Contents
1. Who is responsible for your data
Three companies operate under the BigBlue Surf Experience brand, and each is data controller for the service it delivers:
| Company | Controller for |
|---|---|
| AUBERGE LESPOT S.A.R.L. (A.U.) N°8 Ruelle Mhand Idir, Village Taghazout, Agadir R.C. 39203 · I.C.E. 002095379000017 | Accommodation, surf school, coworking, excursions, meals. It also takes the booking for the other two companies and is your single point of contact. |
| BIGBLUE SCOOTERS RENTALS S.A.R.L. (A.U.) Appt 2, N°8 Ruelle Mhand Idir, Taghazout R.C. 66077 · I.C.E. 003814081000057 | Scooter rental, including driving licence and identity data collected for the hire |
| MAMOUNE TRAVELS S.A.R.L. (A.U.) Appt N°2, Imm. 1457 Socoma Askjour, Marrakech R.C. 118255 · I.C.E. 002894496000053 | Airport transfers and transport, including flight details and pick-up data |
Where your booking includes a scooter or a transfer, the data strictly necessary to deliver that service is shared with the company concerned, and no more. You can exercise all of your rights through the single contact address below, whichever company holds the data.
Processing is carried out under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, supervised by the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP). Where you are resident in the European Union, we also apply the General Data Protection Regulation (GDPR) to the processing of your data.
Questions about this policy, or about your data: management@bigbluesurfexperience.com or through our contact form.
2. What we collect
| Category | Examples |
|---|---|
| Identity | Name, date of birth, nationality, passport or identity card number, photograph of the document where the law requires it |
| Contact | E-mail address, telephone and WhatsApp number, postal address, emergency contact |
| Booking | Dates, room or service booked, package, number of guests, flight number and arrival time, special requests |
| Payment | Amount, currency, method, transaction reference, invoices. We never store your full card number or security code. |
| Surf and activity | Declared level, height and weight for equipment sizing, and any medical information you choose to disclose for your safety |
| Driving | Driving licence details, for scooter rental only |
| Correspondence | E-mails, WhatsApp messages and reviews you send us |
| Technical | IP address, browser and pages visited on this website |
Health data is sensitive. We ask for it only where it affects your safety in the water or on a scooter, we record only what is operationally necessary, only the staff concerned can see it, and we delete it at the end of your stay. You are free not to disclose it — but we may then be unable to let you take part in an activity.
3. Why we use it and on what basis
| Purpose | Legal basis |
|---|---|
| Managing your booking, stay and the services you buy | Performance of our contract with you |
| Registering guests with the Moroccan authorities and declaring overnight stays | Legal obligation under Law No. 80-14 and its implementing decree |
| Invoicing, accounting and tax records | Legal obligation |
| Safety during surf lessons, excursions and scooter hire | Your explicit consent, and our legitimate interest in preventing accidents |
| Answering your messages before and after your stay | Your request, and our legitimate interest in running the business |
| Handling deposits, damage and disputes | Our legitimate interest in defending our rights |
| Sending you offers by e-mail | Your consent, withdrawable at any time |
| Measuring website traffic | Your consent, given through the cookie banner where one is displayed |
We do not carry out automated decision-making or profiling that produces legal effects for you.
4. Who we share it with
We share your data only where it is necessary, and only with:
- The other two companies of the group — BigBlue Scooters Rentals S.A.R.L. (A.U.) and Mamoune Travels S.A.R.L. (A.U.) — strictly limited to what each needs to deliver the scooter or the transfer you booked.
- Our booking system provider, which hosts reservations and the guest portal on our behalf.
- Payment providers and our bank, to take and reconcile payments. Card data is handled by them, not by us.
- Online travel platforms (Hostelworld, Booking.com and similar) where you booked through them, limited to the data needed to honour that booking.
- The Moroccan authorities, where the law requires guest registration or the declaration of overnight stays, and in response to a lawful request.
