Sky Dunes Tours LTD – Privacy Policy

1. Introduction

This Privacy Policy outlines Sky Dunes Tours Ltd ("we", "our" or "the Company") practices with respect to information collected from users who access our website at www.skydunestours.com ("Site"), or otherwise share personal information with us (collectively: "Users").

2. Grounds for Data Collection

Processing of your personal information (meaning any information which may potentially allow your identification with reasonable means; hereinafter "Personal Information").

We process your Personal Information only where one or more of the following legal grounds apply:

• Contractual necessity: Processing is necessary for the performance of our contractual obligations towards you — for example, to confirm your booking, arrange your pickup, and provide the tour or service you purchased.

• Legitimate interests: Processing is necessary for our legitimate business interests, provided they are not overridden by your rights and freedoms — for example, responding to your enquiries, improving our website and services, and preventing fraud.

• Legal obligation: Processing is necessary for compliance with legal and financial regulatory obligations to which we are subject — for example, retaining transaction records for tax purposes as required by UK law.

Where none of the above grounds apply (for example, when sending you marketing communications or non‑essential newsletters), we will only process your Personal Information after obtaining your explicit, freely‑given consent. You may withdraw that consent at any time by contacting us.

We encourage all Users to read this Privacy Policy carefully and use it to make informed decisions about their data.

3. What Information We Collect

We collect two types of data and information from Users.

Non‑personal Information: The first type is un‑identified and non‑identifiable information that is gathered automatically through your use of the Site. This may include aggregated usage data (pages viewed, time spent on the Site, clicks, scroll behaviour), technical information transmitted by your device (browser type, operating system, language preference, device screen size, and access times), and general geographic region derived from your IP address (e.g. city‑level). We use this information to improve the functionality and user experience of our Site, analyse trends, and administer the Site.

Personal Information: The second type is individually identifiable information that may, with reasonable effort, identify an individual. For Sky Dunes Tours, this includes:

• Booking information: When you make a booking or enquiry through our Site or via WhatsApp, we may collect full name, email address, phone number, nationality (where required by local tourism regulations), hotel/riad name and address (for pickup coordination), passenger ages and weights (for safety requirements), dietary requirements, and any special requests or notes you voluntarily provide.

• Communications: When you contact us via WhatsApp, email, or the Site contact form, we collect the content of those communications, including attachments, to respond to your enquiry and provide customer support.

• Payment information: When you pay online, your payment card details are processed directly by our secure payment service provider Stripe. We do not receive or store your full card number; we only receive a confirmation of the transaction and a partial reference to identify the payment.

• Device and usage information: We may collect limited device data such as your IP address and unique identifiers (e.g. cookies) to ensure the security of our Site, prevent fraud, and remember your consent preferences.

We do not collect information from user accounts (we do not offer account registration), social media logins (you cannot sign in with third‑party accounts), or any special categories of personal data (sensitive data) unless you voluntarily provide health or dietary information that is necessary for your booking.

4. How We Receive Your Information

We receive your Personal Information from the following sources:

• Directly from you: when you voluntarily provide your personal details by making a booking through our Site, sending a message via WhatsApp, filling in a contact form, or communicating with us by email or phone.

• Through your use of our Site: when you access or use our Site, certain device and usage information is automatically collected through cookies and similar technologies (subject to your consent preferences).

• From third‑party booking platforms (OTAs): when you book one of our experiences through online travel agencies such as Viator or GetYourGuide, the OTA shares your booking details with us so we can fulfil your tour. You should also review the privacy policy of the platform through which you booked.

• From technology and analytics providers: we use services such as Google Analytics which process data on our behalf. These providers act as processors and are contractually bound to handle your data securely and only on our instructions.

• From public registers: in limited circumstances, we may consult public registers to verify company information (for B2B or corporate bookings) or to comply with legal obligations.

5. How We Use and Share Your Information

We do not rent, sell, or share Users' Personal Information with third parties except as described in this Privacy Policy.

Purposes for which we use your information:

• Providing our services: To process and manage your bookings, confirm your tour, arrange your pickup, and deliver the experiences you have purchased.

• Communicating with you: To send you booking confirmations, tickets, pre‑tour information (including pickup times via WhatsApp), and practical updates related to your booking; to respond to your enquiries and provide customer support.

• Improving our Site and services: To conduct statistical and analytical purposes, using aggregated or non‑personal data, intended to improve the Site, our product offerings, and the user experience.

• Legal and regulatory compliance: To comply with applicable laws, regulations, legal processes, or governmental requests (for example, maintaining financial records for tax purposes as required by UK law).

• Fraud prevention and security: To protect the rights, property, and safety of Sky Dunes Tours Ltd, our customers, and our partners, and to detect and prevent fraudulent transactions.

We will only use your Personal Information for marketing or promotional communications (e.g. newsletters, special offers) if you have given us your explicit, freely‑given consent to do so. You may withdraw that consent at any time.

Sharing with service providers and partners:

In order to operate our business and deliver your experience, we may share Personal Information with trusted third‑party service providers and partners, who act as data processors on our behalf. These may include:

• Payment processors: Stripe securely processes your online payments. We do not have access to your full card details.

• Analytics provider: Google Analytics helps us understand how visitors use our Site (subject to your consent preferences).

• Online Travel Agencies (OTAs): If you booked through a platform such as Viator or GetYourGuide, your booking data is shared back with us to fulfil your tour, in accordance with that platform's privacy policy.

• Local independent suppliers and guides: We share only the information necessary to operate your specific tour (e.g., first names, pickup location, dietary requirements) with the independent drivers, guides, and camp operators who deliver your experience in Morocco. These suppliers are contractually required to use your data only for the purpose of providing the booked service.

These service providers may be located in jurisdictions outside your home country, including the United States, the European Economic Area, and Morocco. Where required, we have implemented appropriate contractual safeguards to protect your data.

Legal disclosures:

We may also disclose Personal Information if we have a good‑faith belief that disclosure is reasonably necessary to: (i) comply with any applicable law, regulation, legal process, or governmental request; (ii) enforce our policies (including our Terms & Conditions), including investigation of potential violations; (iii) detect, prevent, or take action regarding illegal activities, suspected fraud, or security incidents; (iv) establish or exercise our rights to defend against legal claims; or (v) protect the rights, property, or safety of Sky Dunes Tours Ltd, our customers, or any third party.

6. User Rights

Under UK data protection law, you have the following rights regarding your Personal Information:

• Right of access: You may request confirmation as to whether or not Personal Information concerning you is being processed, and access your stored Personal Information, together with supplementary information.

• Right to data portability: You may receive a copy of the Personal Information you directly and voluntarily provide to us, in a structured, commonly used, and machine‑readable format.

• Right to rectification: You may request the correction of inaccurate or incomplete Personal Information held by us.

• Right to erasure ("right to be forgotten"): You may request the deletion of your Personal Information, subject to certain exceptions (e.g., where we are required to retain records for legal or tax purposes).

• Right to object: You may object to the processing of your Personal Information where we rely on legitimate interests as our legal basis, including for direct marketing.

• Right to restrict processing: You may request that we limit the processing of your Personal Information in certain circumstances — for example, while we verify the accuracy of contested data.

• Right to lodge a complaint: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom. Visit www.ico.org.uk for more information.

These rights are not absolute and may be subject to our own legitimate interests and regulatory requirements. For example, we may need to retain certain information to comply with our legal obligations or to defend legal claims.

If you wish to exercise any of the above rights, or have any questions about how your data is handled, please contact us using the details below. In your request, please specify which right you wish to exercise and provide sufficient information to allow us to verify your identity.

Data Protection Contact:

Sky Dunes Tours Ltd
Email: contact@skydunestours.com
WhatsApp: +212 603 287444
Registered Address: 128 City Road, London, EC1V 2NX, United Kingdom
ICO Registration: ZC167059

7. Data Retention

We will retain your Personal Information only for as long as is necessary to provide our services, comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods are determined based on the type of information collected and the purpose for which it is collected, taking into account applicable legal requirements and the need to securely delete or anonymise outdated, unused information at the earliest reasonable time.

Specifically:

• Booking records (including your name, contact details, pickup address, and transaction data): retained for 6 years from the date of your tour, to comply with UK tax and accounting regulations (HMRC requirements).

• Enquiries that do not result in a booking (e.g., WhatsApp messages, email enquiries): retained for up to 12 months from the last communication, after which they are securely deleted.

• Marketing consent records: retained for as long as your consent is valid, and for a limited period after withdrawal to evidence compliance.

• Payment card details: we do not store complete card numbers; our payment processors (Stripe) may retain transaction data in accordance with their own retention policies.

• Analytics data (non‑personal): aggregated and anonymised usage data may be retained indefinitely for statistical purposes.

We regularly review the data we hold and will take reasonable steps to delete or anonymise Personal Information once the applicable retention period has expired, unless we are required by law to keep it longer or need it to defend a legal claim.

We are committed to keeping the Personal Information we hold accurate and up to date. If you believe any information we hold about you is incomplete or inaccurate, please contact us and we will promptly correct it in accordance with your rights.

8. Cookies

When you visit our Site, we and our service providers may use cookies and similar technologies. A "cookie" is a small text file that a website stores on your device while you are browsing. Cookies are widely used and are helpful for a variety of purposes — they enable the Site to function efficiently, remember your preferences, and help us understand how visitors interact with our content.

Types of cookies used on our Site:

• Strictly necessary (session) cookies: These are essential for the core functionality of our Site. They allow you to navigate between pages, keep items in your booking cart, and complete the checkout process. These cookies are temporary and are automatically deleted when you close your browser. Under applicable data protection law, we do not require your consent to place these cookies.

• Preference and consent cookies (persistent): These cookies remember the choices you make on our Site — for example, your language preference and whether you have accepted or declined the use of non‑essential cookies. They are stored on your device for a fixed period and are not deleted when you close your browser.

