Your data, kept to what we need.

We are Hilal Stays & Experiences, on Morocco’s Atlantic coast in the Souss-Massa region: two guesthouses, Moonlight in Taghazout and Blue Whale in Tamraght, and the surf lessons, yoga, trips and transfers we arrange for our guests. This website is hilalstays.com.

We decide how your personal data is used, which makes us responsible for it (the “controller”, or responsable du traitement in Moroccan law). For anything about your data, write to contact@hilalstays.com, or send a WhatsApp message or call us on +212 661 847 072.

Cars are rented by Hilal Luxury Cars, our rental company in Agadir, under its own rental contract: the driving licence and passport it asks for when the car is delivered are handled under that contract.

This website, in English and in French; the messages you send us on WhatsApp, by email or by phone; and your stay at the houses, with the activities, transfers and trips we arrange. It does not cover the other websites we link to, such as Google Maps, WhatsApp or hilalluxurycars.com, which have their own policies.

• Audience measurement, only if you accept. A small question on your first visit asks whether we may count visits with Google Analytics (through Google Tag Manager). Until you press Accept, analytics cookies stay off (Google Consent Mode). If you accept, Google receives your IP address, your browser and device details and the pages you open, and sets its cookies (named _ga) under Google’s privacy policy. Apart from this, the maps and the forecasts below, the site’s scripts, fonts and photos all come from our own site.
• Server logs. Like every website, our web host records each request: your IP address, the date and time, the page asked for (with anything written in its address), the page you came from and your browser. These logs serve to deliver the site and keep it secure.
• On your device only. A few small notes are kept in your browser so that the site remembers your choices (the table below). They are never sent to us, and you can delete them at any time by clearing this site’s data in your browser.
• The maps of the houses. The pages of Moonlight and Blue Whale, and the location page, show maps from Google Maps. When you open one of these pages, your browser loads the map from Google, which receives your IP address, your browser details and the address of the page, and may set its own cookies under Google’s privacy policy. The map shows the house, never where you are: the site does not ask for your location.
• The surf and the weather. The surf report, the weather page and the live conditions on the home page ask MET Norway (api.met.no) and the US agency NOAA, through the PacIOOS server of the University of Hawaiʻi, for the forecasts, the waves and the sea temperature. Your browser sends these requests itself: those services see your IP address, your browser and the address of our site, with no cookie and nothing else about you.
• Links to other sites. WhatsApp, Google Maps, hilalluxurycars.com and the sites our guides recommend receive nothing until you click.

• The WhatsApp form. Before WhatsApp opens, the site asks your name and phone number (required, so that our team knows who is writing) and, if you like, the nights and the number of travellers. The page sends nothing: it opens WhatsApp with the message written, and you send it yourself. If WhatsApp opens in a browser rather than in the app, the text passes through WhatsApp’s own web page first.
• A plan from the builder. The message holds what you chose: the house, the dates, the travellers and the children’s ages, the rooms, each line with its price, and a link to the plan. That link carries the plan without your name or phone number: anyone you share it with sees the plan and, like any web address, it may appear in our host’s logs when it is opened.
• The form of our contact page writes an email in your own email app. The page sends and keeps nothing.
• Email and phone. We receive what you write or tell us, with your email address or phone number.

Once your message reaches us, we use it to answer you and to prepare your quote.

• Your booking. Your name and contact details, the dates, the group, the plan and the quote, our messages about it, and the payments: the deposit by bank transfer (your bank shows us the name and the account it came from) and the rest paid at the house. Nothing is paid on the website, and we never ask for a card number.
• At arrival. Moroccan law requires every guesthouse to check each guest’s passport or identity card and to declare the stay to the authorities. We record what this registration asks for (identity, nationality, document number, dates of the stay) and nothing more.
• If you tell us more. Your flight times, your surf level, a diet or an allergy, so that the transfer, the lessons and the breakfast suit you. We do not ask about your health; if you tell us something about it so that we can look after you, we use it for that alone and delete it after your stay.
• Photos and reviews. We publish a photo in which you can be recognised, or your review, only with your permission, and we take it down if you ask.

We send no newsletters and no advertising. If we ever wish to, we will ask you first, and every message will let you stop them.

You need to give us nothing to read this site. To book, we need your name and a way to reach you; without them we cannot confirm a stay. The registration at arrival is required by law.

• Our team at the two houses, who need it to look after you.
• The people who run what you booked: the surf school and instructors, the yoga teacher, the quad, trip and transfer partners, the hammam and the spa. They receive only what they need: a name, the number of people, the time, the meeting point, and what matters for your safety.
• Hilal Luxury Cars, if your plan has a car.
• The services that work for us: WhatsApp (Meta) for messages, our email provider, our web host and our bank, each for its own service only.
• The authorities, when the law requires it, as for the declaration of guests.

We never sell or rent your data, and never share it for advertising.

WhatsApp, our email provider and our web host run servers outside Morocco, in places such as the European Union or the United States, so your messages and the site’s logs may be stored there. Moroccan law allows this when it is needed to carry out what you ask of us (Law 09-08, art. 44). These providers protect the data with their own safeguards, including, where they apply, the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

If you write to us from the European Union or the United Kingdom, your data comes to us in Morocco because you choose to contact a business here, and we protect it as this policy describes.

After these periods we delete the data, or keep it only in a form that no longer identifies you.

Under Moroccan Law 09-08, everyone can:

• know what we hold about them and receive a copy, free of charge (access);
• have it corrected, which we do within 10 days (rectification);
• object to its use for legitimate reasons, and at any time and free of charge to any marketing (opposition).

If you are in the European Union or the United Kingdom, the GDPR also gives you the right to have your data erased, to restrict its use, to receive it in a common format (portability), to object to a use based on our legitimate interest, and to withdraw your consent at any time, without affecting what was done before.

Write to contact@hilalstays.com or send a WhatsApp message to +212 661 847 072. We answer within 30 days, free of charge, and may ask you to confirm who you are before we share or change anything.

Tell us first: most things are put right quickly. You can also complain to the CNDP, Morocco’s data protection authority (cndp.ma) or, if you live in the European Union or the United Kingdom, to the data protection authority of your country, such as the CNIL in France or the ICO in the United Kingdom.

The site is served only over an encrypted connection (HTTPS) and collects nothing itself. Booking messages and files stay with our team, and we ask the services we use to protect them. We never ask for a card number or a password. If a problem ever put your data at risk, we would tell you, and the authorities, as the law requires.

Bookings are made by an adult. Children travel with a parent or an adult responsible for them, who tells us what we need to know about them, such as their ages in the builder, so that we know which lessons and rides suit them. This site is not meant for children to use on their own.

The site itself sets no cookies. On your first visit, a small question asks whether Google Analytics may count visits: if you accept, Google sets its cookies (_ga and _ga_ followed by an identifier); if you refuse, none are set and everything works the same. The Google map on the house pages and the location page may set Google’s own cookies when those pages load. Change your answer any time.

When what we do with data changes, we update this page and the date at the top. For any question about it, write to contact@hilalstays.com.