Privacy Policy

The short version

We collect what a booking or an enquiry needs and nothing else. We do not sell your data, we do not run advertising trackers, and we never see your card number.

What we collect

When you write to us

The contact form asks for your first and last name, your email address, an optional phone number, and your message. That goes to the house’s own inbox by email so that a person can answer it. Your IP address is held in memory very briefly to stop the form being used for spam, and is not written to a database or kept afterwards.

When you book

Bookings are handled by Cloudbeds, our property management and booking system. What you enter there — your name, contact details, dates, stay preferences and payment — is processed by Cloudbeds and its payment provider on our behalf. Card details are entered inside their PCI-compliant environment; they do not pass through this website and we never hold them.

When you simply read the site

We run no analytics and set no advertising or tracking cookies. Our hosting provider keeps standard server logs, including IP addresses, for security and reliability. Opening the village map loads map tiles from OpenFreeMap, which necessarily sees your IP address in order to send them.

Why we are allowed to hold it

• To perform a contract — everything needed to take, confirm and deliver your booking.
• Legitimate interests — answering an enquiry, protecting the site from abuse, and keeping our records straight.
• Legal obligation — accounting and tax records we are required to keep.

Who else processes it

Cloudbeds

Booking engine and property management system, including payment processing through its PCI-compliant provider.

Vercel

Hosting for this website, including server logs.

Our email provider

Delivery and storage of enquiries sent through the contact form.

OpenFreeMap

Map tiles, on the Imsouane page only.

Each of these acts on our instructions, or as an independent controller for its own infrastructure. We do not sell or share your personal information, and we have not done so in the preceding twelve months.

Leaving Morocco and the EU

The house is in Morocco and our providers are largely in the United States and the European Union, so your data may be transferred outside your own country. Where that involves personal data from the EU or the UK, those transfers rely on the standard contractual clauses in our providers’ data-processing terms.

How long we keep it

• Enquiries — kept while we are talking, then for up to two years in case you come back to us.
• Bookings — kept for as long as accounting and tax law requires, which is longer than we would otherwise keep them.
• Session footage — recorded for your review during the week and deleted afterwards unless you have asked us to keep or send it.

Your rights

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If the GDPR applies to you, you also have the right to restrict or object to processing, the right to portability, and the right to complain to your national data protection authority. If the CCPA applies to you, you have the right to know, to delete, to correct, and not to be discriminated against for exercising them.

Write to imsouanesurfhouse@gmail.com and we will answer within 30 days. We may need to confirm who you are before releasing anything.

Cookies

This website sets no cookies of its own, and no analytics or advertising cookies. The booking engine may set cookies that are strictly necessary for a booking in progress — remembering your dates and the contents of your basket while you complete it.

Children

The site is not directed at children, and we do not knowingly collect their data. Guests under 18 must be booked and accompanied by a responsible adult.

Who is responsible, and how to reach us

The data controller is Imsouane Surf House, which operates Imsouane Surf House. Contact us at imsouanesurfhouse@gmail.com or by post at N97, Imsouane 80043, Morocco. We read the inbox 24/7.