco we apply the safeguards listed in the "How we protect your data" section (personal accounts, access limited to the team members who answer requests, encrypted connections, audit log), and, where the law of your country requires a transfer mechanism, standard contractual clauses or another safeguard recognised by that law. You can obtain a copy of the safeguards by writing to us.

Moroccan law 09-08 also regulates the transfer of personal data abroad, here to the United Kingdom, and subjects our processing to the formalities required by the National Commission for the Control of the Protection of Personal Data (CNDP): declaration or authorisation of the processing, and authorisation of the transfer.

How long we keep it

• Your requests and our conversation with you
  Retention: 24 months after the conversation is closed (or after its last activity), then anonymised: your name, email, phone and messages are removed, and only figures without identity remain for our statistics

• Messages identified as spam
  Retention: 30 days, then deleted

• The copy of each email sent by the website
  Retention: Its content is deleted 90 days after sending (the conversation keeps the message for the period above)

• Our team mailbox (your email answers)
  Retention: 24 months after the last message of the conversation

• Raw visit statistics
  Retention: 13 months; after that only daily totals without any personal data are kept

• Proof of your cookie choice
  Retention: Until the choice expires (13 months when statistics are accepted, 6 months when they are refused), plus 12 months, then deleted

• Server and application logs
  Retention: 30 days

• Backups
  Retention: Up to 6 months (30 daily and 6 monthly copies); erased data disappears when the last backup containing it expires

We may keep a conversation longer only when a legal hold is needed to establish, exercise or defend a legal claim, or when the law requires it.

Your rights and how to use them

Whatever country you live in, you can ask us at any time to:

• give you access to the data we hold about you and a copy of it;

• correct data that is wrong or incomplete;

• erase your data (right to be forgotten), subject to the retention we owe by law;

• restrict its use while a question is being checked;

• give you the data you provided in a structured, commonly used, machine-readable format, or send it to another provider (portability);

• stop a use based on our legitimate interest, including the visit statistics (right to object);

• withdraw a consent you gave, at any time.

These rights come from the GDPR and the UK GDPR (arts. 15 to 21), from Moroccan law 09-08 (access, rectification, opposition) and, for visitors in Brazil, from the LGPD (art. 18). To use them, write to [Privacy contact email]. We answer within one month (the GDPR allows two more months for a complex request, and we would tell you why). To protect you, we may ask you to confirm that the request comes from you, for example by writing from the email address you used. The request is free unless it is manifestly unfounded or excessive.

You can also lodge a complaint with a data protection authority: the authority of the country where you live or work, or where you think the problem occurred, for example the CNIL (France), the AEPD (Spain), the CNPD (Portugal), the Information Commissioner's Office (ICO, United Kingdom), the ANPD (Brazil), or the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP, Morocco). We would be grateful if you contacted us first, so that we can try to solve the problem.

United States visitors: we do not sell your personal information, we do not share it for cross-context behavioural advertising and we do not use it for targeted advertising, as these terms are used in US state privacy laws. You may still ask us to access or delete your data at the contact above.

How we protect your data

• The website is served over an encrypted connection (HTTPS/TLS), and our emails use encrypted connections to the mail server.

• The data is stored on Hostinger servers in the United Kingdom, reachable only through restricted administrative access.

• Only authorised team members can read requests, each with a personal account, a strong password (checked against known breaches), optional two-factor authentication, an automatic sign-out after inactivity and access limited to their role.

• The changes made in our administration panel are logged in an audit log.

• Passwords are stored only as irreversible hashes, and two-factor secrets are encrypted.

• Our backups are encrypted before they leave the server, and their copies expire automatically.

• The forms are protected against spam and abuse, and the website records no payment data because it takes no payment.

No system is perfectly secure. If a breach of your data is likely to put you at risk, we will notify the competent authority within 72 hours, and you when the risk is high, as the law requires.

Children

This website and its forms are meant for adults organising a trip, and are not directed at children under 16. We do not knowingly collect data from them. If you are under 16, please ask a parent or guardian to contact us for you; if you think a child has sent us data, write to us and we will delete it.

Changes to this policy

When this policy changes, we update its version and its date at the top of this page, and each request you send keeps the version you accepted. If a change affects how we use data you already gave us in a way that needs your agreement, we will ask for it.

See also our cookie policy, our terms of use and our legal notice.