Privacy

Version of 17 October 2026. This page explains, in plain words, what the site collects, why, for how long, and how to exercise your rights.

In short

• No cookie is placed on your device without your consent. Only Google Analytics sets any, if you accept it in the cookie banner.
• Our baseline audience measurement, Umami, is anonymous: no identifier, no cross-site tracking.
• We never sell or rent any data.
• You can ask for access, correction or deletion of your data at any time.

Data controller

The data controller is the publisher of the site, identified on the Legal notice page. Contact: bonjour@essaouira.org.

What we collect, and why

Audience measurement. We use Umami, a cookie-less analytics tool. It counts page views and records country, device type, browser, language and referring page, with no persistent identifier: the IP address is used to derive the country and then hashed with a salt that changes every day, which prevents tracking you from one day to the next. The script is served from essaouira.org and the measurements are hosted by Umami Software, Inc. Legal basis: legitimate interest (knowing which pages are useful).

Google Analytics, with your consent. If you click “Accept” in the cookie banner, we also measure the audience with Google Analytics 4, a service of Google Ireland Limited and Google LLC. Your browser then loads Google’s script, which sets two cookies (“_ga” and “_ga_” followed by the site’s identifier) holding a random identifier. It sends Google the pages viewed, the referring page, device type, browser, language and an approximate location derived from the IP address. Google states that Google Analytics 4 does not store IP addresses. Google signals and ad personalisation are turned off, and the site runs no Google ads. Without your consent, no Google script is loaded. Legal basis: your consent, which you can withdraw at any time through the “Cookie settings” link at the bottom of every page.

Newsletter. If you subscribe, we keep your email address, language, interests, the date of your consent and a hashed fingerprint of the IP address used at signup (proof of consent). The subscription is only active after you confirm by email (double opt-in). Emails are sent through Resend, Inc. (United States). Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every email or by writing to us.

Partner links. When you click a booking link we record the listing, the partner, the language, the page you were on, the page that brought you there and a hashed fingerprint of your browser. No IP address or personal identifier is kept; this data is only used for aggregate statistics. Once on the partner’s site, its own privacy policy applies.

Server logs. Like every website, our server technically records each request: IP address, page requested, date, browser. These logs serve security and fault diagnosis. They are overwritten automatically by rotation (30 MB in total, a few days to a few weeks depending on traffic).

Maps. Place and neighbourhood pages offer a map. It loads only when you click “Show the map”; your browser then requests the base map from OpenFreeMap (OpenStreetMap tiles), which receives your IP address like any server you contact. Nothing loads until you click.

Your messages. The contact form stores your name, email address, message and the page concerned in our database, with a fingerprint of your IP address and browser computed under a secret key: neither the address nor the browser itself is kept. A copy of the message is forwarded to our inbox through Resend, Inc. (United States). The fingerprint is erased after 30 days; the message is deleted 90 days after we answer it or, if we never reply, at most six months after receipt. The copy forwarded to our inbox is kept for as long as it takes to handle your request, like the emails you send us directly. Legal basis: legitimate interest (replying to you).

Business listings. The site publishes the professional contact details of venues, schools, organisers and public places (name, address, phone, website, social accounts). This information comes from public sources or from the businesses themselves. If you are concerned and want it corrected or removed, write to us.

Cookies and local storage

Without your consent, the site sets no cookie. It only keeps your answer to the banner (accept or decline) and its date in your browser’s local storage, so it does not ask you again on every page. You are asked again after 13 months.

If you accept Google Analytics, Google sets the cookies “_ga” and “_ga_” followed by the site’s identifier, valid for 13 months at most. If you withdraw your consent through “Cookie settings”, the site deletes them and stops loading Google.

One other cookie exists, a technical one: it is reserved for the editorial team when previewing a draft before publication.

Retention

• Umami audience statistics: aggregated, without identifiers, kept indefinitely.
• Google Analytics, if you accept it: cookies valid for 13 months at most, data kept by Google for 14 months at most. Your answer to the banner is kept for 13 months in your browser.
• Newsletter: until you unsubscribe, then deleted within 30 days. Signups never confirmed are deleted after 30 days.
• Partner-link clicks: 13 months at most.
• Contact form messages: IP address and browser fingerprint erased after 30 days, message deleted 90 days after our reply or, if we never reply, at most six months after receipt. The copy forwarded to our inbox is kept for as long as it takes to handle your request.
• Server logs: automatic rotation, a few weeks at most.

Where the data is hosted

The site and its database are hosted in Frankfurt, Germany (European Union) with Hostinger International Ltd.; daily backups stay on that same server. Audience statistics (Umami Software, Inc.) and email delivery, the newsletter and the copy of each contact form message (Resend, Inc.), involve a transfer to the United States, covered by those providers’ standard contractual clauses. If you accept Google Analytics, measurement data is processed by Google Ireland Limited and may be transferred to the United States to Google LLC, which is certified under the EU–US Data Privacy Framework.

Your rights

Under Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data and, for residents of the European Union, the General Data Protection Regulation (GDPR), you have the right to access, rectify, object to, erase and port your data, and to withdraw your consent at any time.

To exercise them, write to bonjour@essaouira.org describing your request; we answer within 30 days. You may also lodge a complaint with the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP) in Morocco or, in the European Union, with the authority of your country of residence.

Children

The site is not aimed at children under 16 and does not knowingly collect data about them.

Security

Every page is served over HTTPS. Access to newsletter data is limited to the editorial team and password-protected.

Changes

This page evolves with the site. The version date appears at the top; substantial changes are announced in the newsletter.