PRIVACY POLICY
What we collect, why, for how long, and what you can request
The essentials, in five lines
- We do not sell, rent, or exchange any personal data.
- We never see your bank card number.
- The public ranking contains no personally identifiable information — only the team name you chose.
- No photos are published without your express consent, and leaving anything unchecked means no.
- A deletion request is executed unconditionally and without justification being required.
01 Who processes your data
The data controller is Les Mystères de Marrakech SARLAU, a single-member limited liability company with a capital of 100,000 DHS, whose registered office is located at Avenue Allal El Fassi, Complexe Habous 2, Building A, Apartment 21, 40000 Marrakech, Morocco (RC Marrakech 180561, ICE 003943676000073).
For any questions relating to your data: contact@lesmysteresdemarrakech.com.
The processing is declared to the National Commission for the Control of the Protection of Personal Data (CNDP) under number [CNDP NUMBER].
02 What we collect, and why
We only collect what we need to provide you with the game and to fulfill our obligations. Each processing activity is detailed below.
Booking and execution of the service
Payment
Game app
Public ranking
Photographs from the mission
Exchanges with you
We do not send any advertising messages and do not create any prospecting files.
03 Where your data is hosted
- The website and shop — Hostinger International Ltd., a company established in Larnaca, Cyprus (European Union);
- Gaming application data and rankings — Supabase infrastructure located in Ireland (European Union);
- The gaming applications themselves — Lovable platform;
- Payments — approved payment provider, on its own servers;
- The website translation service — Linguise, which processes the displayed pages;
- The messaging service — the company's email provider.
Each of these service providers acts as a subcontractor : they only intervene on our instructions, for the sole purposes described above, and are not authorized to make any other use of your data.
04 To whom your data is transmitted
To no one else. Your data is not sold, rented, exchanged, or given to third parties for commercial, advertising, or statistical purposes.
Two exceptions, strictly regulated: the subcontractors listed in article 03, within the limit of what is technically necessary for them; and, where applicable, the partner tourist transport company, to whom we communicate only the number of participants and the meeting point, without any personal data.
We may also be required to disclose certain data upon request from a duly authorized judicial or administrative authority. We would only do so within these strict limits.
05 Transfers outside of Morocco
Part of your data is hosted in theEuropean Union (Ireland, Cyprus), which offers a recognized level of protection. These transfers are subject to the formalities stipulated by Law No. 09-08 with the CNDP (National Commission for the Protection of Personal Data) and are governed by the data protection contractual clauses concluded with each service provider.
06 The public ranking
The ranking displays, for each course, the team name, the number of participants, the points, the time and the date of the game. Nothing else.
The team name is freely chosen by the players. It is up to you not to include your surname or any other personal information: we have no way of knowing if a team name contains such information.
Removing a line from the ranking is done with a simple message. No justification is required and the removal is permanent.
07 The photographs
Photographs may be taken during missions, either at your initiative or that of the Game Master. They will be sent to you privately via a personal link.
They are never published without your explicit consent, obtained via a checkbox that is unchecked by default. Leaving it unchecked means no. You can withdraw this consent at any time, including after publication: we will then remove the photograph.
The photographs are stored in a private, non-indexed space, accessible only via personal link, and deleted 30 days after the mission.
08 The miners
Our experiences are bookable by adults. When minors participate, they are placed under the responsibility of the accompanying adult, who is responsible for giving or refusing any agreement relating to their data, and in particular to the publication of photographs in which they appear.
We do not collect the age, date of birth, or any personal data of participating children — only, for pricing purposes, the number of participants per age group.
09 Cookies & trackers
The website uses strictly technical cookies, essential for its operation: remembering shopping cart contents, maintaining the session, and preserving the chosen language and currency. They are not used for any profiling and do not require consent.
This website does not use any advertising cookies and does not sell any browsing data. Any audience measurement or third-party tracking that may be installed will be subject to your prior consent, obtained via a dedicated banner and revocable at any time.
10 Security
The website and applications operate exclusively via encrypted connection. Access to the game's database is restricted column by column: players' email addresses are not publicly readable, even by someone querying the database directly from the outside.
Administrator access is personal and protected. Despite these measures, no system is infallible: in the event of a data breach that could affect you, we will inform you as soon as possible.
11 Your rights
In accordance with Law No. 09-08 relating to the protection of natural persons with regard to the processing of personal data, you have a right ofaccess, rectification andobjection.
If you reside in the European Union, you also benefit from the rights granted by the General Data Protection Regulation (GDPR) :
- Deletion of your data;
- Limitation of treatment;
- Portability of the data you have provided to us;
- Objection to processing based on our legitimate interest;
- You may withdraw your consent at any time for processing activities that depend on it.
These rights can be exercised by sending a message to contact@lesmysteresdemarrakech.com, without any particular formalities. We may ask you for information to verify your identity only if there is reasonable doubt. We will respond within one month.
12 Claim
If you are not satisfied with our response, you can contact the CNDP , the Moroccan supervisory authority — www.cndp.ma.
If you reside in the European Union, you can also contact the data protection authority in your country of residence.
13 Changes to this policy
This policy may change if our tools or processing methods change. The date of the last update is shown below. Any substantial changes will be communicated to you before they take effect for data already collected.
The contractual terms of our services are set out in our General Terms and Conditions of Sale, and information relating to the publisher of the site is in our Legal Notices.