Your information
Privacy Policy
Effective and last updated: August 26, 2026. This Policy explains our practices under Morocco’s Law No. 09-08 and other mandatory data-protection laws that may apply.
1. Controller and scope
Morocco Luxury Vacations, S.A.R.L - AU is responsible for personal information processed through Morocco Luxury Vacations, its booking and customer-account systems, inquiries, support, reviews and related travel services. This Policy applies whether you contact us directly, use the website, make a booking for yourself or another person, or travel as part of a group.
If you give us information about another traveler, you confirm that you are authorized to do so and will show them this Policy. Travel suppliers may also act as independent controllers for their own services and legal duties; their privacy terms may apply.
2. Information we collect
- Identity and contact: name, email, phone, country, account credentials and preferred contact method.
- Booking and traveler: experience, dates, group size, pickup details, accommodation, itinerary preferences, booking reference, special requests and service history.
- Payment and invoice: selected payment method, amount, currency, transaction reference, payment status, billing and invoice information. Stripe and PayPal process complete card or wallet credentials; this application does not store complete payment-card details.
- Support and content: inquiries, live-chat messages, emails, support tickets, complaints, survey responses and reviews.
- Device and usage: IP address, browser/device information, security events, pages, referrals and cookie or analytics identifiers when the relevant technology is active.
- Limited sensitive information: accessibility, dietary, allergy or health details only when you choose to provide them and they are reasonably necessary to deliver the requested service safely.
3. Why we use information and our legal bases
| Purpose | Typical legal basis |
|---|---|
| Quote, confirm, personalize and deliver travel services; provide accounts, confirmations and invoices. | Steps requested before a contract and performance of the booking contract. |
| Process payments, accounting, tax, fraud prevention, records and legal claims. | Contract, legal obligation and legitimate interests in secure and accountable operations. |
| Answer inquiries, support travelers, handle emergencies, complaints and service quality. | Contract and legitimate interests in customer care; vital interests in a genuine emergency where applicable. |
| Send marketing or use non-essential analytics/advertising technologies. | Consent where required; otherwise a permitted legitimate interest with an effective opt-out. |
| Process voluntarily supplied health, allergy or accessibility information. | Explicit consent or another lawful condition available under applicable law, limited to service and safety needs. |
Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. Where we rely on legitimate interests, we balance our operational need against your rights and expectations.
4. Who receives information
We disclose only what is reasonably necessary to:
- hotels, riads, transport providers, guides, restaurants, activity operators and other suppliers delivering the journey;
- Stripe, PayPal, banks and fraud-prevention or accounting providers processing and reconciling payment;
- hosting, email, customer-support, live-chat, analytics, security and technical service providers acting under appropriate instructions;
- professional advisers, insurers, public authorities or courts where required by law, safety, a legal claim or protection against fraud; and
- a successor in a genuine merger, restructuring or business transfer, subject to confidentiality and applicable law.
Booking and invoice QR codes contain signed, limited verification URLs. Public verification records do not expose customer contact details or payment amounts. We do not sell personal information.
5. International transfers
Morocco travel arrangements often require information to be used in Morocco and may involve a traveler, supplier or technology provider in another country. Privacy protections may differ. Where a transfer requires authorization, contractual protection, adequacy recognition, consent or another safeguard under Law No. 09-08 or applicable foreign law, we use the required mechanism and limit the information transferred.
6. Cookies, analytics, advertising and live chat
Essential storage supports security, sessions, theme preferences, account access and booking functions. MLV first-party Growth Intelligence, when enabled, measures public page views and CTA activity using a random per-tab/session token stored in session storage; the server retains only a one-way hash of that token plus public page/landing paths, source/medium, referrer host, a coarse device class and a country code only when the trusted hosting/CDN layer supplies one. It does not store the visitor IP address, raw browser user agent, form values, customer identity, payment details or arbitrary URL query strings for Growth Intelligence. Protected Admin, Client, Travel Agent and payment routes are excluded from that measurement.
If enabled, Google Analytics, Google Tag Manager or Meta Pixel may process device, usage, referral and cookie identifiers. Tawk live chat loads on public and customer-facing pages and may process device/session information and the content you choose to submit in a conversation. Do not place passport, payment-card or unnecessary health information in live chat.
Where law requires prior consent for a non-essential cookie or similar technology, it must remain disabled until that consent is obtained. Browser controls can block or delete cookies, but blocking essential storage can prevent account or booking features from working.
7. Retention
We retain information only for service, legal, tax, safety, dispute and security needs. Our normal maximum periods are:
| Record | Normal retention |
|---|---|
| Unsuccessful inquiries and unconfirmed quotes | Up to 24 months after the last meaningful contact. |
| Customer account and profile | While active, then up to 3 years after closure or last activity. |
| Bookings, payments, invoices and accounting evidence | 10 years after the relevant transaction, or a different statutory period if required. |
| Support, complaint and claim files | Up to 5 years after closure, longer if a claim or legal hold remains active. |
| Security and technical logs | Normally up to 12 months unless needed to investigate an incident. |
| First-party Growth Intelligence events | 90–365 days according to the active Administration retention setting; default 180 days. |
| Published reviews | While published, then up to 3 years after removal for moderation and dispute records. |
| Marketing preferences | Until withdrawal or 24 months of inactivity; suppression records may be kept to respect an opt-out. |
We may keep a record longer when law requires it or it is reasonably necessary for an active dispute, fraud investigation or legal claim. Information is then deleted, anonymized or securely archived.
8. Security
We use encrypted connections, access controls, secure password handling, role restrictions, signed verification links, logging, backups and service-provider controls appropriate to the information and risk. No internet system is completely secure. Tell us promptly if you suspect unauthorized use of your account or personal information.
9. Your rights
Subject to identity verification and applicable exceptions, Law No. 09-08 may give you rights of information, access, correction and opposition to certain processing. Where the GDPR or another mandatory law applies, you may also have rights to erasure, restriction, portability, withdrawal of consent and objection to direct marketing or processing based on legitimate interests.
Send a request to contact@moroccoluxury.vacations. Describe the request and the information concerned. We may ask for proportionate proof of identity and authority. We will respond within the period required by applicable law and explain any lawful refusal or limitation. You may complain to Morocco’s Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) or another competent authority.
10. Children
The website is not directed to children booking independently. A parent, guardian or authorized lead traveler must supply information needed for a minor’s journey. We limit a minor’s information to what is necessary for booking, safety and legal requirements.
11. Third-party links and policy changes
External websites and supplier platforms have their own privacy practices. Review them before providing information. We may update this Policy when services, providers or law change. The effective date above shows the latest version; a material change will be highlighted where reasonably possible.
Privacy contact
Morocco Luxury Vacations
S.A.R.L - AU
77 St Mohamed Smiha, 10th Floor, No. 57, Casablanca 20250, Morocco
ICE: 004023960000064
contact@moroccoluxury.vacations
+212 662 102 928