• Analytics cookies (third‑party): With your consent, we use Google Analytics, a web analytics service provided by Google. Google Analytics uses cookies to collect information about how visitors use our Site. We have configured Google Analytics to anonymise IP addresses so that full IP addresses are never stored. We use the aggregated, non‑personal information we receive from Google Analytics solely to improve our Site and services.

Google's ability to use and share information collected by Google Analytics about your visits to our Site is governed by the Google Analytics Terms of Use and the Google Privacy Policy.

We do not use advertising cookies, targeting cookies, or any technology that tracks you across other websites for the purpose of serving advertisements.

Managing cookies and your consent: When you first visit our Site, a cookie consent banner will appear asking you to accept or decline non‑essential cookies (analytics cookies). Strictly necessary cookies are always active. You can change your preferences at any time by clicking the "Cookie Settings" link in the footer of our Site, or by adjusting your browser settings to block cookies. Please note that if you choose to disable certain cookies, some features of the Site may not function as smoothly, but your ability to book an experience will not be affected.

9. Third Party Collection of Information

This Privacy Policy applies to Personal Information collected directly by Sky Dunes Tours Ltd through our Site, WhatsApp, email, and phone communications. It does not apply to the practices of companies we do not own or control, or to individuals we do not employ or manage.

Specifically:

• If you book through an Online Travel Agency (OTA) such as Viator or GetYourGuide, your data is also subject to that platform's own privacy policy. We encourage you to review it.

• Our tours are delivered by trusted independent local partners (drivers, guides, camps) in Morocco. These partners may ask you for limited additional information on the day (for example, a contact number for the hike), which is governed by their own privacy practices.

• Our Site may contain links to other websites, such as social media platforms or partner sites. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy statements.

• To the extent you disclose your information to other parties or sites throughout the internet, different rules may apply to their use or disclosure of your information. We encourage you to read the terms and conditions and privacy policy of each third party you choose to disclose information to.

10. How We Safeguard Your Information

We take the security of your Personal Information seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

11. Transfer of Data Outside the EEA

Please note that some data recipients may be located outside the United Kingdom and the European Economic Area (EEA). In particular, to fulfil your booking, your Personal Information will be transferred to and processed by our independent local partners in Morocco. Morocco has not been granted an adequacy decision by the UK Government or the European Commission. However, such transfers are necessary for the performance of our contract with you (Article 49(1)(b) UK GDPR) and are protected by appropriate contractual safeguards with our local partners. Where we transfer your data to other service providers, we will transfer your data only to countries that have been deemed to provide an adequate level of data protection, or we will enter into legal agreements (such as Standard Contractual Clauses) ensuring an adequate level of data protection.

12. Advertisements

We do not use third‑party advertising technology to serve advertisements on our Site, and we do not use your information for personalised advertising or ad‑targeting purposes. If this changes in the future, we will update this Privacy Policy and obtain your consent where required by law.

13. Marketing

We do not currently use your Personal Information to send unsolicited marketing or promotional materials. We will only send you marketing communications (for example, information about new tours, special offers, or newsletters) if you have explicitly opted in to receive them. You will always have the right to unsubscribe from such communications at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us directly.

Please note that even if you have opted out of receiving marketing emails from us, we may still send you important transactional and service‑related communications without offering you the opportunity to opt out. These include booking confirmations, tickets, pre‑tour pickup information, and essential updates regarding a booking you have made.

14. Corporate Transaction

We may share information in the event of a corporate transaction (e.g. sale of a substantial part of our business, merger, consolidation or asset sale). In the event of the above, the transferee or acquiring company will assume the rights and obligations as described in this Privacy Policy.

15. Minors

We understand the importance of protecting children's privacy, especially online. Our Site is not designed for or directed at children, and we do not knowingly collect Personal Information directly from minors.

We do, however, collect limited information about children (such as age and any dietary or access requirements) when it is voluntarily provided by a parent or legal guardian as part of a family booking. This information is used solely to provide the booked experience safely and appropriately. By providing a child's information, the parent or guardian confirms they have the authority to do so.

If a parent or guardian becomes aware that their child has provided us with Personal Information without their consent, please contact us immediately at contact@skydunestours.com. We will promptly delete such information from our records.

16. Updates or Amendments to This Privacy Policy

We reserve the right to periodically amend or revise this Privacy Policy. When we make changes, we will update the "Last modified" date at the bottom of the page. Minor changes will be effective immediately upon posting on the Site.

If we make any material changes to the way we process your Personal Information, we will provide you with prominent notice (for example, via a banner on our Site or by email) and, where required by applicable data protection law, obtain your explicit consent before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

17. How to Contact Us

If you have any general questions about the Site, the information we collect about you, or how we use it, please contact us at:

Sky Dunes Tours Ltd
Email: contact@skydunestours.com
WhatsApp: +212 603 287444
Registered Address: 128 City Road, London, EC1V 2NX, United Kingdom
ICO Registration: ZC167059

Last Modified: June 2026