Privacy, Cookies, Data Retention and Data Rights Policy

VMT is the data controller for personal data processed for VMT's own business purposes.

Company:

General privacy contact: hello@visitmorocco.tours

VMT determines why and how personal data is processed for its own business activities.

Where another organisation independently determines the purposes and means of processing, that organisation might act as a separate controller.

Where VMT processes personal data solely on another organisation's documented instructions, VMT might act as a processor.

VMT operates from the United Kingdom and therefore principally processes personal data under:

1. aUK GDPR
2. bData Protection Act 2018
3. cData (Use and Access) Act 2025
4. dPrivacy and Electronic Communications Regulations 2003
5. eother applicable UK data-protection and electronic-communications legislation.

The relevant data-protection provisions introduced by the Data (Use and Access) Act 2025 are now in force as of 19 June 2026.

Where EU GDPR applies to VMT's processing, VMT will comply with applicable EU GDPR requirements.

EU GDPR might apply where VMT offers services to individuals located in the European Union or otherwise falls within Article 3 GDPR.

VMT will assess EU GDPR applicability according to the actual processing activity rather than the traveller's nationality alone.

Where applicable law in another jurisdiction provides mandatory privacy rights, VMT will respect those rights to the extent legally applicable.

VMT might collect:

1. aname
2. btitle
3. cdate of birth
4. dnationality
5. ecountry of residence
6. fpostal address
7. gemail address
8. htelephone number
9. iWhatsApp number
10. jbooking reference
11. ktravel dates
12. ldestination information
13. maccommodation requirements
14. ntransportation requirements
15. otour preferences
16. pemergency contact information
17. qpassport or identity-document information where required
18. rvisa-related information where relevant
19. spayment and transaction information
20. tdietary requirements
21. uaccessibility requirements
22. vmedical or fitness information where necessary
23. wcomplaint information
24. xcorrespondence
25. yphotographs or other media provided by the traveller
26. zwebsite and technical information
27. aamarketing preferences
28. abcookie and online identifier information
29. acsupplier or agent information
30. adinformation necessary to investigate fraud or security issues.

VMT processes information necessary to administer enquiries and bookings.

This might include:

1. atraveller names
2. bcontact information
3. ctravel dates
4. daccommodation information
5. etransportation requirements
6. factivity selections
7. gspecial requirements
8. hemergency contact details
9. ibooking history
10. jpayment status.

VMT collects only information reasonably necessary for the relevant purpose.

VMT might request passport or other travel-document information where reasonably necessary for a booking or travel service.

Such information might be required by:

1. aaccommodation providers
2. btransport providers
3. clocal authorities
4. dborder or immigration requirements
5. eactivity providers
6. fother suppliers
7. gapplicable law.

VMT will not request passport information merely because it is convenient.

Travellers should provide accurate information.

VMT is not responsible for consequences caused by inaccurate information supplied by a traveller, subject to applicable law.

VMT processes payment information to receive and reconcile booking payments.

Where a third-party payment processor handles card details, VMT aims not to retain full payment-card information unless necessary and lawfully permitted.

Payment providers might independently process personal data under their own privacy policies.

VMT might retain:

1. atransaction references
2. bpayment dates
3. camounts
4. dpayment status
5. epartial payment information
6. faccounting records.

VMT does not intentionally collect unnecessary full card-security information.

Special-category personal data receives additional protection under applicable law.

Such information might include:

1. ahealth information
2. bdisability information
3. cdietary information where it reveals health or religious information
4. dbiometric information in relevant circumstances
5. eother legally protected special-category information.

VMT will only process special-category data where a lawful condition applies.

VMT might process health or accessibility information where necessary to:

1. aprovide a requested service
2. bassess reasonable safety requirements
3. ccommunicate necessary information to a supplier
4. darrange appropriate assistance
5. erespond to an emergency
6. fcomply with a legal obligation
7. gestablish, exercise or defend legal claims
8. hotherwise comply with applicable law.

VMT will seek explicit consent where required and where another appropriate legal condition does not apply.

VMT will not request sensitive information without a legitimate reason.

VMT might process information concerning children where a child participates in a booking.

VMT will collect only information reasonably necessary for the relevant service.

