Privacy Policy
Get Salty Morocco

Last updated: 16 October 2026

1. Who we are

Get Salty Morocco is a locally owned surf camp and guesthouse in Tamraght, Morocco, offering surf weeks, surf weekends, custom stays, yoga and creative retreats. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit getsaltymorocco.com, contact us, book a stay or stay with us.

The data controller responsible for your personal data is:

Item

Details

Legal name

Disconnect Travel SARL

Trading name

Get Salty Morocco (“Get Salty”, “we”, “us”, “our”)

Registered address

Hay Tissaliouine, Tamraght, Aourir, Agadir, Morocco

Trade register (RC)

57865

ICE

003424261000018

Email

contact@getsaltymorocco.com

WhatsApp

+212 641 749 938

We process personal data in accordance with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and its implementing Decree No. 2-09-165. Where you are in the European Union, the European Economic Area or the United Kingdom, we also apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR, because we offer our services to guests there.

2. Scope of this policy

This policy covers personal data we process about:

  • visitors to getsaltymorocco.com;
  • people who send a booking request through our website, WhatsApp, Instagram or email;
  • guests who stay with us, including each member of a group booking;
  • people who follow or message us on social media or leave us a review.

If you book for other people (for example friends or family in your group), you confirm that you have their permission to share their data with us and that you have shown them this policy.

This policy does not cover third-party websites or services we link to, such as WhatsApp, Instagram or Google. Their own privacy policies apply.

3. Personal data we collect

We collect only the data we need to answer you, run your stay safely and meet our legal duties.

Category

Examples

Identity and contact data

Full name, email address, phone number with country code, WhatsApp name and profile picture, Instagram username

Booking request data

Number of surfers, chosen package (Surf Week, Surf Weekend, Custom Stay), room type (shared or private), check-in and check-out dates, surf level, your message

Stay and travel data

Flight number and arrival/departure times for airport transfers, chosen excursions and add-ons (cooking class, quad, camel ride, scooter or car rental), room allocation

Guest registration data

A copy of your passport and the details on it (name, nationality, date of birth, passport number), your home address and your dates of stay. Moroccan law requires us to record these in our guest register and report them to the police; we use them for no other purpose

Payment data

Deposit (20% to 30% of the booking) and balance amounts, payment method (Stripe or bank transfer to our company account), transaction references and invoice details. Card payments are processed by Stripe; we never see or store your full card number

Health and dietary data

Diet, food allergies, injuries or medical conditions you choose to tell us about in our booking form or in person, so we can adapt meals and activities to you

Images

Photos and videos taken by our photographer or filmmaker during retreats, only with your agreement (see section 5)

Communications

Messages, voice notes and files you send us by WhatsApp, email, Instagram or the website form, and your feedback

Technical data

IP address, browser type, device type, pages visited, date and time of visit, collected through server logs and the cookies described in section 6

Reviews

Your public name, photo and review text if you review us on Google or another platform

Special categories of data. Health information is sensitive data under Law 09-08 and the GDPR. We collect it only with your explicit consent, or where it is needed to protect your vital interests in an emergency. We use it only to keep you safe and feed you properly, and share it only with the staff and instructors who need it.

Data you do not have to give. You can browse our website without giving us any personal data. Fields marked as required in our booking form are needed to answer your request; if you do not provide them, we may not be able to confirm your booking. Guest registration data is a legal requirement for staying with us.

4. How we collect your data

  • Directly from you, when you fill in our booking form, message us on WhatsApp or Instagram, email us, fill in your guest registration on arrival or talk to our team during your stay.
  • From the person who booked for you, if you are part of a group booking.
  • Automatically, when you visit our website, through server logs and the technologies described in section 6.
  • From third parties, such as public review platforms (Google), social networks when you tag or mention us, and booking platforms such as Booking.com or Airbnb, if you book through them.

We use your data only for the purposes below. Each has a legal basis under Law 09-08 (Article 4) and, where it applies, Article 6 of the GDPR.

Purpose

Data used

Legal basis

Answer your booking request, check availability and send you a quote

Identity, contact, booking request, communications

Steps taken at your request before a contract; our legitimate interest in answering enquiries

Confirm and manage your booking, take your deposit and balance, issue invoices

Identity, contact, booking, payment

Performance of our contract with you

Deliver your stay: rooms, meals, surf lessons, equipment, transfers, excursions and add-ons

Booking, stay and travel data

Performance of our contract with you

Adapt meals and activities to your diet, allergies, injuries or medical conditions

Health and dietary data you share with us

Your explicit consent, given when you share it; protection of your vital interests in an emergency

