Privacy policy

Controller and scope

ASSIRENA SARL, registered at Boulevard Moulay Hassan 1er, SIBAM Building, Block A, 3rd floor, No. 10, Marrakech, is the controller for the processing described here. This policy covers visitors to palaisassi.com, prospects, clients, guests, contacts and partners connected with Villa Assi Prestige.

It supplements rather than replaces the policies of communication services, platforms, banks, payment providers and partners with whom a person contracts directly.

Assi’s Guestbook

Participation is optional. With your express consent, we publish your chosen first name or nickname, rating, text, month of stay and submission date after checking the stay. Conforming reviews can be published regardless of their rating. Your email and exact dates remain private and are used only to verify and manage your review. A security fingerprint limits abusive submissions; it is not used for advertising.

Reviews remain published until you request their removal or they are removed for a reason set out in the guestbook rules. Verification data is reviewed for retention no later than twelve months after submission; only information needed for an open dispute or to evidence consent is retained after that review. To correct a text or request removal: direction@palaisassi.com. A Google review is an independent action under Google’s policy.

Data and purposes

• identity, contact details, language, dates, party composition, preferences and concierge requests;
• proposals, acceptances, invoices, payment references, refunds and pre-authorisations;
• arrival preparation, rooms, transfers, breakfast, requested services and stay security;
• administrative, contractual, accounting and security duties, fraud prevention, incidents and complaints;
• website technical data and strictly necessary security logs.

Legal grounds, required data and choices

Dates and party size are required to check availability. Contact details become necessary when you choose to request a proposal or book; without them, ASSIRENA cannot reply or conclude the stay. Preferences and concierge requests are optional unless required for safety or the requested service.

Pre-contractual steps requested by you and performance of the stay rely on Article 4(b) of Moroccan Law No. 09-08. Administrative and accounting duties rely on applicable law. Security, fraud prevention and the handling of claims rely on ASSIRENA’s legitimate interests after balancing individual rights. Any electronic marketing or non-essential tracker, if introduced, will use a separate, freely given and unticked choice.

Online enquiries and contacts

The calendar queries a professional management tool to check availability and minimum stays. The requested dates and number of guests are sent at this stage; no name, email address, telephone number or free-text message is sent.

When you choose to save the main enquiry, ASSIRENA keeps the submitted contact details, dates, party composition, preferences, estimate and consent records in its booking file, together with a unique reference. This does not hold the dates, take payment or replace a written proposal.

Two operational questionnaires, each available in French and English, are reserved for guests with a confirmed booking: Pre-arrival and the Private concierge catalogue. They do not replace the public stay-enquiry journey. Access is provided through a personal link that must not be forwarded. Depending on the questionnaire, ASSIRENA processes the booking reference, stay dates, number of guests, practical preferences, the selected provider and offer, and submitted requests. No payment, identity document or file is requested. Submission does not confirm any change, service or charge.

Do not send passports, full card numbers, security codes, OTPs, passwords, detailed health information or unnecessary documents through any unsecured channel.

Bookings and channels

Management tools and the chosen channels receive only the information needed for enquiries, bookings, payment and stay preparation. When a booking is made on Airbnb or another channel and synchronised with the management tool, the data required for the booking and calendar is handled by those services. Account access is limited to people who need it for those purposes.

Channels and agencies may act as separate controllers for their payments, checks, messaging and legal duties. Their own privacy policy also applies.

When ASSIRENA receives guest contact details from a platform, this notice is provided no later than the first direct communication unless the guest has already received it for that processing.

WiFi D’jib and concierge

Wi-Fi is available in the villa. The Orange WiFi D’jib hotspot provided for journeys may generate technical connection data with the operator, handled under its own policy. The team neither requests nor inspects communications content; if technical diagnosis is needed, only information useful to resolve it is used.

Concierge assistance remains available throughout the stay. Identity documents, full banking details and sensitive information must not be sent through an ordinary conversation.

Payment and identity documents

The current public availability-enquiry journey collects no bank or card data and takes no payment. If a later proposal offers electronic payment, the provider and applicable payment journey will be identified before any data is entered.

The public availability-enquiry journey does not require an identity-document copy or an administrative stay document. No identity-document number should be sent through WhatsApp, email or a free-text field.

