Privacy Policy

The data controller is MBN HOST DEMO, located in the Medina, near Musée Mouassine, Marrakech, Morocco. For any question regarding your data, you can contact us at contact@mbnhostdemo.com.

We only collect the data strictly necessary to manage your stay and your account:

• Identity data: first and last name.
• Contact details: email address, phone number (WhatsApp), country of residence.
• Booking data: arrival and departure dates, number of guests, room(s) and services chosen, special requests.
• Account data: password (stored encrypted and irreversibly), your booking history and messages exchanged with the riad.
• Technical data: device type and language preference, required for the site to function.

Each processing activity is based on a specific legal ground:

Your data is handled by the riad's team and is never sold. It may be shared only with:

• Our technical host (Vercel Inc.) and our database, for the operation of the site.
• The competent authorities where required by law (for example, the guest register).
• Payment providers, where applicable, for the settlement of your stay.

Some providers may be located outside Morocco or the European Union; in such cases, we ensure that appropriate safeguards govern the transfer.

We keep your data for as long as necessary for the purposes described:

• Booking data: 3 years from your last stay.
• Account data: until your account is deleted, then archived for 1 year before permanent erasure.
• Accounting documents: 10 years, in accordance with legal obligations.

Under the GDPR and Moroccan law 09-08, you have the following rights, which you may exercise at any time:

• Right of access: obtain a copy of the data concerning you.
• Right to rectification: correct inaccurate information.
• Right to erasure: request the deletion of your data.
• Right to restriction of and objection to processing.
• Right to portability: receive your data in a structured format.

To exercise these rights, write to contact@mbnhostdemo.com. We respond within 30 days. You may also lodge a complaint with the competent data protection authority.

We implement appropriate technical and organisational measures: password encryption, secure connections (HTTPS), restricted data access and regular backups, to protect your information against unauthorised access, loss or disclosure.

This policy may be updated to reflect legal or service changes. The last-updated date appears at the top of the page. We encourage you to review it regularly.