Where consent is relied upon for an online service directed to a child, VMT will comply with applicable age and parental-consent requirements.

Parents, guardians or persons with parental responsibility should provide accurate information concerning minors.

VMT will apply additional safeguards where reasonably necessary.

VMT might collect information directly from an individual.

VMT might also receive information from:

1. aa parent or guardian
2. banother traveller in the same booking
3. ca travel agent
4. da corporate customer
5. ea supplier
6. fan accommodation provider
7. ga transport provider
8. han activity operator
9. ia payment provider
10. ja website service
11. ka publicly available source
12. lanother person acting lawfully on the traveller's behalf.

VMT processes personal data for purposes including:

1. aresponding to enquiries
2. bcreating quotations
3. ccreating bookings
4. dadministering contracts
5. eproviding travel services
6. fcommunicating with travellers
7. gcoordinating suppliers
8. hprocessing payments
9. iadministering refunds
10. jhandling cancellations
11. kmanaging complaints
12. lmanaging emergencies
13. msafeguarding travellers
14. npreventing fraud
15. omaintaining business records
16. pcomplying with legal obligations
17. qdefending legal claims
18. renforcing contractual rights
19. simproving services
20. twebsite security
21. uwebsite analytics
22. vmarketing where legally permitted
23. wmaintaining customer relationships
24. xbusiness administration.

VMT will identify an appropriate lawful basis for each processing activity.

Depending on the circumstances, VMT might rely on:

1. aperformance of a contract
2. bsteps taken at the individual's request before entering into a contract
3. ccompliance with a legal obligation
4. dlegitimate interests
5. econsent
6. fvital interests
7. ganother lawful basis recognised by applicable law.

VMT will not rely on consent where another lawful basis provides the appropriate legal foundation.

Where VMT relies on legitimate interests, VMT will consider whether the interests are lawful, necessary and balanced against the individual's rights.

The Data (Use and Access) Act 2025 introduced changes to the UK framework concerning recognised legitimate interests and compatible further processing. VMT will apply the amended UK framework where relevant.

VMT will process personal data where necessary to:

1. aprovide a quotation
2. benter into a booking
3. cadminister a booking
4. dprovide contracted services
5. ecommunicate necessary travel information
6. fcoordinate suppliers
7. gadminister amendments
8. hadminister cancellations
9. iprocess refunds
10. jprovide assistance.

Where processing is necessary to perform a contract, refusing to provide required information might prevent VMT from providing the relevant service.

VMT might process personal data to comply with legal obligations.

Such obligations might concern:

1. aaccounting
2. btaxation
3. cfinancial records
4. dfraud prevention
5. eimmigration requirements
6. fhealth and safety
7. gsafeguarding
8. hlaw enforcement
9. icourt orders
10. jregulatory requirements.

VMT might rely on legitimate interests for purposes such as:

1. afraud prevention
2. binformation security
3. cnetwork security
4. dbusiness administration
5. eservice improvement
6. fdirect marketing where legally permitted
7. gdebt recovery
8. hdefending legal claims
9. ienforcing contractual rights
10. jmaintaining business records
11. kmanaging supplier relationships.

VMT will assess whether the processing is necessary and proportionate.

VMT will consider an individual's rights and reasonable expectations.

Where VMT relies on consent, consent will be requested through an appropriate mechanism.

Consent must be freely given, specific, informed and capable of being withdrawn.

Withdrawal of consent does not invalidate processing carried out lawfully before withdrawal.

Withdrawal of consent does not affect processing supported by another lawful basis.

VMT might send marketing communications concerning:

1. aMorocco tours
2. btravel services
3. cspecial offers
4. ddestinations
5. etravel information
6. fnew services
7. grelevant company updates.

VMT will comply with applicable direct-marketing requirements.

Electronic direct marketing will comply with PECR where PECR applies.

Marketing consent will be obtained where legally required.

VMT will provide a straightforward method to unsubscribe.

Each marketing communication will provide an appropriate opt-out mechanism where required.

Where permitted by law, VMT might use an existing customer relationship to send marketing concerning similar services.

VMT will comply with applicable soft-opt-in requirements.

VMT will provide an appropriate opportunity to opt out.

