Privacy policy
Last update: 16/10/2026 — Compliant with GDPR (EU) 2016/679
1. Data controller
Company: KESHLINKS VENTURES LTD
Address: 128 City Road, London, EC1V 2NX, United Kingdom
DPO email / GDPR contact: contact@moroccomuseum.com
2. Data collected
We collect the following data during your interactions with the site:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, surname | Ticket issuance, contact, commercial follow-up | Contract execution / legitimate interest |
| Email address | Confirmation, ticket delivery, newsletter | Contract execution / consent |
| Phone number | Commercial contact, booking follow-up | Consent (optional field) |
| Chosen visit date | Official ticket purchase | Contract execution |
| Payment data | Transaction processing | Contract execution (Stripe) |
| IP address | Commercial tracking, fraud prevention and security. Collected automatically on every form submission (contact, newsletter, community). | Legitimate interest |
| Browser & device (User-Agent) | Commercial tracking and technical analysis. Identifies the type of device, browser and operating system used. | Legitimate interest |
| Origin page (referrer) & URL | Analysis of visitor origin (e.g. search engine, social network, direct access) for commercial tracking and marketing optimisation. | Legitimate interest |
We do not collect sensitive data (health data, ethnic origin, religious beliefs, etc.).
3. Newsletter — Right to unsubscribe
If you subscribe to our newsletter, we use your email address exclusively to send you communications related to Morocco Museum news (new sites, cultural events, offers).
You can unsubscribe at any time via the link in each email or by contacting us at contact@moroccomuseum.com. Your unsubscription takes effect immediately.
4. Retention period
- Booking data (name, email, order): kept for 3 years from the order date, in accordance with legal accounting obligations.
- Payment data: not stored by Morocco Museum. It is processed directly and secured by Stripe Inc., subject to the PCI-DSS standard.
- Connection logs: kept for 12 months in accordance with applicable regulations.
5. Data recipients
Your data may be shared with the following third parties strictly within the scope of service provision:
- Stripe Inc. — payment processing, United States — GDPR guarantees via standard contractual clauses)
- Official cultural site operators (Moroccan Ministry of Culture, delegated operators) — only name and visit date, for ticket issuance
- Vercel Inc. — infrastructure hosting)
- Resend Inc. — email/newsletter sending service, United States — GDPR-compliant sub-processing agreement)
- Google LLC — Google Customer Reviews program, United States — only if, after a shop purchase, you agree to receive Google’s satisfaction survey: your email, order number, delivery country and estimated delivery date are shared with Google for that sole purpose)
We never sell your data to third parties for commercial purposes.
6. Your rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
To exercise your rights, contact us at contact@moroccomuseum.com. We will respond within one month.
7. Cookies
This site uses a minimal number of trackers. The first ones are strictly necessary for the service; audience measurement is only enabled with your consent:
Remember tickets added to the cart and the display currency you chose (EUR, GBP or USD).
Consent: Not required (strictly necessary)
Temporarily store buyer information during the order. Duration: session.
Consent: Not required (strictly necessary)
Remember your choice about non-essential trackers so you are not asked on every page.
Consent: Not required (strictly necessary)
Measure site traffic (page views, origin, usage). Provider: Google LLC (United States). No Google Analytics tag is loaded before you consent.
Consent: Required — you can withdraw it at any time via “Cookie settings” at the bottom of the page
No advertising is currently displayed on this site and no advertising tracker is used. If an advertising service (for example Google AdSense) is enabled, this policy will be updated and your consent will be requested before any advertising tracker is used. You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page.
8. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure: HTTPS connection, encryption of data in transit, restricted access to production data.
9. Third-party services, maps and affiliate links
Accommodation: some pages link to Booking.com through affiliate links (Commission Junction affiliate network). MoroccoMuseum.com may earn a commission if you book, at no extra cost to you. When you click such a link you leave our site: Booking.com and its affiliate network may set their own trackers and process your data under their own privacy policies. The booking, payment and cancellation terms are those of Booking.com and the property.
Maps: depending on the page, interactive maps load map tiles (OpenStreetMap) or Google Maps. Your browser then contacts these services, which receive, among other things, your IP address.
International transfers: several of our providers (Stripe, Vercel, Resend, Google) are located in, or process data in, the United States. These transfers rely on the safeguards provided by the GDPR, including standard contractual clauses where applicable.