Skip to main content
← Back to Home

Privacy Policy

Last updated: April 2026

This Privacy Policy explains how Oahu Surf Maroc (“we”, “us”) collects, uses, and protects your personal data when you visit oahusurfmaroc.com or book a stay with us. We are committed to compliance with the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller responsible for your personal information is Oahu Surf Maroc, based in Tamraght, Souss-Massa, Morocco. For any data-related question, contact contact@oahusurfmaroc.com.

2. What We Collect

  • Booking data: name, email, phone number, country, surfing experience, package + accommodation choice, dates, any notes you share.
  • Contact form data: name, email, message, and optional preferred dates.
  • Technical data: we rely on essential cookies only (language preference, cookie consent record). We do not run analytics, advertising, or tracking cookies by default.

3. Legal Basis & Why We Process It

Under GDPR Art. 6, our legal bases are:

  • Contract (Art. 6(1)(b)): to confirm, deliver, and follow up on your booking.
  • Legitimate interest (Art. 6(1)(f)): to respond to contact-form inquiries and keep the site secure.
  • Consent (Art. 6(1)(a)): only if we later add optional cookies (analytics, marketing). None are loaded today.

4. Who We Share Data With

We share the minimum data required to run the business:

  • Resend (email delivery, EU/US) — processes booking & contact emails.
  • Vercel (hosting, EU/US) — serves this website.
  • Accommodation partner (Manapy Surfcamp) — receives your booking details only when your booking includes a stay (3-day, 5-day, or week all-inclusive). Drop-in lessons are not shared with them.

We do not sell, trade, or rent your personal data to third parties.

5. Data Retention

Booking data is retained for up to 3 years after your last stay for bookkeeping and legitimate customer-service purposes, then deleted or anonymised. Contact-form messages are kept for up to 12 months.

6. Cookies

We use strictly necessary cookies only:

  • NEXT_LOCALE — remembers your language preference.
  • oahu-cookie-consent — stores your consent choice and the date it was given.

We do not load Google Analytics, Meta Pixel, or any marketing trackers. If that changes in the future, they will only load after you explicitly opt in via the cookie banner.

7. Your GDPR Rights

You have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Erase your data (“right to be forgotten”, Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)
  • Withdraw consent at any time (Art. 7(3))
  • Lodge a complaint with your national data protection authority.

To exercise any of these rights, email contact@oahusurfmaroc.com. We will respond within 30 days.

8. Security

All traffic to this site is encrypted with HTTPS. Booking and contact emails are sent via Resend's authenticated domain.

9. Changes

We may update this policy from time to time. The “Last updated” date at the top always reflects the current version. Material changes will trigger a new cookie banner request.