Updated 7 October 2026
Personal data in Morocco
The operator is based in Ouarzazate, Morocco. Moroccan Law 09-08 provides rights of access, correction and objection, subject to its conditions. Contact the operator to exercise these rights or contact Morocco’s CNDP about a complaint. The GDPR rights described below apply where that regulation covers the processing; they do not replace Moroccan rights.
Who is responsible
Amai Abdelaaziz operates the portal and is the contact for privacy requests at contact@ouarzazatecity.com. Where the GDPR applies, the legal bases below depend on the purpose of processing. An enquiry form does not enrol you in marketing.
Website delivery and security
Hosting processes connection data such as IP address, request time, requested page and device/browser information to deliver pages, diagnose errors and prevent abuse. Where applicable, this is based on legitimate interests in a secure functioning website, Article 6(1)(f) GDPR. The site is delivered through OpenAI Sites and Cloudflare infrastructure.
Accounts, saved items and verification
Account functions can process name, email, phone, role, preferences, saved references and timestamps. Sign-in currently uses the site’s ChatGPT authentication flow, which provides account identity. Professional registration may involve document numbers and uploaded verification files. Account services and pre-contractual requests generally rely on Article 6(1)(b); fraud prevention may rely on Article 6(1)(f). Provide only information needed for your role.
Enquiries and proposed bookings
Contact, partnership, advertising and service forms save your name, email, message and supplied business details in our protected inbox. Trip booking requests additionally store the departure, adult/child/infant counts, selected services, price estimate, phone if supplied and practical accessibility preferences. Share only the arrangements you need, without medical diagnoses. Our team uses these details to respond and prepare the requested service, under Article 6(1)(b) where applicable. Owner notifications and replies may be delivered through our configured email service. Only authorised administrators can access private correspondence; sending a request does not confirm a booking or take payment.
Planner, location and external tools
The source-based planner processes destination and trip choices without a booking. If available and expressly selected, ChatGPT web research sends trip details to OpenAI; avoid sensitive personal information. The audio guide requests your device location only when you choose that feature, and does not store precise coordinates through its page. External maps and social links open third-party services; currency conversion uses ExchangeRate-API.
Recipients and international processing
Hosting, authentication, email and requested AI services can receive information necessary for their role. Where you ask us to coordinate a service, relevant request details may be shared with the named provider; do not include unnecessary private details. Some providers process outside the EEA. Their privacy notices explain their practices; ask the operator for the applicable recipients, contractual arrangements and transfer safeguards for your request. No blanket promise of EU-only storage is made.
How long information is kept
Information is retained for the purpose of the request, account or commercial relationship, then reviewed for deletion or restriction. Records needed for legal obligations, disputes or security may be retained longer on the relevant legal basis, including Article 6(1)(c) where required. A form does not promise automatic deletion after a fixed number of days. Ask for review of a record you no longer need us to hold.
Your data rights
Where applicable, request access, correction, erasure, restriction or portability; object to legitimate-interest processing and withdraw consent for future processing without affecting prior lawful processing. Rights have legal conditions and exceptions. Contact contact@ouarzazatecity.com; we may verify identity proportionately. GDPR requests are normally answered within one month, with lawful extensions notified. You may complain to the competent data-protection authority.
Administrator security
Private administrator access uses a salted password hash and an eight-hour, secure HTTP-only session cookie. Session tokens are stored as hashes. Password changes revoke other password sessions. Failed login attempts are limited using hashed connection identifiers and short-lived counters. Brevo keys saved in the dashboard are encrypted and are not displayed again; they are sent only to Brevo to verify the connection and send requested emails.