Legal
Privacy Policy
Last updated: 12 May 2026
1. Who we are
Tafoukt Surf Experience ("we", "us", "our") is a surf camp and school located in Imsouane Village, Chtouka Aït Baha Province, Morocco. We are the data controller for personal information collected through this website.
Contact: contact@tafouktsurfexperience.com
2. What data we collect
- Contact and booking enquiries: name, email address, phone number (optional), surf level, travel dates, group size, and any message you choose to include.
- Analytics: anonymised usage data via Google Analytics (pages visited, session duration, device type). No personally identifiable data is sent to Google Analytics.
- Cookies: Google Analytics sets cookies to distinguish unique visitors. No tracking cookies are set by Tafoukt itself.
We do not collect payment card details. All payments are handled outside this website.
3. Why we process your data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your booking enquiry | Art. 6(1)(b) — pre-contractual steps |
| Confirming and managing your booking | Art. 6(1)(b) — contract performance |
| Sending follow-up communications about your trip | Art. 6(1)(f) — legitimate interest |
| Improving our website via analytics | Art. 6(1)(f) — legitimate interest |
4. Who we share your data with
We use the following third-party processors. Each is bound by a data processing agreement:
- Resend (resend.com) — transactional email delivery to forward your enquiry to us.
- Sanity (sanity.io) — headless CMS for website content (no guest personal data stored in Sanity).
- Google Analytics(Google Ireland Ltd) — anonymised website analytics. Data may be transferred to the United States under Google's Standard Contractual Clauses.
- Vercel(Vercel Inc.) — website hosting. May process request metadata (IP address) in transit under Vercel's DPA.
We do not sell, rent, or share your personal data with any other third parties for their own marketing purposes.
5. Data retention
Enquiry and booking correspondence is retained for 24 months after your enquiry or last trip, after which it is permanently deleted. Analytics data is retained by Google Analytics for 14 months before automatic deletion.
6. International transfers
Morocco is not currently recognised as providing an adequate level of data protection under GDPR. When your data is processed by us in Morocco in order to fulfil your booking, we rely on Article 49(1)(b) of the GDPR (transfer necessary for the performance of a contract). For transfers to Resend and Vercel (United States), Standard Contractual Clauses apply.
7. Your rights
If you are located in the EEA or UK, you have the right to:
- Access the personal data we hold about you (Art. 15 GDPR).
- Rectify inaccurate data (Art. 16 GDPR).
- Erase your data ("right to be forgotten") where it is no longer necessary (Art. 17 GDPR).
- Object to processing based on legitimate interest (Art. 21 GDPR).
- Data portability — receive your data in a machine-readable format (Art. 20 GDPR).
- Withdraw consent at any time where processing is consent-based.
To exercise any of these rights, email contact@tafouktsurfexperience.com. We will respond within 30 days. You also have the right to lodge a complaint with the data protection authority in your country of residence.
8. Changes to this policy
We may update this policy from time to time. Material changes will be notified by updating the "last updated" date above. Continued use of the website after a change constitutes acceptance of the updated policy.