Template document to be validated by a lawyer before actual publication. Information in brackets […] must be completed with the company's real details.
Privacy policy
Last update: [DD/MM/YYYY] — Compliant with GDPR (EU) 2016/679
1. Data controller
Company: [Company name Ltd]
Address: [Full address, United Kingdom]
DPO email / GDPR contact: contact@moroccomuseum.com
2. Data collected
We collect the following data during your interactions with the site:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, surname | Ticket issuance, contact, commercial follow-up | Contract execution / legitimate interest |
| Email address | Confirmation, ticket delivery, newsletter | Contract execution / consent |
| Phone number | Commercial contact, booking follow-up | Consent (optional field) |
| Chosen visit date | Official ticket purchase | Contract execution |
| Payment data | Transaction processing | Contract execution (Stripe) |
| IP address | Commercial tracking, fraud prevention and security. Collected automatically on every form submission (contact, newsletter, community). | Legitimate interest |
| Browser & device (User-Agent) | Commercial tracking and technical analysis. Identifies the type of device, browser and operating system used. | Legitimate interest |
| Origin page (referrer) & URL | Analysis of visitor origin (e.g. search engine, social network, direct access) for commercial tracking and marketing optimisation. | Legitimate interest |
We do not collect sensitive data (health data, ethnic origin, religious beliefs, etc.).
3. Newsletter — Right to unsubscribe
If you subscribe to our newsletter, we use your email address exclusively to send you communications related to Morocco Museum news (new sites, cultural events, offers).
You can unsubscribe at any time via the link in each email or by contacting us at contact@moroccomuseum.com. Your unsubscription takes effect immediately.
4. Retention period
- Booking data (name, email, order): kept for 3 years from the order date, in accordance with legal accounting obligations.
- Payment data: not stored by Morocco Museum. It is processed directly and secured by Stripe Inc., subject to the PCI-DSS standard.
- Connection logs: kept for 12 months in accordance with applicable regulations.
5. Data recipients
Your data may be shared with the following third parties strictly within the scope of service provision:
- Stripe Inc. — payment processing, United States — GDPR guarantees via standard contractual clauses)
- Official cultural site operators (Moroccan Ministry of Culture, delegated operators) — only name and visit date, for ticket issuance
- Vercel Inc. — infrastructure hosting)
- Resend Inc. — email/newsletter sending service, United States — GDPR-compliant sub-processing agreement)
We never sell your data to third parties for commercial purposes.
6. Your rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
To exercise your rights, contact us at contact@moroccomuseum.com. We will respond within one month.
7. Cookies
This site uses a minimal number of cookies, strictly necessary for the service to function:
Remember tickets added to the cart. Duration: browser session.
Consent: Not required
Temporarily store buyer information during the order. Duration: session.
Consent: Not required
[If analytical or advertising cookies are added later, a GDPR-compliant consent banner will need to be implemented.]
8. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure: HTTPS connection, encryption of data in transit, restricted access to production data.