Privacy

Version of 18 September 2026. This page explains, in plain words, what the site collects, why, for how long, and how to exercise your rights.

In short

• No cookie is placed on your device when you browse the site.
• Audience measurement is anonymous: no identifier, no cross-site tracking.
• We never sell or rent any data.
• You can ask for access, correction or deletion of your data at any time.

Data controller

The data controller is the publisher of the site, identified on the Legal notice page. Contact: bonjour@essaouira.org.

What we collect, and why

Audience measurement. We use Umami, a cookie-less analytics tool. It counts page views and records country, device type, browser, language and referring page, with no persistent identifier: the IP address is used to derive the country and then hashed with a salt that changes every day, which prevents tracking you from one day to the next. The script is served from essaouira.org and the measurements are hosted by Umami Software, Inc. Legal basis: legitimate interest (knowing which pages are useful).

Newsletter. If you subscribe, we keep your email address, language, interests, the date of your consent and a hashed fingerprint of the IP address used at signup (proof of consent). The subscription is only active after you confirm by email (double opt-in). Emails are sent through Resend, Inc. (United States). Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every email or by writing to us.

Partner links. When you click a booking link we record the listing, the partner, the language, the page you were on, the page that brought you there and a hashed fingerprint of your browser. No IP address or personal identifier is kept; this data is only used for aggregate statistics. Once on the partner’s site, its own privacy policy applies.

Server logs. Like every website, our server technically records each request: IP address, page requested, date, browser. These logs serve security and fault diagnosis. They are overwritten automatically by rotation (30 MB in total, a few days to a few weeks depending on traffic).

Maps. Place and neighbourhood pages offer a map. It loads only when you click “Show the map”; your browser then requests the base map from OpenFreeMap (OpenStreetMap tiles), which receives your IP address like any server you contact. Nothing loads until you click.

Your messages. Emails you send us are kept for as long as it takes to handle your request.

Business listings. The site publishes the professional contact details of venues, schools, organisers and public places (name, address, phone, website, social accounts). This information comes from public sources or from the businesses themselves. If you are concerned and want it corrected or removed, write to us.

Cookies and local storage

The site sets no cookie and does not use your browser’s local storage for visitors. A single technical cookie exists, reserved for the editorial team when previewing a draft before publication.

Retention

• Audience statistics: aggregated, without identifiers, kept indefinitely.
• Newsletter: until you unsubscribe, then deleted within 30 days. Signups never confirmed are deleted after 30 days.
• Partner-link clicks: 13 months at most.
• Server logs: automatic rotation, a few weeks at most.

Where the data is hosted

The site and its database are hosted in Frankfurt, Germany (European Union) with Hostinger International Ltd.; daily backups stay on that same server. Audience statistics (Umami Software, Inc.) and newsletter delivery (Resend, Inc.) involve a transfer to the United States, covered by those providers’ standard contractual clauses.

Your rights

Under Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data and, for residents of the European Union, the General Data Protection Regulation (GDPR), you have the right to access, rectify, object to, erase and port your data, and to withdraw your consent at any time.

To exercise them, write to bonjour@essaouira.org describing your request; we answer within 30 days. You may also lodge a complaint with the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP) in Morocco or, in the European Union, with the authority of your country of residence.

Children

The site is not aimed at children under 16 and does not knowingly collect data about them.

Security

Every page is served over HTTPS. Access to newsletter data is limited to the editorial team and password-protected.

Changes

This page evolves with the site. The version date appears at the top; substantial changes are announced in the newsletter.