Privacy Policy

Amlal operates surf camps and boutique apartments along Morocco’s Atlantic coast. Our booking platform lets you discover and reserve stays, experiences, services, and packages across our locations.

This policy applies to our website and the booking services we provide through it.

Booking and contact details — such as your name, email address, phone number, nationality, travel dates, number of guests, and any special requests you share when making a reservation or contacting us.

Payment information — handled securely by our payment providers. We do not store your full card number on our own servers.

Communications — messages you send us through contact forms, email, or messaging channels.

Technical and usage data — such as your IP address, device and browser type, and the pages you view, collected through cookies and similar technologies.

We use your information to process and manage your reservations, send booking confirmations and updates, provide customer support, operate and improve our website and services, personalise your experience, send you marketing communications where you have consented, and comply with our legal and accounting obligations.

Payments are processed by trusted third-party providers such as Stripe and PayPal. Your card details are transmitted directly to them under their own security standards and privacy policies. We receive only confirmation of payment and limited transaction data needed to manage your booking.

We use cookies and similar technologies to keep the site working, remember your language preference, and understand how the site is used so we can improve it. You can control or disable cookies through your browser settings, though some parts of the site may not function properly without them.

We share your data only as needed with: accommodation and activity providers so they can fulfil your booking; payment processors to complete your transaction; service providers who help us operate the platform, such as hosting, analytics, and communication tools; and public authorities where we are required to do so by law.

We do not sell your personal data.

Because we welcome guests from across Europe and beyond, your information may be processed outside your country of residence. Where this happens, we take steps to ensure your data remains protected in line with applicable law.

We keep your information only for as long as necessary to provide our services, meet our legal, tax, and accounting obligations, and resolve any disputes. When it is no longer needed, we securely delete or anonymise it.

Depending on where you live, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion, restrict or object to certain processing, and request a copy of your data in a portable format. You may also withdraw consent to marketing at any time. To exercise any of these rights, contact us using the details below.

We use reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access. However, no method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

Our services are intended for adults. We do not knowingly collect personal data from children without the appropriate consent of a parent or guardian.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on this page and revise the “last updated” date above.