Legal
Privacy policy and cookies
This page describes what this site does with your data. It is written from how the site actually works, not from a template: what is not listed here is not collected.
The controller is ELBAHI.NET SARL AU, Lalla Takerkoust, Marrakech, Al Haouz. Contact: contact@quad-marrakech.ma.
What we collect, and why
Contact form — your name, your email address and your message. They are used only to answer you. They are relayed to our mailbox by our sending provider; they are not written to this site’s database.
Booking — name, email, phone, and the name of where you are staying if you ask for a transfer. This data is used to deliver the activity: to confirm you, to reach you if something changes, and to pick you up at the right address.
Payment — you can pay in cash at the base, in which case no payment data is collected. If you choose to pay online, the payment is processed by PayPal, a third-party payment provider: you are redirected to PayPal to pay. Our server sends PayPal the amount, the currency, the booking reference and the return addresses to your booking page; your PayPal account, or your card and billing address, are entered on PayPal’s own pages, under its own policy. No card or bank data is entered on this site or received by us; we keep only the PayPal order and payment identifiers, the status, the amount, the currency and the dates.
Currency preference — a technical cookie remembers the currency you pick, so you are not asked again on every page. It holds nothing else and cannot identify you.
Anti-bot — the contact form uses Cloudflare Turnstile, which checks that you are not an automated program.
Map — activity pages and the contact page show a Google Maps map, to locate the base and the meeting points. It loads by itself when you scroll down to it, without waiting for your agreement: Google then receives your IP address and technical information about your browser, and may set its own cookies, under its own privacy policy. We have no access to any of this data. You can block Google’s cookies in your browser settings; the address and directions are also written on those pages.
Audience measurement — we count page views, a few booking steps, the amount of confirmed bookings and clicks on our WhatsApp and phone buttons with Google Analytics, which sets cookies. It loads as soon as the page opens, without asking for your agreement.
Advertising — we run advertising on Facebook and Instagram, and their measurement tag lets us know which adverts led to a booking. It also sets cookies and loads the same way, as soon as the page opens. We send it only the viewing of an activity, the start of a booking, the sending of the booking form and the amount of a confirmed booking, and its automatic reading of forms is on: when you type your name, email or phone number, the tag sends Meta a hashed fingerprint of it (an unreadable string that cannot be reversed, but which Meta can match to its own accounts); it also records clicks on buttons and information about the page.
How to object — you can block both tools at any time: by refusing or deleting cookies in your browser settings, with an extension that blocks trackers, with the Google Analytics opt-out add-on offered by Google, or in the advertising preferences of your Facebook or Instagram account. You can also write to us at contact@quad-marrakech.ma.
What we do not do
No data is sold, rented or passed on for marketing. What you enter to book — your name, your email, your phone number — is never sent to an advertising network in plain text; only the hashed fingerprint described above goes to Meta.
If you block these two tools, the site works exactly the same: booking never depends on them.
Who receives your data
| Recipient | What they receive | Why |
|---|---|---|
| Our transactional email provider | Name, email, message or confirmation | To deliver the message |
| Cloudflare | IP address, request headers | To serve the site and filter bots |
| Google (Google Maps) | IP address, technical information about your browser | To show the map on activity pages and the contact page |
| Google (Google Analytics) | IP address, technical information about your browser, pages viewed, booking steps, amount of confirmed bookings, WhatsApp and phone clicks | To measure audience and bookings |
| Meta (Facebook and Instagram pixel) | IP address, technical information about your browser, activity viewed, start of booking, sending of the booking form, amount of a confirmed booking, clicks on buttons, hashed fingerprint of the name, email and phone number typed into a form | To know which adverts lead to a booking |
| PayPal (if you pay online) | Amount, currency, booking reference, return addresses to your booking page; your payment details are entered on PayPal’s pages, under its own policy | To collect your deposit or the full amount |
| Our host | The server’s data | To run the site |
Some of these providers are established outside Morocco and the European Union. Transfers happen under their own contractual commitments.
For how long
Booking data is kept for as long as the activity requires, then for the period imposed by the applicable accounting and tax obligations. Contact form messages live in our mailbox and are deleted once they no longer serve a purpose.
Your rights
You can ask for access to your data, for it to be corrected or deleted, or object to its processing. Write to contact@quad-marrakech.ma: we answer in writing.
If you live in the European Union, these rights are yours under the General Data Protection Regulation. In Morocco, law 09-08 provides for them as well, and places their supervision with the CNDP.
Changes
Any change to this page follows a real change to the site. The date it was last updated appears in the footer.