VMT will not assume that being a previous customer gives unlimited permission for marketing.

VMT might send essential service communications without relying on marketing consent.

Service communications might include:

1. abooking confirmations
2. bpayment reminders
3. citinerary information
4. dschedule changes
5. esafety information
6. femergency information
7. gcancellation notices
8. hoperational messages
9. ilegal notices.

Service communications are distinct from direct marketing.

VMT uses cookies and similar technologies where necessary and appropriate.

Cookies might collect information concerning:

1. adevice type
2. bbrowser
3. cIP address
4. dwebsite activity
5. epreferences
6. fsession information
7. ganalytics information
8. hmarketing interactions.

VMT will provide appropriate information about cookies.

Non-essential cookies and similar technologies will require consent where applicable law requires consent.

Strictly necessary technologies might operate without consent where the applicable legal exemption applies.

PECR requires clear information and consent for non-exempt cookies and similar technologies.

Continuing to browse the website does not itself constitute valid consent where active consent is required.

VMT will provide an appropriate mechanism for managing non-essential cookie preferences.

VMT might use:

1. astrictly necessary cookies
2. bfunctionality cookies
3. canalytics cookies
4. dperformance cookies
5. eadvertising or targeting technologies.

VMT will only use categories relevant to the website's actual configuration.

VMT will maintain a cookie inventory separately from this Policy where necessary.

The cookie inventory should identify:

1. acookie name
2. bprovider
3. cpurpose
4. dcategory
5. eduration
6. ffirst-party or third-party status
7. gconsent requirement.

VMT might use analytics services to understand website performance.

Analytics might provide information concerning:

1. apages viewed
2. bapproximate location
3. cdevice
4. dbrowser
5. ereferral source
6. fsession information
7. ginteractions.

Where analytics technology requires consent under applicable law, VMT will obtain consent before activating the relevant technology.

VMT will not describe non-essential analytics as “strictly necessary” merely because analytics are useful to VMT.

Third-party analytics providers might process information under their own terms and privacy documentation.

For visitors in the United Kingdom, and in other countries outside the European Union, the European Economic Area and Switzerland, VMT uses Google Analytics only to produce statistics that help VMT improve the website, as permitted by the Privacy and Electronic Communications Regulations 2003 as amended by the Data (Use and Access) Act 2025. Google signals and advertising features are switched off, and no advertising cookies are used.

Those visitors are told about these statistics when they first visit and can switch them off at any time, free of charge, using “Switch off” in the cookie notice or “Cookie settings” in the website footer. Switching them off stops measurement and removes the Google Analytics cookies.

Visitors in the European Union, the European Economic Area and Switzerland, and visitors whose location cannot be determined, are asked for consent before any analytics technology is activated.

VMT uses third-party providers to operate its business.

Such providers might include:

1. apayment processors
2. bemail providers
3. cwebsite hosting providers
4. dcloud storage providers
5. ebooking systems
6. fcustomer relationship systems
7. ganalytics providers
8. hcommunication platforms
9. iaccounting providers
10. jcybersecurity providers
11. ktravel suppliers
12. lIT support providers.

VMT will select processors and service providers according to appropriate risk and contractual requirements.

Where required by law, VMT will enter into appropriate data-processing arrangements.

VMT uses Brevo (Sendinblue SAS, France) to send the emails generated by the VMT website — the acknowledgement sent after an enquiry, the notification of that enquiry to VMT, and the welcome email and newsletters sent to subscribers — and to store newsletter subscribers' first names and email addresses. Brevo processes this data on VMT's behalf, under a data-processing agreement, in the European Union. Subscribers can unsubscribe at any time using the link in every newsletter or by emailing hello@visitmorocco.tours.

VMT might share traveller information with suppliers where necessary to provide booked services.

Suppliers might include:

1. ahotels
2. briads
3. ctransport providers
4. ddrivers
5. eguides
6. factivity operators
7. grestaurants
8. hexcursion providers
9. iemergency service providers.

VMT will share only information reasonably necessary for the relevant service, subject to applicable law.

VMT operates travel services in Morocco.

Personal data might therefore be transferred to or accessed from Morocco.

Personal data might also be processed by service providers located outside the UK or European Economic Area.

