Privacy Policy

Who is responsible

The data controller is TEMPLATE SARL, 46, boulevard Zerktouni, 3ème étage, apt n° 6, Casablanca-Anfa, Morocco. For anything concerning your data, write to hello@templateexperiences.com.

We handle your data under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data. For guests resident in the European Union, we also apply the GDPR.

What we collect, and why

Booking a retreat

Your name, email, country, chosen dates, number of guests, surf level, whether you want a private room, and the amounts of your booking. We need this to hold your place, prepare your stay and honour the contract.

Health and dietary information

Only what you choose to tell us - an allergy, an injury, a dietary requirement. We use it to cook for you safely and adapt activities, we share it only with the host or chef concerned, and we delete it after your stay.

Contact and enquiry forms

Your name, email and message, used solely to answer you and, where relevant, to prepare a proposal.

Newsletter

Your email address, used to send occasional news about retreats. Consent only, withdrawable at any time.

Payments

The amount, currency, date and result of your payment, plus the reference Payzone gives it. We never receive your card number, expiry date or security code.

What we do not do

• We run no analytics, audience measurement or advertising tracker on this site.
• We do not sell, rent or trade your data.
• We do not use your data to profile you or to take automated decisions about you.
• We do not store card details - they never reach our servers.

Cookies

The public site sets no advertising or analytics cookies. The only cookies we use are the session cookies that keep the team signed in to the private administration area. They are strictly necessary to that area's operation, they are never set on your visit as a guest, and they require no consent banner.

Payzone may set its own cookies on its payment page during a transaction, under its own policy.

Who else processes your data

We use a small number of providers, each strictly to run the site and our bookings:

Supabase

Database hosting for content, bookings and enquiries. Servers in the European Union (AWS, Paris).

Vercel

Hosting and delivery of the site itself.

Payzone

Card payment processing, in Morocco. Receives your payment data directly; we receive only the result.

Our email provider

Delivery of the confirmation and notification emails attached to your booking or enquiry.

Some of these providers are established outside Morocco or outside the European Union. Transfers take place under the safeguards their own terms provide. We disclose data to no one else, except where the law obliges us to.

How long we keep it

• Bookings and the records attached to them: for the period required by accounting and tax law, currently ten years.
• Enquiries and messages that lead to no booking: three years from our last exchange.
• Health and dietary details: deleted after your stay.
• Newsletter subscriptions: until you unsubscribe.

Your rights

You may ask us at any time to give you a copy of the data we hold about you, correct it, delete it, restrict what we do with it, or object to a particular use. You may withdraw consent to the newsletter at any time without affecting anything else.

Write to hello@templateexperiences.com and we will answer within one month. If our answer does not satisfy you, you may complain to the CNDP in Morocco, or, if you live in the European Union, to the data protection authority of your country.

Security

The site is served over HTTPS. Access to bookings and enquiries is restricted to the team, protected by individual accounts and enforced at database level, so no visitor can read another guest's booking. Payment authentication uses 3D Secure.

Changes to this policy

We update this policy when what we do with data changes. The date at the top always reflects the current version. Questions are welcome at hello@templateexperiences.com.