Privacy policy

Data controller

The data controller is [RAISON_SOCIALE], [ADRESSE_SIEGE], Marrakech, Morocco. For any question about your data: [EMAIL_CONTACT].

CNDP registration: [CNDP_DECLARATION].

What we collect, and why

Booking form: your name, phone number, email address where you provide one, the type and name of your accommodation, the neighbourhood, your preferred date and time, the number of people, the treatment chosen, any therapist preference and any notes. This is used only to handle your request, to contact you to confirm it, and to organise the visit.

Location: the “locate me” button is used only if you activate it. Your GPS coordinates are processed in your browser to identify the nearest neighbourhood we serve. Only the neighbourhood name is sent and stored; the exact coordinates are neither transmitted nor kept.

Automated-submission protection: when the form is submitted, a one-way fingerprint (SHA-256 hash) of your IP address is stored with a timestamp to limit repeat submissions. The IP address itself is never stored in the clear, and the fingerprint cannot identify you.

Legal basis

Processing form data is based on pre-contractual steps taken at your request, then on performance of the service contract.

Geolocation is based solely on your consent, given when your browser asks for permission, and withdrawable at any time in your browser settings.

Limiting automated submissions rests on our legitimate interest in protecting the service from abuse.

Who receives it

Your data is available to the booking team and to the therapist assigned to your treatment, only as far as the service requires.

We use two technical processors: Cloudflare, Inc. for hosting the site and database, and Resend (Plus Five Five, Inc.) for sending confirmation emails.

We sell no data and pass none to commercial or advertising partners.

How long we keep it

Requests and bookings: three years from the last contact, so that a complaint or follow-up can be handled.

Anti-spam fingerprints: thirty days at most.

Administrator session: the owner’s authentication cookie expires after seven days.

Cookies and analytics

This site sets no advertising cookies and uses no third-party tracker for profiling.

Only one cookie may be set: the owner area’s session cookie, strictly necessary for authentication and set only after a successful sign-in. It is never set for visitors to the public site.

Your browser may also keep the progress of your booking request locally (local storage). That stays on your device and is not sent to us; clearing site data removes it.

To see at which step booking requests are abandoned, the site anonymously counts how many visits reach each step (for example “day chosen”). Only the date, the step name and a total are stored: no IP address, no identifier, no cookie. A temporary marker in the tab (session storage) stops the same step being counted twice; it disappears when the tab is closed.

Your rights

You have rights of access, rectification, erasure, restriction and objection, together with a right to data portability. You may withdraw consent to geolocation at any time.

To exercise these rights, write to [EMAIL_CONTACT], quoting your booking reference if you have one. We reply within thirty days.

If you believe your rights are not being respected, you may contact Morocco’s national data protection authority (CNDP), or the data protection authority of your country of residence if you live in the European Union.

Security

The site is served over HTTPS only. Access to bookings is protected by a password and a cryptographically signed session cookie, sent over HTTPS only and unreadable by page JavaScript.

No payment data is collected by this site; payment is made in person.