Record your stay in our guest register and report it to the police

Passport copy and guest register data

Compliance with our legal obligations under Moroccan law

Keep accounting and tax records

Payment and invoice data

Compliance with our legal obligations under Moroccan law

Communicate with you before, during and after your stay

Contact data, communications

Performance of our contract; our legitimate interest in good guest service

Ask for feedback or a review after your stay

Contact data

Our legitimate interest in improving our services; you can opt out at any time

Take photos and videos during retreats and share them on our website and Instagram

Images

Your consent, asked at the start of each retreat. If any guest says no, we do not film or photograph that week’s group

Send you our newsletter or blog updates, if we launch them

Contact data

Your consent when you sign up (Law 09-08, Article 10); you can unsubscribe at any time

Show you our ads on Google, Facebook and Instagram, and measure how our ads perform

Technical and cookie data

Your consent through our cookie banner

Run, secure and improve our website, and prevent fraud or abuse

Technical data

Our legitimate interest in a safe, working website

Establish, exercise or defend legal claims

Any relevant data

Our legitimate interest; compliance with legal obligations

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 10).

Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

6. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. Our website uses only a limited number of them.

Type

Purpose

Provider

Consent needed?

Strictly necessary

Make the website, booking form and cookie banner work, remember your cookie choices and keep the site secure

Get Salty (WordPress, Elementor), Hostinger

No

Reviews widget

Display our Google reviews

Trustindex, Google

Yes, where it sets non-essential cookies

Fonts

Display our website fonts

Google Fonts

No cookies are set, but your IP address may be sent to Google to load the fonts

Tag management

Load the advertising tags below, according to your cookie choices

Google Tag Manager

No cookies of its own; it loads other tags only with your consent

Advertising (Google)

Measure the results of our Google ads and show our ads to people who visited our website

Google Ads (Google)

Yes

Advertising (Meta)

Measure the results of our Facebook and Instagram ads and show our ads to people who visited our website

Meta Pixel (Meta Platforms)

Yes

We load Google Ads and Meta Pixel cookies, and other non-essential cookies, only after you accept them in our cookie banner. You can change or withdraw your choice at any time by reopening the cookie banner on our website, or by deleting cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the website, such as the booking form, from working.

When you click our WhatsApp or Instagram links, you leave our website, and Meta’s own cookie and privacy policies apply.

7. Who we share your data with

We share your data only when needed for the purposes in section 5, and only as much as each recipient needs.

Recipient

Why

Location

Our team: owners, reception, cooks, surf and yoga instructors, drivers, and our photographer or filmmaker

To run your stay and keep you safe

Morocco

Local activity partners (excursion guides, quad, camel ride, scooter or car rental, cooking class)

To book and deliver the add-ons you choose; usually your name, group size and dates only

Morocco

Hostinger (website hosting and email) and Vowel Agency (website design and maintenance)

To host and maintain our website, booking form and email

Hostinger servers outside Morocco

WhatsApp and Instagram (Meta Platforms)

To exchange messages with you

EU / United States

Advertising partners: Google (Google Ads, Google Tag Manager) and Meta (Meta Pixel)

To show and measure our ads, only if you accept advertising cookies

EU / United States

Trustindex and Google

To display reviews on our website

EU / United States

Stripe and our bank

To process deposits, payments and refunds

Stripe: EU / United States; our bank: Morocco

Accountants and legal advisers

To keep our books and protect our rights

Morocco

Public authorities (police, Gendarmerie Royale, tax authority, courts)

To report guest stays to the police as Moroccan law requires, or to respond to a lawful request

Morocco

Emergency services and medical providers

To help you in an emergency

Morocco

A buyer or successor of our business

If our business is sold or restructured, under equivalent privacy protections

Morocco

Our service providers act on our instructions as processors. They are bound by contract to keep your data confidential and secure and may not use it for their own purposes. Meta and Google may act as independent controllers of the data they process through their own platforms.

8. International data transfers

We are based in Morocco, so when you contact us from abroad, your data comes to Morocco. Some of our service providers, such as WhatsApp, Instagram, Google, Meta, Stripe and Hostinger, store or access data in other countries, including the United States and the European Union.

When we transfer data outside Morocco, we comply with Articles 43 and 44 of Law 09-08. We transfer data only to countries the CNDP recognises as offering adequate protection, or with the CNDP’s authorisation, or where the transfer is necessary to perform our contract with you or you have consented to it.

For guests in the EU, EEA or UK, Morocco is not covered by an adequacy decision of the European Commission. We protect your data with the measures in this policy and, where our providers transfer it onward, rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask us for details of these safeguards using the contact details in section 16.

9. How long we keep your data

We keep your data only as long as we need it for the purpose it was collected for, or as long as the law requires. Then we delete or anonymise it.