- Independent activity providers — a driver, a guide, a hammam — limited to the name and the information they need to deliver the service you booked.
- Our accountant and, where necessary, our lawyer or insurer, bound by professional confidentiality.
We do not sell your personal data, and we do not share it for third-party advertising.
5. Transfers outside Morocco
Some of our providers store data on servers located outside Morocco, including in the European Union. Under Article 43 of Law No. 09-08, transfers abroad require an adequate level of protection and, where applicable, the authorisation of the CNDP. Where personal data of EU residents is transferred, we rely on contractual guarantees with our providers that reflect the requirements of the GDPR.
6. How long we keep it
| Data | Retention |
|---|---|
| Booking and stay records | 3 years after your last stay, for follow-up and dispute handling |
| Invoices and accounting records | 10 years, as required by Moroccan tax and commercial law |
| Guest registration records | The period required by the authorities |
| Health and safety declarations | Deleted at the end of your stay |
| Driving licence and identity data for rentals | Held by BigBlue Scooters Rentals S.A.R.L. (A.U.), processed under Law 09-08 for contractual and legal purposes. Deleted 3 months after the end of the hire, unless a dispute is open |
| Marketing consent | Until you withdraw it, and in any case reviewed every 3 years |
| WhatsApp conversations | Up to 24 months |
7. Your rights
You may at any time:
- Access the data we hold about you, and obtain a copy;
- Correct anything inaccurate or incomplete;
- Delete your data, where we are not required to keep it by law;
- Object to processing based on our legitimate interest;
- Restrict processing while a dispute over accuracy is resolved;
- Withdraw consent at any time, without affecting what was done before;
- Receive your data in a portable format, where the GDPR applies to you.
Write to management@bigbluesurfexperience.com or through our contact form with your booking reference. We answer within 30 days. We may ask you to confirm your identity first — that protects you.
8. Cookies and the website
This website is deliberately simple. It sets no advertising cookies and no third-party tracking cookies.
Two things are worth knowing:
- Fonts are loaded from Google Fonts. Your browser therefore connects to a Google server, which receives your IP address. No cookie is set by that request.
- Audience measurement. Where we activate analytics, it runs only after you have given consent through the banner, and the data is used solely in aggregate to understand which pages are useful.
Our booking engine, hosted at bookings.bigbluesurfexperience.com, sets the cookies it needs to keep your basket and your session working. Those are essential to the service.
You can block or delete cookies in your browser settings at any time.
9. WhatsApp
We use WhatsApp because it is how our guests actually reach us, at any hour, from anywhere. When you write to us there, your message and your telephone number are processed by WhatsApp Ireland Ltd (Meta) under its own privacy policy, over which we have no control. Please do not send passport scans, card details or medical information through WhatsApp — use e-mail, or give them to us at reception.
10. How we protect your data
- Access is limited to the staff who need it, under confidentiality obligations.
- Paper documents containing identity data are kept locked at reception.
- The website and the booking engine are served over an encrypted connection.
- We never take or store card security codes, and our staff are instructed never to ask for them.
No system is perfect. Where a breach is likely to affect your rights, we will inform you and the CNDP without undue delay.
11. Children
We do not knowingly collect data from anyone under 16 other than through the booking made by their parent or legal guardian, who provides it and consents to it on their behalf.
12. Changes to this policy
Where we change this policy materially, we will publish the new version here with a new date, and inform guests with an active booking by e-mail.
13. Contact and complaints
For any question, or to exercise a right: management@bigbluesurfexperience.com or through our contact form, or by post to AUBERGE LESPOT S.A.R.L. (A.U.), N°8 Ruelle Mhand Idir, Village Taghazout, Agadir, Morocco.
If our answer does not satisfy you, you may lodge a complaint with the CNDP in Rabat (www.cndp.ma). If you are resident in the European Union, you may also complain to the supervisory authority of your country of residence.