Where UK GDPR applies, VMT will use a lawful transfer mechanism where required.

Where EU GDPR applies, VMT will use an appropriate GDPR transfer mechanism where required.

Depending on the circumstances, safeguards might include:

1. aadequacy regulations or decisions
2. bstandard contractual clauses
3. cinternational data-transfer agreements
4. dUK Addendum mechanisms
5. eother lawful transfer mechanisms
6. fapplicable derogations where legally available.

VMT will not treat a transfer as lawful merely because a supplier is reputable.

Traveller information might be shared with Moroccan suppliers to deliver booked services.

VMT will apply appropriate contractual and organisational safeguards.

Where Moroccan data-protection law applies to particular processing, VMT will comply with applicable requirements.

VMT welcomes customers from the United States.

US privacy laws vary significantly between states.

Whether a particular US state privacy law applies depends on factors including:

1. aVMT's activities
2. bthe volume of data processed
3. crevenue
4. dthe number of consumers involved
5. ewhether VMT sells personal data
6. fwhether VMT conducts targeted advertising
7. gwhether VMT meets a relevant statutory threshold
8. hwhether an exemption applies.

VMT will assess applicable US state privacy requirements based on actual activities and applicable thresholds.

VMT does not represent that every US state privacy statute applies to every VMT customer.

Where a US state law gives an applicable customer specific privacy rights, VMT will provide those rights as required.

VMT does not sell personal data as part of its ordinary travel-booking business.

VMT will not use this statement to exclude any statutory definition of “sale”, “sharing” or equivalent concept where a particular state law applies.

VMT takes reasonable technical and organisational measures to protect personal data.

Measures might include:

1. aaccess controls
2. bauthentication
3. crestricted permissions
4. dsecure communications
5. esecure payment processing
6. fsupplier controls
7. gbackups
8. hdevice security
9. istaff confidentiality obligations
10. jincident-management procedures.

VMT limits access to personal data according to business need.

No online system provides absolute security.

VMT will respond to suspected data breaches according to applicable law.

VMT will investigate suspected personal-data breaches.

VMT will assess whether notification to a regulator, affected individuals or another authority is legally required.

Where applicable UK GDPR requires notification to the ICO, VMT will comply with the applicable deadline.

Where another jurisdiction imposes a separate breach-notification requirement, VMT will comply where applicable.

VMT will maintain appropriate records of relevant data incidents.

VMT retains personal data only for as long as reasonably necessary for the relevant purpose, subject to legal and regulatory requirements.

Retention periods depend on:

1. athe type of information
2. bthe purpose
3. ccontractual requirements
4. daccounting requirements
5. etax requirements
6. flimitation periods
7. glegal claims
8. hfraud prevention
9. isafeguarding
10. jregulatory requirements.

VMT will periodically review retained information.

Information no longer required will be securely deleted, anonymised or otherwise disposed of where appropriate.

VMT will retain booking and financial information for periods required by applicable accounting, tax and legal requirements.

VMT might retain booking records beyond the end of a trip where reasonably necessary to:

1. aestablish or defend legal claims
2. bresolve disputes
3. cmeet regulatory obligations
4. dprevent fraud
5. ecomply with accounting requirements.

Passport information will not be retained indefinitely.

VMT will delete or securely dispose of passport information when the relevant purpose has ended unless a lawful reason requires longer retention.

Where a supplier independently retains passport information, that supplier's own retention policy might apply.

Marketing information will be retained while the relevant marketing relationship or lawful basis continues.

VMT will periodically review marketing databases.

Unsubscribed individuals will not continue to receive marketing communications except where another lawful reason applies.

VMT might retain limited suppression information to ensure that an unsubscribe request is respected.

Depending on the applicable law, an individual might have rights including:

1. aright to be informed
2. bright of access
3. cright to rectification
4. dright to erasure
5. eright to restriction
6. fright to object
7. gright to data portability
8. hrights concerning automated decision-making
9. iright to withdraw consent where consent forms the lawful basis
10. jright to complain to a regulator.

An individual may request access to personal data held about them where the applicable law provides such a right.

Requests should be sent to: hello@visitmorocco.tours

VMT will verify the identity of the requester where reasonably necessary.

