Privacy Policy

Effective Date: May 16, 2026 Last Updated: May 16, 2026

This Privacy Policy explains how Raha Mogador ("we," "us," or "our") collects, uses, shares, and protects personal information when you visit rahamogador.com (the "Site"), book an experience or retreat with us, subscribe to our newsletter, or otherwise interact with our services.

Raha Mogador is a destination management company based in Essaouira, Morocco, offering curated travel experiences, editorial guides, and group retreats. We have written this policy to comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and Moroccan Law No. 09-08 on the protection of personal data.

By using our Site or services, you agree to the practices described below. If you do not agree, please do not use the Site.

1. Who We Are

Data Controller: Raha Mogador Location: Essaouira, Morocco Contact email: hello@rahamogador.com Website: https://rahamogador.com

For any privacy-related question, concern, or request, contact us at the email address above.

2. Information We Collect

a. Information You Provide Directly

Newsletter signup (via Ghost): Your email address when you subscribe to The Insider's Guide.
Contact and inquiry forms (via Formspree and Tally): Your name, email address, phone or WhatsApp number (optional), travel dates, group size, special requests, and any message you choose to send us.
Custom group and retreat inquiries (via Formspree and Tally): The same fields above, plus details about your group, retreat type, or itinerary needs.
Booking information (via Cal.com): When you book an experience through our embedded Cal.com booking widget, you provide your name, email, number of guests, selected date and time, and any notes or dietary or accessibility requirements you include.
Payment information (via Stripe and PayPal): Payments are processed directly by Stripe or PayPal. We do not store, see, or have access to your full payment card or banking details. We receive only a confirmation that payment succeeded, along with limited transaction details (such as the last four digits of the card, or the PayPal email and name associated with the transaction).

b. Information Collected Automatically

When you visit the Site, limited information is collected automatically by Ghost (our website platform) for the Site to function and remain secure:

IP address (used transiently for security and abuse prevention)
Browser type and version
Device type and operating system
Referring URL

We do not currently use Google Analytics, Plausible, Fathom, or any other third-party analytics or tracking service. We do not track your behavior across pages or across other websites. If we add analytics in the future, we will update this Privacy Policy and, where required, ask for your consent.

3. How We Use Your Information

We use your information only for the purposes listed below:

To confirm and manage your bookings, experiences, and retreats
To respond to your inquiries, custom retreat requests, and group booking forms
To process payments through Stripe and PayPal
To send you booking confirmations, pre-arrival information, and post-experience follow-ups
To send you our newsletter and editorial content, if you have subscribed
To improve our Site, content, and services based on your direct feedback and bookings
To comply with Moroccan, EU, US, and other applicable legal obligations
To prevent fraud, abuse, or violations of our Terms of Use

We will never sell your personal information to third parties.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

Contract: To fulfill bookings, retreats, and experiences you have purchased or requested.
Consent: For newsletter subscriptions and marketing communications. You may withdraw consent at any time.
Legitimate interests: To secure our Site, prevent fraud, and operate our business — balanced against your privacy rights.
Legal obligation: When we are required to retain or disclose information by Moroccan, EU, or other applicable law.

We share your personal information only with trusted service providers and partners who need it to deliver our services to you. These include:

Recipient	Purpose	Location
Ghost (Ghost Foundation)	Website hosting and newsletter delivery	EU / US
Cal.com	Booking widget and scheduling	EU / US
Stripe	Payment processing	US / EU
PayPal	Payment processing	US / EU
Formspree	Contact, inquiry, and custom booking forms	US
Tally	Contact, inquiry, and custom booking forms	EU
Google (Gmail / Workspace)	Business email communication	US
Local partners in Morocco	Riad hosts, transport providers, retreat venues, guides, and activity operators — only the minimum information necessary to deliver your booking (typically name, arrival date, group size, and any special requests)	Morocco

We may also disclose your information if required by law, court order, or government request, or to protect the rights, safety, or property of Raha Mogador, our guests, or the public.

6. International Data Transfers

Because Raha Mogador operates in Morocco and serves international travelers, your data may be transferred to and processed in countries outside your home country, including Morocco, the European Union, and the United States.

Where data is transferred outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the service provider's own approved transfer mechanisms. By using our Site or services, you acknowledge and consent to these international transfers.

Raha Mogador's processing of personal data in Morocco is conducted in accordance with Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data and is subject to oversight by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

7. Cookies and Tracking Technologies

Our Site uses only strictly necessary cookies required for the Site to function properly. These include:

Session cookies set by Ghost to maintain your login state if you are a member or newsletter subscriber.
Security cookies used to protect against cross-site request forgery and other security threats.
Functional cookies set by Cal.com, Formspree, and Tally when you actively interact with our booking widget or forms, in order for those features to work.

We do not currently use any analytics, advertising, tracking, or behavioral cookies. We do not track you across other websites, and we do not share cookie data with advertising networks.

Because we use only strictly necessary cookies, no cookie consent banner is required under GDPR or ePrivacy rules. If we add non-essential cookies (such as analytics) in the future, we will update this Privacy Policy and present you with a consent banner at that time.

You can control or disable cookies through your browser settings, though disabling them may affect Site functionality.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy:

Booking and payment records: Retained for up to 7 years to comply with tax, accounting, and legal obligations under Moroccan and international law.
Inquiry and form submissions: Retained for up to 2 years after our last interaction with you, unless you request earlier deletion.
Newsletter subscriptions: Retained until you unsubscribe.

After these periods, we securely delete or anonymize the information.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Right of access — Request a copy of the personal data we hold about you.
Right to rectification — Ask us to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — Ask us to delete your data, subject to legal retention obligations.
Right to restrict processing — Ask us to limit how we use your data.
Right to data portability — Receive your data in a portable, machine-readable format.
Right to object — Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent — Withdraw any consent you have previously given.
Right to lodge a complaint — File a complaint with your local data protection authority.

For California residents (CCPA/CPRA):

Right to know what personal information we collect, use, disclose, and share.
Right to delete personal information we have collected from you.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information. We do not sell your personal information.
Right to limit the use of sensitive personal information.
Right to non-discrimination for exercising your CCPA rights.

For Moroccan residents (Law 09-08):

Right of access, rectification, and opposition to the processing of your personal data, exercisable by contacting us at the email above.
Right to lodge a complaint with the CNDP (www.cndp.ma).

To exercise any of these rights, email hello@rahamogador.com. We will respond within 30 days (or 45 days for CCPA requests, as permitted by law). We may need to verify your identity before fulfilling your request.

10. Data Security

We take reasonable technical and organizational measures to protect your personal information from unauthorized access, loss, misuse, or alteration. These include encrypted connections (HTTPS), trusted third-party providers (Ghost, Cal.com, Stripe, PayPal, Formspree, Tally) with their own enterprise-grade security, and limited internal access on a need-to-know basis.

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Children's Privacy

Our Site and services are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at hello@rahamogador.com and we will delete it promptly.

When children are included in a family booking, we only collect the minimum information necessary (typically first name and age) and only from the booking adult.

12. Third-Party Links

Our Site may contain links to external websites operated by third parties (such as our booking partners, riads, or featured local businesses). We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies before sharing any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will update the "Last Updated" date at the top and, where appropriate, notify you by email or through a notice on the Site.

We encourage you to review this policy periodically.

14. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

Raha Mogador Essaouira, Morocco Email: hello@rahamogador.com Website: https://rahamogador.com