Last updated 6 November 2026
This notice explains what personal data At Marruecos collects when you use this website, why we collect it, who else sees it, and the rights you have over it. We have tried to describe what actually happens rather than what sounds reassuring.
Who is responsible
At Marruecos.
For any question about your data, or to exercise any of the rights below, write to privacy@atmarruecos.com. We aim to reply within 30 days, which is the limit the GDPR sets.
What we collect, and when
When you book an expedition - your name, email address, telephone number, the number of travellers, and the departure you chose. This is the minimum needed to hold your seats and get your boarding pass to you.
When you ask us to design a trip - your name, email address, telephone number, the dates and group size you mention, the interests you tick, and anything you write in the message box.
When you order from the boutique - your name, email address, telephone number, and the reservation code that unlocked the store.
Records of what we sent you - we keep a copy of each confirmation email and each WhatsApp message, including the address or number it went to and whether it actually arrived. Without this we cannot tell you whether your boarding pass was delivered.
We do not collect card details. There is no card field on this site and no card number ever reaches our servers.
Where your booking came from - if you book, we note the advertising tags in the link you arrived by (for example the campaign name, and Google's click reference if you clicked one of our Google ads) and the name of the website that sent you, such as google.com. This is read from the page you land on and held only in the open page, with the advertising tags staying in the address as you move between our pages; nothing is saved on your device, and nothing is kept unless you book.
We do not use analytics or tracking cookies, we do not follow you around the site, and we do not profile you or make automated decisions about you.
Why we are allowed to hold it
Performance of a contract - booking and boutique data. We cannot deliver a tour you have booked without knowing who is coming.
Legitimate interests - tailor-made enquiries, so we can answer you; delivery records, so we can prove a confirmation was sent; and where a booking came from, so we know which of our advertising works.
Consent - telling Google that one of its ads led to your booking. We only do this if you tick the optional box offered at booking, and you can withdraw it at any time by writing to us.
Legal obligation - accounting records, where tax law requires us to keep them.
Who else sees it
We do not sell your data and we do not share it for marketing. It reaches these parties only because they operate part of the service, or tell us whether our advertising works:
Resend - delivers our confirmation emails, and therefore processes your email address and the content of those emails.
Meta Platforms (WhatsApp Business) - where you receive a boarding pass by WhatsApp, your telephone number and that message pass through Meta's infrastructure. Meta's own terms then apply to that message.
Our hosting provider - operates the server the site runs on.
Your guide - sees the name and group size for their departure, so they can meet you.
Google (Google Ads) - only if you booked after clicking one of our Google ads and ticked the box allowing it: we may send Google that ad's click reference, the time of the booking and its amount, so Google can count the ad as having led to a booking. Your name, email address and telephone number are never sent.
Because we operate from Morocco, which the European Commission has not declared to offer adequate protection, data may be processed outside the EEA. Our safeguard for this is: Transfer safeguard - e.g. Standard Contractual Clauses.
How long we keep it
Booking and boutique records: Retention period - e.g. 24 months after the departure date.
Tailor-made enquiries: until the enquiry is closed, and then for a short period in case you come back to us.
Delivery records for emails and WhatsApp messages: kept alongside the booking they belong to.
You can ask us to erase your data sooner - see below. We will do so unless we are legally required to keep it.
Your rights
If you are in the EEA or the UK, you can ask us to:
give you a copy of the data we hold about you;
correct anything that is wrong;
erase it;
restrict how we use it, or object to our using it;
send it to you, or to someone else, in a portable format.
Write to privacy@atmarruecos.com. You do not have to give a reason, and exercising a right will never cost you anything or affect a booking you have already made.
If you think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first so we can put it right.
Cookies
This site sets one cookie, and only for the operator: `te_admin`, which keeps whoever is running the business signed in to the dashboard. It is strictly necessary, expires after 8 hours, and is never set for visitors.
There are no analytics, advertising or third-party cookies, which is why you have not been shown a consent banner. Our typefaces are served from our own server rather than from Google, so loading a page does not reveal your IP address to anyone but us.
Security
The site is served only over HTTPS. Administrative access requires a password and, where enabled, a second factor from an authenticator app. Card details are not collected at all, which removes an entire category of risk.
No system is perfect. If you believe you have found a security problem, please write to privacy@atmarruecos.com and give us a chance to fix it before publishing it.
Changes
If we change how we use your data we will update this page and change the date at the top. Material changes affecting an existing booking will be emailed to you.