✦ Legal Information

Privacy Policy

Last updated: September 2026 · Version 2.1 · How we respect, protect, and handle your data.

1. Introduction

Discover Hidden Morocco ("we", "our", or "us") is a Moroccan-licensed boutique travel agency (Licence n° CIMR-2024-MRK-002041) operating in Marrakech, Kingdom of Morocco. We are committed to protecting the privacy, confidentiality, and security of our guests' personal data.

We comply with Moroccan Law n° 09-08 relating to the protection of individuals with regard to the processing of personal data (CNDP), as well as the European General Data Protection Regulation (GDPR - Regulation EU 2016/679) for our European and international visitors. This policy explains what information we collect, why we collect it, and what your legal rights are.

2. Information We Collect

We collect personal information that you provide voluntarily when inquiring, customizing an itinerary, or booking an expedition:

  • Personal Details: Full name, nationality, email address, phone/WhatsApp number, and passport details (as required by Moroccan authorities for hotel and desert camp registrations).
  • Travel Preferences & Needs: Accommodation style (Luxury Riad / Desert Glamping), dietary preferences, physical mobility requirements, and group composition.
  • Payment Information: Transaction references, bank transfer receipts, or secure payment tokens. We do not store full credit card numbers on our servers.
  • Communication Records: Email correspondence and WhatsApp messages exchanged with our concierge team to coordinate your itinerary.
  • Technical Browsing Data: IP address, browser type, device details, and pages viewed, collected anonymously via standard cookies to improve website performance.

3. How We Use Your Information

We process your data strictly for legitimate business and travel-fulfillment purposes:

  • Fulfilling Your Journey: Booking hand-picked riads, private 4x4 drivers, desert camp accommodations, mountain guides, and hot air balloon flights.
  • Trip Communications: Sending your digital dossier, itinerary updates, flight pick-up instructions, and direct WhatsApp concierge support while in Morocco.
  • Emergency & Safety: Ensuring we can assist you promptly in the unlikely event of travel disruptions, medical needs, or emergencies during your trip.
  • Legal & Tax Compliance: Issuing official travel invoices and maintaining records as required by Moroccan fiscal and tourism authorities.
  • Optional Newsletters: With your explicit consent, sending you curated seasonal Morocco travel stories, new route announcements, and exclusive offers. You can unsubscribe at any time.

4. Legal Basis for Processing

Under GDPR and Moroccan law, we only process your personal data where we have a valid legal basis:

  • Contractual Performance: Processing is strictly necessary to prepare your quote, confirm your reservations, and execute your tour contract.
  • Legal Obligation: To comply with mandatory Moroccan hotel check-in registration laws and corporate tax accounting requirements.
  • Legitimate Interest: To maintain website security, prevent fraud, answer your inquiries, and improve our services.
  • Consent: For sending optional promotional communications. You may withdraw your consent at any time without penalty.

5. Data Sharing & Third Parties

We believe in absolute privacy. We never sell, rent, trade, or monetize your personal data to advertisers, data brokers, or marketing networks. We share your information exclusively with essential partners involved in delivering your tour:

  • Local Licensed Partners: Our vetted Moroccan drivers, licensed city guides in Fes/Marrakech, and desert camp managers (only the details necessary to provide your service).
  • Accommodation Partners: Riads and boutique hotels to secure your room reservations in compliance with local hospitality regulations.
  • Secure Payment Gateways: Certified, PCI-DSS-compliant payment processors who handle financial transactions with bank-grade encryption.
  • AI Assistant (Chatbase): Our website chat assistant to answer instant queries. Conversations are fully anonymized and never linked to your personal profile.

6. International Data Transfers

Because we serve travelers worldwide, some of our technology providers (such as cloud hosting and email delivery) operate servers within the European Union or the United States.

When transferring personal data across borders, we ensure strict data protection standards are maintained through Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data enjoys the same level of legal protection as inside the EU.

7. Data Retention & Security

We keep your personal information only for as long as strictly necessary to fulfill the purposes outlined in this policy:

  • Booking & Financial Records: Retained for 7 years to comply with statutory Moroccan tax and audit obligations.
  • Trip Inquiries & Messages: Retained for 3 years to assist you with future trip requests, after which they are securely purged.
  • Marketing Subscriptions: Retained until you click "Unsubscribe" or request removal.
  • Analytics Data: Anonymized data is retained for 26 months, after which it is automatically deleted.

We employ enterprise-grade technical safeguards — including SSL/TLS 256-bit encryption, strict access controls, and firewall defenses — to protect your data against unauthorized access, alteration, or disclosure.

8. Your Rights Under GDPR & Moroccan Law

Depending on your location, you have strong legal rights regarding your personal information:

  • Right of Access (Art. 15 GDPR): You can request a copy of all personal data we hold about you.
  • Right to Rectification (Art. 16 GDPR): You can ask us to correct inaccurate or incomplete details.
  • Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You can request the permanent deletion of your data when it is no longer required for legal or booking fulfillment purposes.
  • Right to Restrict Processing (Art. 18 GDPR): You can ask us to pause processing your data under certain circumstances.
  • Right to Data Portability (Art. 20 GDPR): You can request your data in a structured, machine-readable format.
  • Right to Object (Art. 21 GDPR): You can object at any time to direct marketing communications.

To exercise any of these rights, simply email our Privacy Officer at contact@discoverhiddenmorocco.com. We respond to all verified requests within 30 days without any fee.

9. Children's Privacy

Our website is not intended for or marketed to children under 16 years of age. We do not knowingly collect personal data directly from minors. When families travel with children, all personal details must be provided directly by the parent or legal guardian.

If you believe a minor has submitted personal information through our website without parental consent, please contact us immediately and we will delete the data without delay.

10. Policy Updates & Contact Us

We review and update this Privacy Policy at least annually to reflect changes in tourism regulations, legal standards, and our services. If we make significant changes, we will notify you by email or via a prominent banner on our website homepage.

For any questions, requests, or concerns regarding your privacy, please contact our team:

Questions About Your Privacy?

Our Marrakech concierge team is always here to answer any questions about your data security.

Email Privacy Team WhatsApp Concierge