Privacy Policy

This privacy policy applies to Marrakech Express Tour, a Marrakech-based tour operator specialising in private desert tours, day trips, and multi-day excursions across Morocco. When this document says "we," "us," or "our," we mean the company operating this website.

Our office and our data controller are based in Marrakech, Morocco. If you have any questions about how your personal data is handled, you can reach us anytime at contact@marrakechexpresstour.com.

We only collect what we need to operate the booking — nothing speculative, nothing sold on. The categories below cover everything we store about you.

You give us directly

• Booking details — your name, email address, phone number, the tour you booked, the date, the number of travellers, and any pickup address you provide.
• Communications — anything you send us through email, the contact form, WhatsApp, or our live chat.
• Reviews and photos — content you voluntarily submit after your tour, including your name and country of origin if you choose to include them.

Collected automatically

• Technical data — IP address, browser type, device, time zone, and the pages you visited. Used to keep the site fast and secure.
• Cookies — small files stored in your browser. See the dedicated section below.

Every piece of data has a single, specific job. Here is the full list:

• Run your booking — confirm your spot, share the meeting point, send weather updates, and pair you with the right guide and vehicle.
• Process your payment — securely via Stripe; we do not store card data on our servers.
• Customer support — answer your questions before, during, and after the tour.
• Service improvements — analyse anonymised usage data to fix bugs, speed up pages, and design better itineraries.
• Optional marketing — only with your consent, and only to share new tours, seasonal offers, and stories from our local guides. One-click unsubscribe in every email.
• Legal compliance — Moroccan tax records, anti-fraud checks, and any obligation we have as a licensed tour operator.

You can create a free account to manage your bookings, view your confirmations, and leave reviews. An account is optional — you can also book as a guest.

• What we store — your name, email address, an optional phone number, and the bookings linked to your account.
• How you sign in — with a one-time secure link sent to your email address, or with an email and a password you choose.
• Passwords — stored only as a secure one-way hash. Nobody on our team can read your password.
• Email verification — new accounts confirm their email address with a link we send, so nobody can register using someone else’s address.

You can update your details, change your password, or ask us to delete your account at any time from your account page or by contacting us.

Cookies are tiny files that let the site remember things between page loads. We keep their use minimal and disclose every category here.

• Strictly necessary — your currency choice (EUR / USD / MAD), the items in your booking flow, your login session for the customer dashboard. The site cannot function without these.
• Performance — anonymous page-speed and error data that helps us spot broken flows.
• Analytics — aggregated browsing data via Google Analytics (used only with your consent).

You can clear or block cookies in your browser settings at any time. Some of the booking features may stop working if you block the strictly-necessary category.

We do not sell or rent your personal data. We do share the minimum strictly necessary with a small, hand-picked list of service providers.

• Stripe (United States / Ireland) — payment processing. stripe.com/privacy
• Google Maps / OpenStreetMap — interactive maps on tour pages and pickup-zone previews.
• Email delivery — transactional confirmations sent via a reputable provider that signs your delivery with SPF / DKIM.
• Hosting — the website is hosted on a managed WordPress platform with daily encrypted backups and a Web Application Firewall.

No matter where you live, you can ask us at any time to:

• Access — get a copy of the personal data we hold about you.
• Correct — fix any inaccuracy.
• Delete — erase your data, subject to legal record-keeping duties.
• Restrict or object — limit how we process your data, or opt out of marketing emails.
• Port — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, for any consent-based processing.

Your data is encrypted in transit (HTTPS / TLS 1.2+) and at rest. Access to our admin systems is restricted to a small team, protected by strong passwords and two-factor authentication.

We keep booking records for the period required by Moroccan tax and accounting law (typically 10 years). Reviews stay on the site as long as the underlying tour exists. Marketing-list entries are deleted on unsubscribe.

Our tours welcome children when a parent or guardian books on their behalf and accompanies them throughout the trip. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

When we make a material change, we update the "Last updated" date at the top of this page and — if you have an active booking — let you know by email. Continued use of the site after a change means you accept the revised policy.