Aviso de privacidad
Última actualización: 10 August 2026
Este aviso explica qué datos personales recoge At Marruecos cuando usas esta web, para qué los recogemos, quién más los ve y qué derechos tienes sobre ellos. Hemos intentado describir lo que realmente ocurre.
Quién es responsable
At Marruecos.
For any question about your data, or to exercise any of the rights below, write to privacy@atmarruecos.com. We aim to reply within 30 days, which is the limit the GDPR sets.
Qué recogemos, y cuándo
**When you book an expedition** — your name, email address, telephone number, the number of travellers, and the departure you chose. This is the minimum needed to hold your seats and get your boarding pass to you.
**When you ask us to design a trip** — your name, email address, telephone number, the dates and group size you mention, the interests you tick, and anything you write in the message box.
**When you order from the boutique** — your name, email address, telephone number, and the reservation code that unlocked the store.
**Records of what we sent you** — we keep a copy of each confirmation email and each WhatsApp message, including the address or number it went to and whether it actually arrived. Without this we cannot tell you whether your boarding pass was delivered.
**We do not collect card details.** There is no card field on this site and no card number ever reaches our servers.
We do not use analytics, advertising or tracking of any kind, and we do not profile you or make automated decisions about you.
Por qué podemos tratarlos
**Performance of a contract** — booking and boutique data. We cannot deliver a tour you have booked without knowing who is coming.
**Legitimate interests** — tailor-made enquiries, so we can answer you, and delivery records, so we can prove a confirmation was sent.
**Legal obligation** — accounting records, where tax law requires us to keep them.
Quién más los ve
We do not sell your data and we do not share it for marketing. It reaches these parties only because they operate part of the service:
**Resend** — delivers our confirmation emails, and therefore processes your email address and the content of those emails.
**Meta Platforms (WhatsApp Business)** — where you receive a boarding pass by WhatsApp, your telephone number and that message pass through Meta's infrastructure. Meta's own terms then apply to that message.
**Our hosting provider** — operates the server the site runs on.
**Your guide** — sees the name and group size for their departure, so they can meet you.
Because we operate from Morocco, which the European Commission has not declared to offer adequate protection, data may be processed outside the EEA. Our safeguard for this is: Transfer safeguard — e.g. Standard Contractual Clauses.
Cuánto tiempo los conservamos
Booking and boutique records: Retention period — e.g. 24 months after the departure date.
Tailor-made enquiries: until the enquiry is closed, and then for a short period in case you come back to us.
Delivery records for emails and WhatsApp messages: kept alongside the booking they belong to.
You can ask us to erase your data sooner — see below. We will do so unless we are legally required to keep it.
Tus derechos
If you are in the EEA or the UK, you can ask us to:
give you a copy of the data we hold about you;
correct anything that is wrong;
erase it;
restrict how we use it, or object to our using it;
send it to you, or to someone else, in a portable format.
Write to privacy@atmarruecos.com. You do not have to give a reason, and exercising a right will never cost you anything or affect a booking you have already made.
If you think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first so we can put it right.
Cookies
This site sets **one** cookie, and only for the operator: `te_admin`, which keeps whoever is running the business signed in to the dashboard. It is strictly necessary, expires after 8 hours, and is never set for visitors.
There are no analytics, advertising or third-party cookies, which is why you have not been shown a consent banner. Our typefaces are served from our own server rather than from Google, so loading a page does not reveal your IP address to anyone but us.
Seguridad
The site is served only over HTTPS. Administrative access requires a password and, where enabled, a second factor from an authenticator app. Card details are not collected at all, which removes an entire category of risk.
No system is perfect. If you believe you have found a security problem, please write to privacy@atmarruecos.com and give us a chance to fix it before publishing it.
Cambios
If we change how we use your data we will update this page and change the date at the top. Material changes affecting an existing booking will be emailed to you.
Todos los circuitos — At Marruecos