Identity verification protects against unauthorised disclosure.

VMT will normally respond within the applicable statutory period.

Where applicable law permits an extension because of complexity or volume, VMT will notify the requester as required.

Individuals may request correction of inaccurate personal data.

Individuals may request completion of incomplete information where appropriate.

VMT will update inaccurate information where the legal requirements for rectification are met.

Individuals might request deletion of personal data.

Erasure is not absolute.

VMT might lawfully retain information where necessary for:

1. alegal obligations
2. baccounting
3. ctaxation
4. dlegal claims
5. efraud prevention
6. fsafeguarding
7. gother lawful purposes recognised by applicable law.

Where VMT cannot erase information because a legal exception applies, VMT will explain the applicable reason where required.

Individuals might request restriction of processing where the applicable legal conditions apply.

Restriction might apply while:

1. aaccuracy is disputed
2. bprocessing is unlawful but deletion is opposed
3. cVMT no longer needs the data but the individual requires it for a legal claim
4. dan objection is under consideration.

Individuals may object to processing where the applicable law provides such a right.

Individuals have an absolute right to object to direct marketing under applicable UK and EU data-protection law.

VMT will stop direct marketing following a valid objection.

Other processing might continue where VMT has a lawful basis which permits continuation under applicable law.

Where applicable law provides a right to data portability, an individual may request personal data in a structured, commonly used and machine-readable format.

The right applies only where the statutory conditions are satisfied.

Portability does not apply to every category of personal data.

VMT does not ordinarily make decisions about travellers solely through automated processing.

Where VMT introduces automated decision-making which produces legal or similarly significant effects, VMT will comply with applicable requirements.

Where applicable law provides safeguards against solely automated decisions, VMT will provide those safeguards.

The Data (Use and Access) Act 2025 changed aspects of the UK rules concerning automated decision-making. VMT will apply the amended UK requirements where relevant.

VMT might use limited profiling for purposes such as:

1. awebsite analytics
2. bservice personalisation
3. cmarketing segmentation
4. dfraud prevention.

VMT will comply with applicable legal requirements.

VMT will not use profiling to make decisions with significant effects on individuals without an appropriate legal basis and required safeguards.

VMT provides a dedicated route for data-protection complaints.

Complaints should be sent to: hello@visitmorocco.tours

VMT will acknowledge a data-protection complaint within 30 days where the new UK statutory complaints requirements apply.

VMT will investigate appropriately and keep the complainant informed.

VMT will communicate the outcome of the complaint.

The new UK requirement took effect on 19 June 2026 and requires organisations to provide a clear complaint route, acknowledge complaints within 30 days, investigate appropriately and communicate the outcome.

UK individuals may complain to the Information Commissioner's Office where they believe their personal data has been handled unlawfully.

VMT encourages individuals to contact VMT first so VMT has an opportunity to investigate.

Contacting VMT first does not remove an individual's right to complain to the ICO.

ICO:

VMT will provide the current ICO contact information in its website privacy information where appropriate.

Where EU GDPR applies, an individual may complain to the relevant EU supervisory authority.

An individual might complain to the supervisory authority in:

1. atheir habitual residence
2. bplace of work
3. cplace of the alleged infringement,

subject to the applicable GDPR rules.

VMT will not prevent an individual from exercising this right.

Where Article 27 GDPR requires VMT to appoint an EU representative, VMT will make the required appointment.

Whether Article 27 applies depends on the nature and scale of VMT's EU-related processing.

VMT will publish representative details where legally required.

VMT will not claim that UK establishment alone prevents EU GDPR from applying.

VMT might disclose personal data where required by law or valid legal process.

Such disclosures might involve:

1. apolice
2. bcourts
3. cregulators
4. dimmigration authorities
5. etax authorities
6. femergency services
7. gother competent authorities.

VMT will assess requests for disclosure according to applicable law.

VMT might process personal data concerning guides, drivers, hotels, activity providers, agents and other suppliers.

Supplier information might be processed for:

1. acontracting
2. bpayment
3. cbooking
4. dcompliance
5. ecommunication
6. fsupplier management
7. gsafety
8. hfraud prevention.