Data

Retention period

Booking requests that do not lead to a booking

12 months after our last exchange

Booking, invoice and payment records

10 years after the end of the financial year, as required by Moroccan accounting and commercial law

Guest registration data

For the period set by the Moroccan authorities, then deleted

Health, dietary and emergency contact data

Deleted within 30 days after your stay ends, unless needed for an incident or claim

WhatsApp, email and Instagram messages

24 months after our last exchange

Marketing consent and contact list

Until you unsubscribe or withdraw consent; inactive contacts are removed after 3 years

Photos and videos used with your consent

Until you withdraw your consent; content already published may remain in archived posts we cannot reasonably remove

Website server logs

Up to 12 months

Cookies

As listed in our cookie banner, and no longer than 13 months

Data needed for a legal claim

Until the claim is resolved and limitation periods have expired

10. Your rights

Under Law 09-08 you have the right to be informed, the right of access, the right to rectification and the right to object, including the right to refuse direct marketing. If the GDPR or UK GDPR applies to you, you have all of the following rights.

Right

What it means

Information

Be told clearly how your data is used; this policy does that

Access

Get a copy of the personal data we hold about you

Rectification

Have inaccurate or incomplete data corrected

Erasure

Have your data deleted when we no longer need it or have no legal basis to keep it

Restriction

Ask us to limit how we use your data while a complaint or correction is checked

Objection

Object to processing based on our legitimate interests, and to direct marketing at any time

Portability

Receive data you gave us in a structured, machine-readable format, or have it sent to another provider

Withdraw consent

Withdraw consent at any time, for example for marketing, photos or health data

Complaint

Complain to the CNDP in Morocco or to your local data protection authority (section 16)

How to exercise your rights. Write to contact@getsaltymorocco.com or message us on WhatsApp at +212 641 749 938. Tell us which right you want to use. We may ask you to confirm your identity before we act, to protect your data.

We will reply within one month. If your request is complex, we may extend this by up to two further months and will tell you why. Exercising your rights is free, unless a request is clearly unfounded or excessive.

Some rights have limits. For example, we cannot delete data we must keep by law, such as invoices or guest registration records.

11. How we protect your data

We take appropriate technical and organisational measures, as required by Article 23 of Law 09-08 and Article 32 of the GDPR, to protect your data against loss, misuse, unauthorised access, alteration and disclosure. These include:

  • an encrypted (HTTPS) connection on our website;
  • password-protected accounts with two-factor authentication on our email, WhatsApp Business and website administration;
  • end-to-end encryption on WhatsApp messages;
  • paper guest registration forms and passport copies kept in a locked place, with access limited to authorised staff;
  • access to health and dietary data limited to staff who need it for your safety and meals;
  • confidentiality commitments from our staff and contracts with our service providers;
  • regular updates of WordPress, our theme and plugins, and regular backups.

No website or transmission over the internet is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the competent authorities as the law requires.

12. Children and minors

Our website and booking form are intended for adults. We do not knowingly collect personal data directly from anyone under 18; a parent or legal guardian makes the booking and gives us the child’s data.

Children aged 2 and over may stay with us when a parent or guardian is present. Young people aged 15 to 17 may stay without a parent if a parent or guardian signs a written agreement with us, which covers their consent for activities and any health information we need. We do not publish photos or videos of minors without written consent from a parent or guardian.

If you believe a child has given us personal data without a parent’s consent, contact us and we will delete it.

13. Marketing messages

We do not currently send marketing emails or messages. If we launch a newsletter or blog updates, we will send them only to people who sign up and agree to receive them, as Article 10 of Law 09-08 requires.

If you subscribe, you can stop these messages at any time, free of charge, by:

  • clicking “unsubscribe” in any email;
  • replying “STOP” to a WhatsApp or SMS message;
  • writing to contact@getsaltymorocco.com.

You will still receive service messages about a booking you have made.

Our website links to WhatsApp and Instagram and displays Google reviews through a Trustindex widget. When you use these services, their providers collect data under their own privacy policies, which we do not control:

If you message, tag or mention us on social media, we see the data you choose to share there. Reviews you post on Google are public; we display them on our website as published, with your public name and profile photo. To have your review removed from our website, delete or edit it on Google or contact us.

15. Changes to this policy

We may update this policy when our services, tools or the law change. The “Last updated” date at the top shows when it was last revised. If we make significant changes, such as using your data for a new purpose, we will tell you by email or WhatsApp, or with a notice on our website, and ask for your consent where the law requires.

16. Contact us and complaints

For any question about this policy or your data, contact us first. We will do our best to resolve your concern.

  • Email: contact@getsaltymorocco.com
  • WhatsApp: +212 641 749 938
  • Post: Disconnect Travel SARL, Hay Tissaliouine, Tamraght, Aourir, Agadir, Morocco

You also have the right to complain to a data protection authority: