Protection of your personal data is important to us. With this Privacy Policy, we aim to explain in more detail which personal data we collect and for what purposes they are processed.

1. Data Controller and Contact

The data controller for your personal data is:

SASU KALACEO - JUST MARRAKECH

30 Avenue des Olives

13013 MARSEILLE

FRANCE

If you have any questions or suggestions regarding data protection or if you wish to exercise your rights, feel free to contact us via the link on your application: "Contact Us".

You can reach our Data Protection Officer at the following address: contact@justmarrakech.fr.

The Just Marrakech website and mobile application are owned by SAS KALACEO-JUST MARRAKECH, which is a data controller of your personal data.

We have adopted this Privacy Policy, which governs how we process the information collected by Just Marrakech, and it also explains why we need to collect certain personal data about you. Therefore, you must read this Privacy Policy before using the Just Marrakech website.

We care about your personal data and are committed to ensuring its confidentiality and security.

For clarity, the data processing by activity organizers who offer their services on Just Marrakech is subject to their own privacy policies. Activity organizers act as separate data controllers.

2. Scope of Data Protection

Data protection applies to personal data, meaning any information related to an identified or identifiable natural person. Throughout this document, personal data will also be referred to simply as "data".

3. Automated Data Collection

When you visit our website or app, your device automatically transmits data for technical reasons. The following data is stored separately from other data you may provide to us:

• The URL of the visited page
• Network connection latency
• Date and time

We store this data for the following purposes:

• Load balancing, i.e., to distribute access to our website across multiple devices, enabling us to offer you the fastest possible download times;
• To ensure the security of our IT systems, for example, to defend against specific attacks on our systems and to recognize attack patterns;
• To ensure the proper functioning of our IT systems, for example, in case of errors we can only correct by storing the IP address;
• To be able to pursue criminal prosecution, respond to threats, or initiate legal action if concrete evidence of criminal behavior is found.

Your IP address is stored for only 30 days.

In this case, processing is carried out to ensure the security of processing in accordance with Article 32 of the GDPR, as well as based on our legitimate interest in protecting ourselves from misuse of our services (Article 6(1)(f) GDPR).

4. Just Marrakech Account

4.1. Registration

• First and last name
• Email address
• Passwords

You can also log in using your Facebook, Google, or Apple account. In this case, we receive the following personal data from Facebook, Google, or Apple to create a user account for you:

• Name
• Email address
• Photo (Facebook only)
• Authentication token

Your registration data is required to create and manage your user account. In this case, you are entering into a (free) user contract with us, based on which we collect this data (Article 6(1)(b) GDPR).

To conclude the contract, you must provide this data. However, you are neither contractually nor legally obliged to enter into the contract and provide the data.

4.2. Favorites

After creating your customer account, you can create a list of favorite activities and visits. You can share these favorites with other users. Your data is processed for these purposes to offer you the corresponding features (Article 6(1)(b) GDPR).

5. Reviews and Ratings

Our website offers the ability to review and comment on visits or activities. After participating in a visit booked through our website, we may ask you to rate it. Submitting a review is, of course, voluntary. When you submit a review, we collect the data you provide to process it in line with the function you use and publish your review on our website. You can request to have a review deleted at any time by contacting our customer service.

You may at any time opt out of receiving review requests by clicking the unsubscribe link in each review request email. If you have an account, you can also do this from your profile (Settings > Notifications). Otherwise, you can send us a message using the "Contact Us" link on the Just Marrakech app.

The processing of your data for this purpose serves our legitimate interest in providing as much information as possible to our users about the visits we offer. Reviews are also in the interest of all users. Therefore, processing is based on Article 6(1)(f) GDPR.

6. Customer Service

6.1. Handling Inquiries

Your inquiry will be handled by our French Just Marrakech customer service by email or phone.

6.2. Customer Service Optimization

To continuously improve our customer service, we analyze the inquiries we receive based on certain parameters and keywords. Although, in principle, we do not analyze based on personal data, it cannot be ruled out that, in specific cases, personal data may also be processed in this context. The processing required in this context serves our legitimate interest and that of our clientele, which is the continuous optimization of our customer service (Article 6(1)(f) GDPR).

6.3. Translations

In certain cases, we may need to translate requests received in a specific language. This operation may involve the processing of personal data to protect our legitimate interest in providing international customer service (Article 6(1)(f) GDPR).

7. Technical Service Providers

We use technical service providers for hosting our website, as well as for some essential services. Therefore, data processing takes place on the servers of these service providers. These service providers only process data according to our explicit instructions and are required to ensure sufficient technical and organizational measures to ensure data protection. Consequently, our service providers operate for us as processors within the meaning of Article 28 GDPR.

7.1. Website Hosting

For hosting our website, we use the services of Hostinger operations, UAB Švitrigailos str. 34, Vilnius 03230 Lithuania. As a result, when you interact with our website or provide personal data, it is processed on Hostinger’s servers. We only use servers domiciled within the European Union. For remote maintenance and similar configurations, we have concluded standard contractual clauses adopted by the EU Commission with Hostinger, in accordance with Article 46(2)(c) GDPR.

