Your data
Privacy Policy
Last updated: 8 August 2026
This policy explains what personal data we collect when you use this website or book a stay with us, why we collect it, who we share it with, and what rights you have over it.
We are a small surf camp. We only collect what we need to answer you and to host you well, and we do not sell your data to anyone.
1. Who is responsible for your data
Cactus Surf Experience, Cactus Surf Experience, R5VJ+X98, Imsouane 80043 Morocco, is the data controller for the personal data described in this policy.
For anything to do with your data — a question, a correction, or a request to delete it — email contact@cactussurfexperience.com or message us on +212 6 74 78 79 08.
2. What we collect
We collect three kinds of data.
- What you send us in a form. Our booking and contact forms ask for your name, email address and phone or WhatsApp number, along with the details of your request: dates, number of guests, room or package, surf level, chosen extras, and whatever you write in the notes or message field — which may include dietary requirements or a health note you choose to share.
- What you send us directly. Emails and WhatsApp messages you send us, and our replies.
- How the site is used. If you accept analytics cookies, Google Analytics records anonymised information about your visit: pages viewed, approximate location by country or city, device and browser type, and how you arrived. Our hosting provider also keeps short-lived technical server logs including IP addresses, which are needed to run and secure the site.
3. Why we use it, and our legal basis
- To answer your enquiry and prepare your reservation — because you asked us to, and to take steps before entering into a contract with you.
- To run your booking: confirming dates, sending your reservation summary, arranging your transfer, catering to your diet, and reaching you if something changes — to perform our contract with you.
- To keep you safe in the water, where you have told us about a health condition or injury — with your explicit consent, given when you choose to tell us.
- To keep basic records of bookings and payments — because Moroccan law requires it.
- To understand how the site is used and improve it — with your consent, given through the cookie banner.
- To protect the site from abuse and keep it running — our legitimate interest in a secure, working website.
We do not use your data for automated decision-making or profiling, and we do not send marketing emails unless you have asked us to.
5. Where your data goes
We are based in Morocco, and the services above are based in the European Union and the United States. This means your data may be transferred outside your own country.
Where data covered by the GDPR is transferred outside the European Economic Area, our providers rely on the European Commission's standard contractual clauses or an equivalent safeguard.
6. How long we keep it
- Enquiries that do not become bookings: up to 12 months, then deleted.
- Booking correspondence and guest records: up to 3 years after your stay, so we can handle questions, returning guests and complaints.
- Accounting records: as long as Moroccan tax law requires.
- Health and dietary notes: deleted after your stay ends, unless you book again.
- Analytics data: retained by Google for up to 14 months.
8. Your rights
Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or stop using it. If you are in the European Economic Area or the United Kingdom, the GDPR gives you these rights formally:
- Access — get a copy of the data we hold about you.
- Rectification — have anything inaccurate corrected.
- Erasure — have your data deleted, where we have no legal reason to keep it.
- Restriction and objection — ask us to pause or stop a particular use, including anything based on our legitimate interest.
- Portability — receive the data you gave us in a portable format.
- Withdraw consent — at any time, for anything based on consent, such as analytics or a health note. Withdrawing does not affect what we did before.
To use any of these rights, email contact@cactussurfexperience.com. We will reply within 30 days and we will not charge you for it.
9. Complaints
Email contact@cactussurfexperience.com and we will reply within 30 days. If you are not satisfied, you can complain to Morocco's data protection authority, the CNDP (cndp.ma), under Law 09-08, or — if you are in the EEA or UK — to the supervisory authority in your own country.
10. Children
This website is not aimed at children, and we do not knowingly collect data from anyone under 16 through it. Where a minor stays with us, their details reach us from the parent or guardian making the booking.
11. Security
The site is served over HTTPS, and form submissions travel encrypted. Booking details reach us as email and are held in our business inbox, accessible only to the small team who need them.
No system is perfectly secure. If a breach ever affects your data, we will tell you and the relevant authority as the law requires.
12. Changes to this policy
We will update this page whenever what we do with your data changes. The date at the top shows the last change.