Privacy Policy

[LEGAL NOTICE TO CLIENT]: The following Privacy Policy provides a comprehensive operational structure covering data collection for tours, activities, customer accounts, payment gateways (PayPal & Stripe), and WhatsApp communication. This draft is subject to formal legal review and final approval by the client or legal counsel prior to formal certification.

1. Introduction & Overview

At Moroccan Luxury Desert Tours (“Timlalin Desert”, “we”, “us”, or “our”), we respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains what personal data we collect, why we collect it, how it is handled across reservations and customer accounts, and your rights under applicable data protection principles.

2. Information We Collect

When you browse our website, make an enquiry, register for an account, or book a tour or activity, we may collect the following categories of personal information:

• Identity & Contact Data: Full name, email address, telephone and WhatsApp number.
• Reservation & Logistics Details: Preferred dates, tour departure times, party size (number of adults and children), hotel or riad accommodation name in Agadir, Taghazout, or Tamraght, pickup address details, and special dietary or assistance requests.
• Customer Account Credentials: Username, email address, encrypted authentication hashes (stored exclusively using native WordPress security encryption algorithms; plain text passwords are never stored or accessible).
• Pre-Reservation Enquiries: Inquiries submitted via our “Make an Enquiry” feature, requested travel dates, itinerary preferences, and customer messages.
• Technical & Browsing Data: IP address, browser type, operating system, device details, and session timestamps collected automatically for system security, fraud detection, and CSRF protection.

3. Why We Collect Your Information & How It Is Used

We process personal data strictly for legitimate tourism operations and customer service purposes:

• Tour Coordination & Fulfillment: Scheduling certified native desert guides, reserving private transport, arranging dining provisions in desert camps, and ensuring seamless hotel pickup.
• Customer Account Administration: Allowing registered guests to view upcoming tour vouchers, access historical reservations, view past enquiries, and update their personal profiles.
• Enquiry Assistance: Providing tailor-made quotes, itinerary recommendations, and answers to questions prior to booking.
• Operational Updates: Contacting you via WhatsApp or email regarding driver dispatch, weather notifications, or meeting point updates.

4. Payment Processing & Security (PayPal, Stripe & Cash)

We implement strict financial security standards:

• No Payment Card Storage: We never store, capture, process, or view credit or debit card details on our WordPress website or database servers.
• Credit / Debit Cards (Stripe): All credit and debit card transactions are processed directly by Stripe using encrypted tokenization on PCI-DSS Level 1 compliant secure servers.
• PayPal: Online payments made through PayPal are securely authorized via the official PayPal Orders API v2. Transaction details are verified between our server and PayPal without exposing payment credentials.
• Cash on Arrival: For reservations choosing the cash payment option, no financial payment is charged online; payment is collected in cash (EUR, USD, or MAD) directly on the tour day.

5. Cookies & Session Storage

Our website utilizes necessary and functional cookies to ensure a smooth booking and account experience:

• Cart & Session Cookies: A secure, anonymized cookie token (mtb_cart_token) preserves your tour cart configuration across pages. The cart never stores prices on your device; all calculations occur authoritatively on our server.
• Currency Preferences: Remembers your chosen display currency (EUR, USD, or MAD).
• Account Authentication: Standard WordPress session cookies ensure secure authentication when you log into your My Account dashboard.

6. Data Sharing & Third-Party Services

We do not sell, rent, or trade your personal information. We disclose data solely to authorized service partners necessary to fulfill your travel experience:

• Local Drivers & Licensed Guides: Only necessary logistical information (your name, pickup hotel, passenger count, and contact phone) is provided to your assigned driver on the day of service.
• Payment Providers: Transaction data is securely transmitted to PayPal or Stripe as described above.
• Legal Obligations: Where required by Moroccan law or tourism authority regulations.

7. Data Retention

We retain booking and customer data only for as long as necessary to fulfill tourism services, meet legal and tax retention requirements under Moroccan commercial statutes, and manage customer accounts. Non-registered enquiry submissions may be retained for up to 24 months to assist returning travelers unless deletion is requested earlier.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access the personal information we hold about you.
• Right to rectify inaccurate or incomplete information.
• Right to request erasure of your data, subject to statutory record-keeping regulations.
• Right to object to or restrict certain processing activities.

Registered customers may review and update their profile details directly in the My Account portal at any time.

9. Contact & Privacy Inquiries

For any questions, requests, or privacy inquiries, please contact our Data Protection Coordinator:

• Email: contact@timlalindesert.com
• WhatsApp Assistance: +212 600 000 000 [Client official phone number required]
• Location: Timlalin Dunes, Agadir Region, Morocco