8. Newsletter

On our website, you can subscribe to our newsletter. With this, we aim to send you information about offers, visits, activities, or special promotions as personalized as possible. By subscribing to our newsletter, you consent to us processing your email address for the purpose of sending the newsletter. The legal basis for this processing is Article 6(1)(a) GDPR. You can withdraw your consent at any time by unsubscribing from our newsletter. To do so, you can use the "Unsubscribe" link included in every email or send us a message using the "Contact Us" link on your application. To verify your email address, you will first receive an email containing a link that you must click to confirm your subscription ("double opt-in"). When you subscribe to the newsletter, we store your IP address and the date and time of the subscription. The processing of this data is necessary to prove consent. The legal basis derives from our legal obligation to prove your consent (Article 6(1)(c) GDPR, in conjunction with Article 7(1) GDPR).

If you have booked a visit through our website or app, or if you have created a Just Marrakech account, we will send you our newsletter based on our legitimate interest in promoting services similar to your bookings or your account (Article 6(1)(f) GDPR, Article 7(3) UWG (Unfair Competition Law)), unless you have objected. If we use cookies for personalization purposes, we will obtain your separate consent.

You can object to these operations at any time, even during registration, by unchecking the relevant box or by clicking on the "Unsubscribe" link in the respective emails. Additionally, if you have an account, you can always subscribe or unsubscribe from various types of communication from your profile (Settings > Notifications).

9. Bookings and Payments

9.1. Bookings

When you book a visit, activity, or similar service on our website or app, we collect the data required to conduct the visit. Typically, this includes the following information: first and last name, billing address, email address, phone number, the number of participants, and the date and time. Depending on the booked activity, we may also need to collect other information, such as a flight number, the age of participants, or your full identity for the "Women" group (ID or passport and a selfie).

Processing in connection with these operations is based on Article 6(1)(b) GDPR. If necessary, we will transfer your data to the provider responsible for the visit or activity, who will process your personal data in accordance with their privacy policy as an independent data controller. If a transfer to a third country outside the European Economic Area is necessary, this operation is based on Article 49(2)(b)(c) GDPR.

9.2. Booking Confirmations

To keep you informed about the status of your bookings, we will send booking confirmations, reminders, and updates for upcoming bookings (e.g., in case of time changes or meeting point changes) to ensure you have all the necessary information to enjoy the services you have booked. Booking confirmations are sent to your email address, and/or by SMS to the phone number you provided when booking, and/or by a push notification on the Just Marrakech app. If you have an account, you can specify how you wish to be informed from your profile (Settings > Notifications).

We process your personal data to provide you with these features of our service (Article 6(1)(b) GDPR).

9.3. Payments

We offer several options for paying for your booking. We process the necessary data based on the chosen payment method. In this context, your personal data will be processed as described below, this processing being based on Article 6(1)(b) GDPR and necessary to process the chosen payment method.

Credit Card Payments

For processing credit card payments, we use the services of Paypal, Stripe Payments Europe, Ltd. (SPEL). The data provided during your payment will be transmitted by Stripe to the respective banks or financial institutions to process the payment.

In the case of credit card payments, we only receive the information that a payment has been made or not, as well as the last four digits of the credit card number. We do not have access to the full credit card number.

10. Fraud Prevention

To ensure our protection and that of activity organizers against fraudulent bookings, we conduct an evaluation of the information provided by our customers during the booking process, including the data transmitted by their device, as necessary to protect our legitimate interest and that of activity organizers in ensuring reliable bookings (Article 6(1)(f) GDPR).

11. Why Do We Process Your Data?

Our top priority is customer data security, and as such, we can only process minimal user data, solely to the extent necessary to maintain the website.

Automatically collected information is used solely to identify potential cases of abuse and establish statistical information regarding website usage. These statistical data are not otherwise aggregated in such a way as to identify any particular system user.

You can visit the website without telling us who you are or revealing any information by which someone could identify you as a specific and identifiable individual.

However, if you wish to use certain website features or subscribe to our newsletter or provide other details by filling out a form, you may need to provide personal data such as your email, first name, last name, city of residence, organization, and phone number.

You can choose not to provide your personal data, but you may not be able to take advantage of certain website features. For example, you will not be able to receive our newsletter or contact us directly from the website. Users unsure of what information is mandatory are welcome to contact us via support@justmarrakech.com.

12. Your Rights:

If you are a European resident, you have the following rights related to your personal data:

• The right to be informed.
• The right of access.
• The right to rectification.
• The right to erasure.
• The right to restrict processing.
• The right to data portability.
• The right to object.
• Rights related to automated decision-making and profiling.

If you wish to exercise these rights, please contact us via the details below.

Additionally, if you are a European resident, we note that we process your information to fulfill any contracts we might have with you (for example, if you place an order through the site) or otherwise to pursue our legitimate business interests outlined above.

Also, please note that your information may be transferred outside of Europe, including to Canada and the United States.

13. Links to Other Websites:

Our website may contain links to other websites that are not owned or controlled by us.

Please be aware that we are not responsible for those other websites or third-party privacy practices.

We encourage you to be cautious when you leave our website and to read the privacy statements of every website that may collect personal information.

14. Information Security:

We secure the information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards to protect against unauthorized access, use, modification, and disclosure of personal data under our control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.

15. Legal Disclosure:

We will disclose any information we collect, use, or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

16. Contact Information:

If you would like to contact us to understand more about this Policy or wish to contact us regarding any matter related to individual rights and your personal information, you may send an email to contact@justmarrakech.fr.