Privacy Policy

We may collect the following information: first and last name, ID document number, email address, phone number, postal address, booking information, stay preferences, payment information, browsing data, IP address.

Some data may be collected automatically via cookies.

The ID document number presented on arrival as part of the police registration form is processed separately, solely for declaration to the competent authorities, as required by law. This processing is distinct from the purposes described in point 2 below.

The data collected is used to: manage bookings, ensure client follow-up, personalize the user experience, respond to client requests, send information related to the stay, improve our services, comply with our legal obligations.

Data processing is based on: performance of the booking contract, client consent, applicable legal obligations, the legitimate interest of the establishment.

Data may only be shared with: our technical service providers, our payment providers, competent authorities where required by law.

No personal data is sold to third parties.

Data is retained only for as long as necessary for the purposes for which it was collected, unless otherwise required by law.

Booking data is retained for 3 years after the last contact (excluding separate accounting/tax obligations). Browsing data is retained for a maximum of 13 months. Prospecting data is retained for 3 years after the last active contact, with automatic deletion in the absence of interaction. For example, the copy of the ID document collected as part of the police registration form is destroyed within 48 hours maximum; the corresponding declarative data (declared identity, stay dates) is retained for a minimum of 3 years, in accordance with the applicable legal obligation.

Atlantis 12 implements appropriate technical and organizational measures to ensure the confidentiality and security of personal data.

In accordance with the GDPR and law 09-08, you have, among others: a right of access, a right of rectification, a right of erasure, a right to object, a right to restriction of processing, a right to data portability, a right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal, the right to lodge a complaint with the competent supervisory authority (the CNDP for Morocco, or the data protection authority of your country of residence if you reside in the European Union).

To exercise your rights: contact@atlantis12essaouira.com

All data processed by our provider FicheSafe/Softnexia as part of identity verification is hosted exclusively within the European Union (OVHcloud, France), including during the 48-hour window in which the ID scan is destroyed.

No administrative or maintenance access to this provider is carried out physically from a country located outside the European Union. No transfer of data outside the European Union occurs in connection with this processing.

This policy may be amended at any time to reflect legal or technical developments.

For any questions regarding the protection of personal data: contact@atlantis12essaouira.com