Privacy Policy
Website “Location Vacances Marrakech by L&L Invest” — https://locationvacancemarrakech.com
This page explains, in plain terms, what personal data we receive when you use this site, why, who sees it, where it is kept, how long we keep it and how to exercise your rights. It complies with Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data and, for people located in the European Union, with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).
In brief
- When you send a request through a form, it is saved in the site's database and sent to us by e-mail at our Gmail mailbox. We use it only to reply to you and to prepare your stay.
- The site sets no cookies and displays no advertising. It counts its visits with an in-house tool, without cookies, which never keeps your IP address and which you can decline.
- Your data is processed by L&L Invest, in Morocco, with the help of technical service providers located in the United States and in Europe.
- We do not sell your data and do not send you advertising without your consent.
1.Who is responsible for your data?
The data controller is [to be completed: first name and surname of the owner], an individual resident in Morocco, who lets the properties in their own name under the name “L&L Invest” (hereinafter “L&L Invest”, “we”).
- Address: [to be completed: postal address of the owner]
- Contact for any question about your data: centerimmo.marrakech@gmail.com
- Declaration to the National Commission for the Control of Personal Data Protection (CNDP, Morocco): [to be completed: number and date of the declaration receipt; where applicable, number and date of the transfer authorisation]
- Representative in the European Union (Article 27 of the GDPR): [to be completed: name and contact details of the representative, if the appointment is confirmed — otherwise delete this line]
2.What data, for what purpose, and on what basis?
| When | Data | Why | Legal basis |
|---|---|---|---|
| Stay request or booking request from a property page | Surname, first name, e-mail, telephone (WhatsApp), arrival and departure dates, number of travellers, property requested, preferred contact method, optional message, language of the site | To consider your request, offer you a stay, prepare the booking | Pre-contractual measures taken at your request (GDPR art. 6.1.b; Law 09-08, art. 4, b) |
| Information request about an upcoming property | Name, e-mail, telephone (optional), property concerned, desired dates and number of travellers (optional), message, language | To inform you and contact you again about this property | Pre-contractual measures taken at your request (art. 6.1.b; art. 4, b) |
| Ask a question | First name, e-mail, subject, message, language | To answer your question | Our legitimate interest in replying to people who write to us (art. 6.1.f; art. 4, e) [to be confirmed: legal basis adopted] |
| Any request (in addition) | Date and time sent, request reference, originating page and, if it appears in the address of that page, the campaign that brought you (“utm” parameters); then the follow-up of your request (status, history, internal team notes) | To follow up and process your request; to know which campaigns work | Our legitimate interest in managing our requests (art. 6.1.f; art. 4, e) |
| Acknowledgement of receipt (when enabled) | Your e-mail, the language chosen | To confirm that we have received your request. This message does not confirm a booking. | Pre-contractual measures (art. 6.1.b; art. 4, b) |
| WhatsApp, e-mail or direct call | Number, WhatsApp profile name, e-mail address, content of the exchanges | To communicate with you through the channel you have chosen | Pre-contractual measures (art. 6.1.b; art. 4, b) |
| Audience measurement (any visit, unless declined) | See § 8: pages viewed, actions on the site, country, language, type of device, origin, irreversible daily hash | To know how many people visit the site and what interests them, in the form of statistics | Our legitimate interest in improving the site (art. 6.1.f; art. 4, e) |
| Security (any visit) | IP address and technical connection information, processed by the host and to block abusive submissions | To operate the site and protect it against abuse and attacks | Our legitimate interest in ensuring the security of the site (art. 6.1.f; art. 4, e) |
Mandatory fields:
- “Stay request” and booking request: first name and surname, e-mail, telephone, dates and number of travellers;
- “Ask a question”: first name, e-mail and message;
- information request: name, e-mail and message.
Without this information, the form cannot be sent and we cannot reply to you. The other fields are optional.
We take no automated decisions about you and do not carry out profiling. Do not include sensitive information (health, religion, opinions, etc.) in your messages: it is not necessary.
3.Who receives your data?
Within L&L Invest: Laurent and Latifa, who handle your requests. [to be completed, where applicable: MDB-Group (Mayron Boubaker, France), for the technical maintenance of the site, under a subcontracting contract]
Our technical service providers:
| Provider | Role | Where the data is |
|---|---|---|
| Netlify, Inc. (United States) | Hosts the site, runs its functions (recording requests, audience measurement); technical logs | Functions run in the United States; pages delivered through Netlify's global network; US company |
| Neon — Databricks, Inc. (United States) | Database of requests and statistics | Europe (Frankfurt, Germany); US company |
| Google (Gmail) | E-mail service that sends the site's e-mails (notification of your request to L&L Invest, acknowledgement of receipt, team login codes) and receives your requests and your e-mails | Google servers worldwide, under its own privacy rules |
| Apple, Google, Mozilla, Microsoft (notification services) | Deliver to the team's phones a “new request” alert, which shows only the property and the dates, without your name or your e-mail | Depends on the service |
Netlify and Neon act on our instructions. For e-mail, we use a Gmail account; Google then processes the e-mails under its own terms and privacy rules.
