Privacy Policy

Marrakech Eco Tours (“we”, “us”, “our”) is a Morocco-based tour operator offering guided trekking, desert, cultural, and adventure tours departing from Marrakech and Agadir. Our website is marrakechecotours.com.

We are the data controllerfor the personal data described in this policy. To contact us about it — including to exercise any of the rights set out below — email info@···.com, call +212 653 936 003, or write to us at Marrakech, Morocco.

We also operate a sister brand, Morocco Bike & Ski Tours (moroccobike-skitours.com), run by the same team. This policy covers marrakechecotours.com; the sister site publishes its own notice.

This policy explains what personal data we collect, how we use it, and what rights you have. We process personal data in accordance with Moroccan Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data, overseen by the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). Where we serve visitors in the European Union, we also apply GDPR-aligned standards.

We collect only the information you voluntarily provide when you:

• Submit an enquiry or booking request through our contact form (name, email address, phone number, tour interest, travel dates, group size, and message)
• Contact us via WhatsApp, email, or phone directly
• Subscribe to our newsletter (email address only)
• Complete a booking and deposit payment (payment is processed by PayPal — we do not receive, store, or have access to your card or bank details)
• Appear in photographs taken on tour, where we have asked for and received your permission to publish them

We also process a small amount of technical and preference data automatically — see Cookies & Similar Technologies and our Cookie Policy for the full detail.

We use the information you provide solely to:

• Respond to your tour enquiry and process your booking
• Send booking confirmations, itineraries, and pre-departure information
• Contact you regarding changes to your booking or tour
• Send newsletters, only if you have explicitly subscribed (you can unsubscribe at any time)
• Comply with legal and accounting obligations under Moroccan law

We will never use your information for unsolicited marketing without your explicit consent. We do not sell, rent, share, or trade your personal data with third parties for any marketing purpose.

Our website uses a small number of cookies. We do not use social media pixels or cross-site advertising trackers. The cookies we set are:

• Consent (met-cookie-consent) — remembers your cookie choice so we do not ask again. Strictly necessary.
• Currency (met_currency) — remembers the display currency you select (EUR, USD, GBP, or MAD). Functional preference; set only when you change currency.
• Google Analytics (_ga, _gid and related) — help us understand, in aggregate, how visitors use the site and whether our advertising reaches the right people. Set only if you choose “Accept all”; if you choose “Necessary only” they are never set and Google Analytics does not load.

We also use privacy-friendly, cookieless performance measurement (see Third-Party Services). A full breakdown, including how to refuse or clear cookies, is in our Cookie Policy. On your first visit a banner lets you accept all cookies or keep only the strictly necessary ones. Our lawful basis for analytics cookies is your consent, which you can withdraw at any time by clearing this site’s cookies.

To operate our website and process bookings, we use the following processors. Each handles data under their own privacy terms:

• Vercel— website hosting and privacy-friendly analytics. Vercel Analytics and Speed Insights collect anonymised, aggregated traffic and performance data (page views, visitor counts, Core Web Vitals) without cookies or personal identifiers. Vercel may log standard server data (IP address, request timestamps) for security. See Vercel’s Privacy Policy.
• Google (Analytics & Ads) — only if you accept all cookies, we use Google Analytics 4 to measure aggregate site usage and Google Ads to measure the performance of our advertising. Google may process this data (including your IP address, from which we enable IP anonymisation) outside Morocco. It does not load if you choose “Necessary only”. See Google’s Privacy Policy.
• PayPal— secure payment processing for deposits and full payments. PayPal handles all card and bank data directly; we never receive your payment credentials.
• Resend— transactional email delivery. When you submit our contact or newsletter form, your name and email are routed via Resend to our inbox. See Resend’s Privacy Policy.
• Cloudflare — DNS, network security, and email routing. Messages sent to our info@···.com address are forwarded by Cloudflare Email Routing to the team inbox we monitor, so the contents of your email pass through Cloudflare in transit. As our DNS and security layer, Cloudflare also processes standard connection data (IP address, request metadata) to protect the site from abuse. See Cloudflare’s Privacy Policy.
• WhatsApp / Meta— if you contact us via WhatsApp, your messages are subject to Meta’s own privacy policy and terms.
• Third-party RSS publishers— news articles on our News page are fetched server-side from public RSS feeds (The Guardian, BBC, NYT Travel, and others). No user-identifying information is sent to these publishers.

We retain your personal data for as long as necessary to fulfil your booking and for up to 5 years afterwards for accounting and legal compliance under Moroccan law. Enquiries that do not result in a booking are deleted within 12 months of our last contact with you. Newsletter subscriptions are kept until you unsubscribe.

Under Moroccan Law 09-08 (and GDPR where it applies), you have the right to:

• Request a copy of the personal data we hold about you (right of access)
• Request correction of any inaccurate or incomplete data (right of rectification)
• Request deletion of your data, where we are not legally required to retain it
• Object to or restrict our processing of your data in certain circumstances
• Withdraw consent at any time for any communication you did not contractually agree to

To exercise any of these rights, email us at info@···.com. We will respond within 30 days. You also have the right to lodge a complaint with the CNDP if you believe your data has been mishandled.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. Our website is served exclusively over HTTPS with a strict Content Security Policy. All payment processing is handled by PayPal — we never receive, transmit, or store card data. Contact form submissions are delivered via Resend over encrypted connections.

Our primary operations and data are based in Morocco. Our hosting (Vercel), email delivery (Resend), and — where you have accepted analytics cookies — Google Analytics/Ads infrastructure may process data in the United States or European Union. Where personal data is transferred outside Morocco, we take steps to ensure appropriate protections consistent with Moroccan Law 09-08 and CNDP guidance.

Our services are not directed at children under 16, and we do not knowingly collect their personal data. Minors participating in tours must be accompanied by a responsible adult who agrees to these terms and this policy on their behalf. If you believe a child has submitted personal data to us, contact us and we will delete it promptly.

Our website links to external sites, including news articles and our sister brand. Once you leave our site this policy no longer applies, and we are not responsible for the privacy practices of third-party websites.

We may update this policy from time to time to reflect changes in our services or applicable law. The date at the top of this page reflects the most recent revision. Continued use of our website after a revision constitutes acceptance of the updated policy.

For any privacy-related question or to exercise your data rights, contact us at info@···.com.