Privacy Policy: MarrakechSouks.com

Last updated: August 2, 2026

​

1. Who We Are

MarrakechSouks.com (the "Website," "we," "us," "our," or the "Operator") is operated by a duly organized and registered private limited liability company. Our full corporate name and registered address are on file with our payment processor and applicable regulators, and are available to competent authorities and to data subjects upon a verified, lawful request submitted to the contact below.

For all privacy-related matters, you may contact us at:

privacy@marrakechsouks.com [replace with your actual business inbox]

We provide Marrakech souk tours, private shopping experiences, and related tourism services in Marrakech, Morocco, and may in the future offer e-commerce sales of Moroccan crafts and related goods ("Services").

This Policy explains what personal data we collect, why, how we use it, who we share it with, and the rights you have — whether you are visiting from the European Union, the United Kingdom, the United States, Morocco, or elsewhere.

​

2. Scope

This Policy applies to anyone who interacts with the Website or our Services through:

• Contact and booking/inquiry forms

• WhatsApp or other messaging channels

• Email correspondence

• Phone calls

• Payment processing (Stripe and any other providers we add)

• Analytics and advertising tools

• Cookies and similar tracking technologies

• Any future online store functionality

​

3. Personal Data We Collect

Provided directly by you

• Full name

• Email address

• Phone / WhatsApp number

• Nationality and travel document details, where required to arrange a tour or experience

• Travel dates, group size, itinerary preferences

• Special requests (dietary, accessibility, or other)

• Billing and shipping information (for any future product orders)

• Payment information — processed directly by our payment processor (see Section 8); we do not store full card numbers ourselves

• Any other information you choose to share with us in messages, forms, or reviews

​

Collected automatically

• IP address

• Browser and device type

• Operating system

• Referring URLs

• Approximate geographic location (derived from IP)

• Pages visited, time on page, click behavior

• Date/time stamps of visits

• Cookie identifiers (see Section 7)

We do not knowingly collect government ID numbers, biometric data, or health information, except where a customer voluntarily discloses a medical or dietary need relevant to arranging a tour.

​

4. Why We Process Your Data

Purpose

Examples

Deliver the Services

Booking tours, coordinating guides, arranging shopping experiences

Communicate with you

Confirmations, changes, customer support

Process payments

Via Stripe or other processors

Improve the Website

Analytics, testing, fixing bugs

Marketing (with consent, where required)

Newsletters, offers, promotions

Security & fraud prevention

Detecting abuse, chargebacks, spam

Legal compliance

Tax, accounting, responding to lawful requests

​

5. Legal Bases for Processing (EEA/UK/Switzerland — GDPR & UK GDPR)

 

If you are located in the European Economic Area, the UK, or Switzerland, we rely on one or more of the following legal bases under the General Data Protection Regulation (EU 2016/679) and equivalent UK legislation:

• Contract — processing necessary to book and deliver a tour or product you've ordered

• Consent — for marketing communications and non-essential cookies, which you may withdraw at any time

• Legitimate interests — for security, fraud prevention, and improving our Services, balanced against your rights

• Legal obligation — where processing is required by law (e.g., tax records)

​

6. Your Rights

​

If you are in the EEA, UK, or Switzerland (GDPR)

You have the right to:

• Access the personal data we hold about you

• Correct inaccurate data

• Request erasure ("right to be forgotten")

• Restrict or object to processing

• Data portability

• Withdraw consent at any time (without affecting prior lawful processing)

• Lodge a complaint with your local data protection supervisory authority

​

If you are a California resident (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, use, and disclose

• Request deletion of your personal information

• Correct inaccurate personal information

• Opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising)

• Non-discrimination for exercising your rights

​

If you are in Morocco

Under Law 09-08 on the Protection of Individuals with regard to the Processing of Personal Data, and subject to CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) requirements, you have the right to access, correct, and object to the processing of your personal data. We process personal data in connection with services delivered in Morocco and, where required, will maintain the applicable CNDP declaration/authorization for such processing.

​

Everywhere else

Regardless of your location, you may contact us to ask what data we hold about you, request correction, or request deletion. We will honor reasonable requests to the extent permitted by law.

To exercise any of these rights, email privacy@marrakechsouks.com. We may need to verify your identity before acting on a request.

 

7. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Essential functionality — keeping the site working, security, fraud prevention

• Analytics — understanding how visitors use the site (e.g., Google Analytics)

• Marketing/advertising — where enabled (e.g., Meta/Facebook Pixel), and only with consent where required by law

• Payments — cookies set by Stripe to process transactions securely

Where legally required (e.g., for EEA/UK visitors), we will request your consent via a cookie banner before setting non-essential cookies. You can also control cookies through your browser settings; disabling them may limit some site functionality.

 

8. Payment Processing

Payments on this Website are processed by Stripe, Inc. and may in future be supplemented by additional payment providers. When you make a payment:

• Your card and payment details are transmitted directly to and processed by Stripe (or the relevant processor), not stored on our own servers

• Stripe processes this data under its own privacy policy and is PCI-DSS compliant: https://stripe.com/privacy

• We receive limited transaction data from Stripe (e.g., payment status, last four digits of card, billing name/email) necessary to fulfill and reconcile your order

​

9. Third-Party Service Providers

We may rely on third parties for hosting, analytics, communications, payments, mapping, security, and customer support, including but not limited to:

• Stripe (payments)

• Google (analytics, maps)

• Meta/WhatsApp Business (messaging, advertising)

• Cloudflare or similar (security/CDN)

• CAPTCHA/anti-spam providers

• Email service providers

These providers process data under their own privacy policies. We select providers that offer appropriate safeguards, but we do not control their independent processing activities.

​

10. International Data Transfers

Because our Services are delivered in Morocco, our operating entity is US-based, and we use international service providers, your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including the United States and Morocco.

Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), or transfers to providers certified under equivalent frameworks, to the extent applicable.

​

11. Data Retention

We retain personal data only as long as reasonably necessary for the purposes described in this Policy, including to:

• Deliver a booked service and handle any related disputes

• Comply with tax, accounting, and legal obligations (typically several years post-transaction)

• Maintain security and fraud-prevention records

When data is no longer needed, we delete or anonymize it.

​

12. Data Sharing

We do not sell or rent your personal data. We share it only:

• With service providers necessary to deliver the Services (guides, drivers, artisans, payment processors)

• With professional advisors (accountants, lawyers) as needed

• Where required by law, regulation, or valid legal process

• To protect our rights, property, safety, or that of others

​

13. Children

Our Services are not directed at, and we do not knowingly collect personal data from, individuals who cannot legally provide consent under applicable law (generally, minors under 16–18 depending on jurisdiction). If we learn we have inadvertently collected such data, we will delete it.

​

14. Security

We use reasonable technical and organizational measures (encryption in transit, access controls, working with reputable processors like Stripe) to protect your data. No online system is 100% secure, and we cannot guarantee absolute security.

​

15. External Links

The Website may link to third-party websites. We are not responsible for the privacy practices or content of those external sites.

​

16. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Material changes affecting EEA/UK users' rights will, where required, be communicated via the Website or by email.

​

17. Contact Us

The Operator of MarrakechSouks.com Email: privacy@marrakechsouks.com

Our full legal entity name and registered address will be provided to any data subject upon a verified request, and are disclosed in full to our payment processor(s) and, where legally required, to regulatory authorities.

EEA/UK residents may also lodge a complaint with their local data protection authority if they believe their rights have been violated.