Privacy policy

In short

• We collect only what you type into our forms, and only to answer you and follow up your request.
• We do not sell your data. There is no advertising on this site, no advertising tracker and no social-media pixel.
• Your details are kept in our client system, which runs on Google services, so they are processed outside Morocco.
• You can ask to see, correct, delete or object to your data at any time, by WhatsApp.

1. Who is responsible for your data

The controller (responsable du traitement) is:

• Casanova Estates (trading as Casanova Estates and Casanova Stays), Marrakech, Morocco
• Contact: WhatsApp +212 660 277 779

We have not appointed a data protection officer.

2. Which laws apply

We are established in Morocco, so Moroccan Law no. 09-08 on the protection of individuals with regard to the processing of personal data applies. Because we address visitors in Europe, we also follow the EU General Data Protection Regulation (GDPR) for visitors in the EU and EEA.

3. What we collect, why, and on what basis

We collect nothing about you except what you choose to send us through the forms below, plus the anonymous statistics described in section 12. There is no account to create and no payment on the site. We do not collect identity documents through the site.

Enquiry form. Data: your name, your e-mail address or WhatsApp number (one of the two is enough), what you are interested in, and your message. Purpose: to reply to you and follow up your request. It is sent to our team and recorded in our client system.

Stays booking request. Data: the villa, your dates, number of guests, your name, WhatsApp number, e-mail address (optional) and message. Purpose: to check availability and answer your request; our team confirms or declines on WhatsApp. The request is recorded in our client system, which is a Google Sheets file.

Call booking. Data: your name, WhatsApp number, e-mail address (optional), what you are interested in, your budget and a message. Purpose: to hold the slot you chose and call you on WhatsApp at that time. The booking appears as an event in our Google Calendar.

If you contact us on WhatsApp or Instagram. We see your number or profile name and your messages, and we keep the conversation to follow up. WhatsApp and Instagram are run by Meta and handle your data under their own terms.

Technical logs. Like any website, our server may keep a short technical record of connections (such as date, page requested and IP address) to keep the site secure and working. This record is kept for a few weeks at most (the logs overwrite themselves) and is not used for anything else.

Required or optional. Your name and one way to reach you are required, because we cannot answer without them. Everything else is optional. Please do not send identity-card or passport numbers, bank details, or health or other sensitive information.

Legal bases. Answering your enquiry, booking request or call request is a step taken at your request before a possible contract, and then the performance of that contract (GDPR Art. 6(1)(b)). Keeping a record of our business relationship rests on our legitimate interest in running and following up our business (Art. 6(1)(f)). Keeping records that the law requires, such as accounting records, rests on a legal obligation (Art. 6(1)(c)). Where Moroccan law asks for your consent, in particular to share your details with Google, we ask for it on the form.

We do not use your details for marketing messages unless you agree separately and clearly. You can withdraw that consent at any time.

We do not take decisions about you by automated means, and we do not profile you.

4. Who receives your data

• Our team members who handle your request.
• Google, which provides the Sheets and Calendar services we use. Google acts on our behalf as a service provider (processor) and may not use your data for its own purposes under its terms with us.
• Hostinger, which hosts the server on which this site and its forms run.
• Meta (WhatsApp, Instagram) if you contact us there, under its own terms.
• A third party such as a villa owner, a notary or a bank only if you ask us to involve them or agree to it, and only the details needed for that purpose.
• Public authorities, where the law requires it.

We do not sell or rent your data.

5. Transfers outside Morocco

Google processes data on servers outside Morocco, including in the United States, so your details are transferred and processed outside Morocco. Our site itself runs on a virtual server rented from Hostinger.

Safeguards: our transfers are covered by Google’s Cloud Data Processing Addendum, which includes the EU standard contractual clauses, and, where it applies, by the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.

Where a form asks you to tick a box to agree, you also expressly agree to this transfer.

6. How long we keep your data

We keep data only as long as we need it for its purpose, as in the table below.

7. How we protect your data

We take reasonable technical and organisational measures: encrypted connections (HTTPS), access limited to authorised team members, and keeping only the data we need.

No system is perfectly safe. In particular, data sent over an open network such as the internet may circulate without security guarantees (Law 09-08, Art. 5).

If a breach puts your data at risk, we will tell the people concerned and the authorities as the law requires.

8. Your rights

Under Law 09-08 you have the right to access your data, to have it corrected, updated or erased, and to object, on legitimate grounds, to its processing. You may object at any time and free of charge to being contacted for marketing.

If the GDPR applies to you, you also have the right to restrict processing, to receive your data in a portable format (data you gave us, processed by automated means on the basis of contract or consent), and to withdraw any consent at any time, without affecting what was done before.

How to use your rights. Send a WhatsApp message to +212 660 277 779, saying what you wish. It is free.

We will answer within 30 days. If we need to check who you are, we will ask for proportionate proof, such as a message from the contact detail you gave us.

9. Complaints

If you think we did not respect your rights, please write to us first. You may also complain to the Moroccan authority: Commission nationale de contrôle de la protection des données à caractère personnel (CNDP), www.cndp.ma.

If you live in the EU or EEA, you may also complain to the data protection authority of your country of residence or work, or of the place where you think the problem occurred.

10. Children

This site is for adults. We do not knowingly collect data from anyone under 18. If you think a minor has sent us data, tell us and we will delete it.

11. Changes to this policy

We may update this policy, for instance if we add new tools or if the law changes. The date at the top shows the latest version. Before we use advertising tools, we will update this policy, including section 12, and ask for your consent first.

12. Cookies and statistics

No cookies. This site does not set any cookie. The only thing it stores in your browser is the language you choose, so that the site opens in that language next time. This is stored at your request and is strictly necessary for that; it is used for nothing else, and nothing else is kept on your device.

What we do not use. No Google Analytics, no advertising trackers, no social-media pixels, no embedded maps or videos, no chat widget. Our fonts are served from our own server. The links to WhatsApp and Instagram are plain links; they load nothing until you click.

What we measure. We measure how the site is used with a self-hosted, cookie-less tool that runs on our own server, to count visits and see which pages and buttons are useful. In detail:

• It puts nothing on your device and reads nothing from it.
• It does not store your IP address, and it does not build a browser fingerprint. (The technical logs in section 3 are separate.)
• To count visits without recognising you, it uses an anonymous counter that changes every day. We cannot link it to you, nor follow you from one day to the next.
• It records only: the page viewed, the website you came from (the referrer host), your language, your approximate country (taken from your browser’s time zone, not from your IP address), and whether you use a phone or a desktop.
• Data stays on our server, is seen only by us, and is not shared or combined with our client system or your enquiries.
• Raw data is deleted after 6 months.

Purpose and basis. Understanding how the site is used so that we can improve it, on the basis of our legitimate interest, with no profile of any person built. This measurement does not need your consent under the Moroccan CNDP simplified model for audience measurement.

How to opt out. If your browser sends Do Not Track or Global Privacy Control, your visit is not measured.

Because the only thing stored on your device is the language you choose yourself, and no profile is built, we do not show a cookie banner.

If we start advertising later. If we ever add advertising tools or social-media tools that use cookies or similar technology, we will first update this section and the rest of this policy and ask for your consent through a banner where “Accept” and “Refuse” are equally easy, load nothing before you agree, and let you change your mind at any time.