Exterior camera at the entrance

One exterior security camera is installed at the entrance to Villa Assi Prestige. It is active during stays and may record images, without audio. Its field of view is limited to the outdoor access point; it does not cover any indoor space, jacuzzi, rooftop, terrace or other leisure area.

The camera is used to protect people and property and to manage incidents at the entrance. Its existence, location and operation are disclosed to guests before booking and on site. Access to images is limited to authorised persons; any retention is limited to what is strictly necessary for that purpose and applicable obligations.

Additional information

The calendar handles only the requested dates and number of guests. For the two confirmed-guest questionnaires, the personal link associates the booking reference, stay dates and number of guests with the form; a short-lived encrypted context can verify the connection to the stay when secure website receipt is enabled. In every case, selected content is sent to the questionnaire provider and notified to ASSIRENA on submission.

If additional information later had to be collected under an applicable legal obligation or at the request of an authorised public body, the guest would be informed at the point of collection. Collection would be limited to what is necessary, disclosed only to legally authorised recipients and retained only for the period required by the applicable rule.

Recipients and international transfers

Authorised ASSIRENA staff access only the data needed for their duties. Strictly necessary recipient categories may include availability and embedded-questionnaire services, Airbnb or the chosen channel, messaging services, the bank or payment provider named in the proposal, accountants, essential partners, insurers, advisers and legally authorised public bodies.

The copy held by the questionnaire provider is hosted in Belgium. A strictly necessary copy may also be retained in the website’s secured technical record when signed receipt is enabled and its context has been validated. Strictly necessary security and notification services may involve processing in the European Union or the United States. If audience measurement is accepted, Google Analytics processes limited device, browser and journey-event information for ASSIRENA; Google Signals, retargeting and advertising personalisation remain disabled. ASSIRENA reviews the contract, country and applicable CNDP formality for each transfer. Guest lists are never sold.

CNDP process

ASSIRENA maintains a processing register and checks the CNDP formality applicable to each activity. Any reference actually issued is retained in the compliance register and may be communicated to the person concerned or the competent authority following a verified request.

No number is reproduced on the website without documentary verification of its transcription. Any new purpose, newsletter, non-essential tracker or payment journey will be preceded by updated information and, where required, the corresponding formalities.

Retention

• unconverted enquiry: 12 months after the last exchange;
• booking file: the operational stay period followed by evidence archiving limited to the legally applicable limitation period;
• invoices and accounting archives: 10 years;
• incident, damage or complaint: the time needed to handle it followed by archiving under the applicable limitation period;
• marketing: until objection or unsubscribe; technical cookies: for no longer than strictly necessary;
• operational questionnaire responses: the questionnaire-service copy and, where it exists, the verified technical copy are reviewed for deletion no later than 90 days after departure; only necessary elements already added to the booking file follow that file’s applicable retention period;
• Google Analytics audience data: two months; consent choice: no more than six months.

Security and rights

The website uses HTTPS encryption and controls designed to limit unauthorised access. Access to management accounts is restricted to people who need it; other security measures also depend on each provider’s settings and commitments. No security measure is an absolute guarantee.

You may exercise access, correction, updating and objection rights under Moroccan Law No. 09-08 by writing to contact@palaisassi.com. You may also request erasure or blocking of non-compliant processing, subject to mandatory retention duties. Justified corrections are made free of charge within ten clear days. Proportionate identity verification may be requested where reasonably necessary and deleted after verification.

Cookies, marketing and children

No Meta or TikTok pixel, advertising tracker, retargeting tool or newsletter is active. Google Analytics loads only after express permission to measure page views and aggregated journey steps, without Google Signals, retargeting or advertising personalisation. Refusal disables no website function and the choice can be changed at any time.

A booking is made by an adult. A child’s data is limited to safety, sleeping arrangements, transport, food or a legal duty. No marketing is directed at children.

Contact and supervisory authority

Data contact: contact@palaisassi.com · +212 669 585 972 · ASSIRENA SARL, Boulevard Moulay Hassan 1er, SIBAM Building, Block A, 3rd floor, No. 10, 40000 Marrakech. You may also contact the CNDP as provided by law.