Privacy policy

1. Data controller

The data controller is SiteAuto | Location Service, Aéroport de Fès-Saïss, Fès, Maroc. Contact for any question about your data: [email protected] · +212 700 143 454.

2. Data collected and purposes

• Booking form: name, e-mail address, requested vehicle, insurance type, rental dates and a free-text message (optional). Purpose: reply to your request and prepare the rental. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• IP address and request date: website security and prevention of spam and abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Technical logs of the host (Hostinger): IP address, date and pages viewed, to keep the site running and secure. Legal basis: legitimate interest.
• Exchanges by e-mail, phone or WhatsApp: information you give us to organise your rental. Legal basis: pre-contractual steps or performance of the contract.
• Commercial contact (optional): if you answer “Yes” in the form, we keep your data for 24 months and may send you our newsletter and offers. Legal basis: your consent (Art. 6(1)(a) GDPR, Law 09-08), which you may withdraw at any time, free of charge, by writing to [email protected] or via the unsubscribe link. Answering “No” has no effect on how your request is handled.

We collect no sensitive data, carry out no profiling and take no automated decisions about you.

3. Retention periods

• Requests with consent (“Yes”): 24 months from the request, then automatically deleted (IP address included). During this period you may receive our newsletter; you can unsubscribe at any time.
• Requests without consent (“No”): data used only to handle your request, automatically deleted 3 months after the end date of the reservation.
• If a rental is concluded: data needed for the contract and legal obligations (accounting, insurance) is kept for the applicable legal period.
• Anti-abuse counters (IP address): 24 hours.
• Host logs: period set by the host under its own policy.

4. Who receives your data

Your data is intended for the SiteAuto | Location Service team. It may be processed by providers acting as processors: the website host (Hostinger) and the e-mail delivery service. We do not sell or rent your data and do not use it for advertising.

5. Third-party services

• WhatsApp: the WhatsApp button opens WhatsApp (Meta) only when you click. Your message is then subject to WhatsApp’s privacy policy.
• Google Maps: on itinerary pages, the map is loaded only after you click “Show the map”. Google then receives your IP address and may set cookies.
• External links (festival, Pexels, etc.): these sites have their own privacy policies.

The site’s fonts, icons and scripts are hosted on our own server: no third-party service is contacted when pages open.

6. Cookies and trackers

The site uses only one technical session cookie (PHPSESSID), which protects forms against fraud (CSRF token) and expires when your visit ends. It is strictly necessary for the service and does not require your consent. No advertising or audience-measurement cookies are set. If an audience-measurement tool were added, it would only be enabled with your consent, unless configured under the exemption described in CNIL guidance.

7. Security

We protect your data with an encrypted connection (HTTPS), administration access protected by a hashed password and attempt limiting, anti-spam filtering and regular updates. In the event of a data breach likely to put your rights and freedoms at risk, we will inform you and the competent authority within the legal deadlines.

8. Where data is processed

SiteAuto | Location Service is based in Morocco. Your data may be processed in Morocco and on the host’s servers. We undertake to apply a level of protection equivalent to that required by the GDPR for people located in the European Union.

9. Your rights (GDPR)

You have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set directions for its fate after your death (France). You may withdraw any consent given at any time. To exercise your rights, write to [email protected] stating the purpose of your request; proof of identity may be requested if in doubt. We reply within one month.

10. Moroccan Law 09-08 and the CNDP

As the site is operated from Morocco, the processing of your data is also subject to Law No. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data, supervised by the National Commission for the Control of Personal Data Protection (CNDP). This law gives you, in particular, the rights to information, access, rectification and objection on legitimate grounds. You can exercise them by writing to [email protected], or contact the CNDP: www.cndp.ma.

11. Complaints to a supervisory authority

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), the data protection authority of your country of residence or, in Morocco, the CNDP (www.cndp.ma).

12. Changes

This policy may change, in particular when a new feature is added or the law changes. The date of the latest update appears at the top of this page.