Services you choose to use: WhatsApp (Meta), only if you write to us through this channel. WhatsApp then processes your data under its own rules, as the controller of its service: see its privacy policy.
Your data may also be disclosed to an authority that lawfully requests it.
4.Where is your data processed?
- In Morocco: L&L Invest resides in Morocco and processes your requests there. The European Commission has not recognised Morocco as providing a level of data protection equivalent to that of the European Union. Your data is protected there by Moroccan Law No. 09-08, under the supervision of the CNDP, and we also apply the GDPR to people located in the European Union.
- In the United States: Netlify, Neon (Databricks), Google and Meta are US companies, and the site's functions run in the United States. Their safeguards:
- Netlify states that it adheres to the EU–US Data Privacy Framework (“Data Privacy Framework”), recognised by the European Commission's adequacy decision of 10 July 2023. Its data processing agreement otherwise provides for the European Commission's standard contractual clauses;
- Databricks (Neon) states that it adheres to the same framework and relies on standard contractual clauses;
- Google states that it adheres to the same framework and relies on standard contractual clauses where required.
[to be completed: safeguards actually entered into (data processing agreements with Netlify and Neon) and, in Morocco, CNDP transfer authorisation, where applicable]
- In Europe: the database is hosted in Frankfurt (Germany).
You can obtain a copy of these safeguards by writing to centerimmo.marrakech@gmail.com.
5.How long do we keep your data?
| Data | Period |
|---|---|
| Requests that do not result in a booking (and their follow-up) | 3 years after the last exchange or the last update, then automatic deletion from the database |
| Requests that result in a booking | [to be completed: period, for example until the end of the stay, then the period required by law for accounting and disputes] |
| E-mails in our Gmail mailbox (received and sent: your requests, our replies, acknowledgements of receipt) | Same periods as above; we regularly delete e-mails whose period has expired |
| WhatsApp conversations | Same periods as requests; you can also delete the conversation on your side |
| Visit statistics (audience measurement events) | 13 months |
| Daily key used to calculate the visit hash | 2 days, then deletion: the hash can then no longer be linked to an IP address |
| IP address used against abusive submissions | A few minutes in memory, or 24 hours at most in the form of an irreversible hash |
| Your refusal of audience measurement (in your browser) | Until you withdraw it or clear your browsing data |
| Technical logs of the host | [to be completed: retention period of Netlify logs] |
| Technical backups of the database | [to be completed: length of Neon's restore history] |
6.Your rights
At any time, you may:
- access your data and obtain a copy of it;
- have it rectified if it is inaccurate;
- have it erased (in the site's database and in our mailbox);
- have its use restricted;
- object to its processing, in particular processing based on our legitimate interest (audience measurement, follow-up of requests), on grounds relating to your situation, and without having to give reasons in the case of any direct marketing;
- receive the data you have provided to us in a machine-readable format (portability);
- if you reside in France, give directives on what happens to your data after your death.
These rights are provided for by Law 09-08 (articles 7 to 9) and, for people located in the European Union, by the GDPR (articles 15 to 22).
How to proceed: write to centerimmo.marrakech@gmail.com stating your request. We may ask you to confirm your identity if we have reasonable doubt. We reply within one month at most, which may be extended by two months if the request is complex; we will then inform you.
For visit statistics, we can no longer link the data to a person beyond 2 days: we will therefore not be able to retrieve it for you, unless you yourself provide us with information that makes this possible.
7.Complaints
If you consider that your rights are not being respected, please write to us first: we will look for a solution. You may also contact:
- in Morocco: the CNDP (National Commission for the Control of Personal Data Protection) — www.cndp.ma;
- in France: the CNIL, Complaints Department, 3 place de Fontenoy, 75007 Paris — www.cnil.fr/fr/plaintes;
- or the data protection authority of the European Union country where you reside, work or believe an infringement has taken place.
9.Security
We take appropriate measures to protect your data:
- encrypted connection (HTTPS) across the whole site;
- access to requests restricted to the L&L Invest team, through a private application protected by a one-time login code sent by e-mail;
- login codes and session tokens never stored in plain text;
- IP address never saved for statistics;
- alerts sent to the team's phones limited to the property and the dates.
[to be completed: other measures, for example two-step verification on the Gmail mailbox and on the providers' accounts]
No system is infallible. In the event of a data breach presenting a risk to you, we will notify the competent authorities and, if the risk is high, we will inform you.
10.Changes and language
We may change this policy, for example if our service providers or the way we handle requests change. The date of the last update is shown below.
This text exists in French, English and Arabic. In the event of any discrepancy between these versions, the French version prevails, to the extent permitted by law. This rule does not deprive you of any right granted to you by the law of your country of residence.
Last updated: [to be completed: date of publication online]