If VMT sells, restructures or transfers part of its business, personal data might be transferred as part of the relevant transaction where legally permitted.

Any transfer will remain subject to applicable data-protection requirements.

VMT might maintain social-media accounts.

Interactions with social-media platforms might involve processing by those platforms.

Those platforms have their own privacy policies.

VMT will not control processing performed independently by a social-media platform.

VMT might collect technical information necessary to secure its website.

This might include:

1. aIP address
2. bbrowser information
3. cdevice information
4. dsecurity logs
5. eaccess times
6. ferror information.

Security information might be retained longer than ordinary analytics information where reasonably necessary to detect or investigate security incidents.

The VMT website might contain links to third-party websites.

VMT does not control those websites.

Third-party websites have their own privacy practices.

Travellers should review the privacy information of third-party websites before providing personal data.

VMT will seek to collect information adequate, relevant and limited to what is necessary for the relevant purpose.

VMT will avoid collecting sensitive information merely because it might become useful later.

This approach reflects the data-protection principles applying under the UK framework.

VMT seeks to keep personal data accurate.

Travellers should inform VMT of material changes to information relevant to their booking.

VMT will take reasonable steps to correct inaccurate information where required.

VMT expects personnel and contractors with access to personal data to maintain appropriate confidentiality.

Access will be limited according to role and business need.

Where VMT appoints a processor, VMT will require appropriate contractual safeguards where legally required.

Processors will process personal data according to documented instructions and applicable law.

VMT will take reasonable steps to select processors capable of providing appropriate security.

A Moroccan supplier might receive traveller information necessary to deliver a service.

A US-based or other international technology provider might process information as part of providing services to VMT.

VMT will assess applicable international-transfer requirements before using relevant providers.

Where processing relies on consent, consent may be withdrawn.

Withdrawal should be sent to: hello@visitmorocco.tours

VMT will stop consent-based processing unless another lawful basis applies.

Withdrawal does not affect processing carried out before withdrawal.

VMT might request reasonable information to verify identity before responding to a rights request.

VMT will avoid requesting unnecessary identity documents.

Information provided solely for identity verification will be handled securely.

An authorised representative may submit a request on another person's behalf where legally permitted.

VMT might request evidence of authority.

Parents, guardians and persons with legal authority may exercise rights on behalf of children where permitted by law.

A person must not request another individual's personal data without lawful authority.

VMT might refuse disclosure where disclosure would breach another person's privacy rights.

VMT might retain information necessary to establish, exercise or defend legal claims.

Such retention might continue beyond the ordinary operational retention period.

VMT will review such information when the legal purpose ends.

VMT might process personal data to detect and prevent:

1. apayment fraud
2. bidentity fraud
3. cbooking fraud
4. drefund fraud
5. emisuse of VMT services.

VMT might share relevant information with payment providers, suppliers, insurers, professional advisers or authorities where legally permitted.

Travellers may manage marketing preferences through the unsubscribe mechanism provided in communications.

A marketing unsubscribe request does not necessarily stop service communications.

VMT might retain a limited record of an unsubscribe request to prevent future unwanted marketing.

VMT might retain records showing cookie preferences.

Such records help VMT demonstrate compliance.

Consent records will be retained for an appropriate period.

VMT might update this Policy to reflect:

1. alegislative changes
2. bregulatory guidance
3. cchanges to VMT's services
4. dchanges to technology
5. echanges to suppliers
6. fchanges to cookies
7. gchanges to data-processing practices.

The latest version will be published on the VMT website.

Material changes will be communicated where required by law.

Nothing in this Policy requires an individual to waive a mandatory data-protection right.

Nothing in this Policy excludes liability or obligations which cannot legally be excluded.

General privacy enquiries: hello@visitmorocco.tours

Data-protection rights requests: hello@visitmorocco.tours

Data-protection complaints: hello@visitmorocco.tours

Postal correspondence:

This Policy takes effect on 12 August 2026.

VMT will review this Policy periodically and following material changes to applicable law.

This Policy is principally based on UK data-protection law.

Where another mandatory data-protection regime applies to particular processing, VMT will comply with that regime to the extent required.

Nothing in this Policy removes rights granted by mandatory law.