Privacy and data protection.

Almara, whose operating base is in Mirleft, Morocco, is the controller of the personal data collected on this site. You can contact us at hello@surfcamp-almara.com.

Any request concerning your data is handled within a maximum of thirty days.

We collect the data you provide when making a booking request (name, email address, telephone, dates and stay package, accommodation preferences), together with the technical data generated by your browsing (IP address, browser type, language, referring page).

We collect no sensitive data. Your bank details are never stored on our servers: they are handled directly by our secure payment provider.

Booking data is processed for the performance of pre-contractual measures and of the contract (Article 6(1)(b) GDPR). Journal mailings rest on your consent (Article 6(1)(a)), which you may withdraw at any time. Audience measurement rests on the consent collected through the cookie banner.

Accounting records are retained under a legal obligation (Article 6(1)(c)).

Your data may be entrusted to technical providers acting on our behalf under a processing agreement: hosting of the site and the database, sending of emails, payment processing. These providers are established in the European Union or offer equivalent safeguards.

The list of processors is available on request at hello@surfcamp-almara.com.

Booking data is kept for the duration of the relationship, then for the period necessary to follow up payments. Accounting records are kept in line with the applicable statutory periods. Proof of consent is kept until consent is withdrawn.

Once those periods have elapsed, the data is deleted from our systems.

You have the rights of access, rectification, erasure, restriction, portability and objection provided for by Articles 15 to 22 GDPR.

To exercise them, write to hello@surfcamp-almara.com. Your request is handled within a maximum of thirty days; the first request is free of charge.

You may at any time lodge a complaint with the supervisory authority of your place of habitual residence. For residents of the European Union, this is the national data protection authority (in France, the CNIL — cnil.fr).

No prior formality is required.

We use a strictly limited set of cookies. Essential cookies (session, consent record, security) are exempt from consent. Audience-measurement cookies are activated only after your consent has been collected through the dedicated banner.

The detail of purposes and durations is set out in the cookie banner settings.

When you make a booking, we optionally record the channel through which you found us, together with any campaign parameters (UTM) present in the arrival URL. This information is used solely to measure how well our communication channels work.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). No third-party cookie is set for this purpose. You may request erasure by email.