Confidentialité et mentions légales
Cette page est disponible uniquement en anglais.
Privacy notice
Who we are
This website is operated by James Carter, trading as Sunrise Surf House, at Sunrise Surf Apartments, Hay Tamaouanza, 80508 Aourir, Morocco. We are the data controller for the personal data described below.
For any privacy question or request, write to privacy@sunrisesurfhouse.com.
Our declaration to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) under Moroccan law 09-08 is pending. This notice will be updated with our declaration number once issued.
What we collect, and why
| What | Why we need it | Legal basis |
|---|---|---|
| Name, email, phone or WhatsApp, country of residence | To take and manage your booking and contact you about it | Performance of your booking contract |
| Number of guests | To prepare your stay | Contract |
| Dates, apartment, arrival time, any notes you add | To provide your accommodation | Contract |
| Passport or national ID number | Moroccan law requires us to register every guest with the authorities | Legal obligation |
| Your typed signature, when you signed, your IP address and browser | To record that you agreed to the rental agreement | Contract; our legitimate interest in a reliable record |
| Payment card | Handled entirely by Stripe. We never see or store your card number. We hold only a token that lets us charge the instalments you agreed to | Contract |
| Referral code, if you used one | To credit the person who referred you | Legitimate interest |
| How you found us, if you tell us | To understand what works | Consent — the field is optional |
| Messages you send us | To reply to you | Contract; legitimate interest |
| Your email address, if you start a booking and don't send it | An hour later we may email you once with a link back to your dates. We don't follow up | Legitimate interest |
| Your email address, after your stay | After your stay we may email you once to ask for a review. We don't follow up | Legitimate interest |
We do not use tracking or advertising cookies. We do not sell your data or share it for anyone else’s marketing.
Who else handles it
These services hold data on our behalf:
- Supabase — database and file storage, in Ireland
- Vercel — website hosting
- Stripe — card payments and scheduled instalments
- Resend — booking emails
- GitHub — encrypted nightly backups, which GitHub cannot read
- Airbnb — only if you booked through them, under their own privacy policy
Your data is therefore stored outside Morocco, in the European Union and the United States.
Moroccan law also requires us to provide guest identity details to the national police (DGSN).
How long we keep it
| Data | How long |
|---|---|
| Booking records and signed rental agreements | As long as required for tax and accounting purposes |
| Passport or ID numbers | 3 years after your stay, then deleted. If your booking is declined, expires or is cancelled before you arrive, deleted straight away |
| Payment tokens | Until your final instalment clears, then removed. Removed straight away if your booking doesn't go ahead |
| Enquiries, unfinished bookings, and requests that don't go ahead with nothing charged | 12 months |
| Referral records | 3 years after the stay. A commission earned or paid is kept with our accounting records |
Deleted data leaves our encrypted backups within 30 days.
How we protect it
All data travels over encrypted connections. ID numbers are encrypted in our database. Access is limited to the owner and the house manager. Card details never reach our systems.
Your rights
Under Moroccan law 09-08, and the GDPR if you are in the European Union, you can ask us to:
- give you a copy of the data we hold about you
- correct anything that’s wrong
- delete your data, where we aren’t required to keep it
- object to or restrict some processing
- send your data to you in a portable format (EU residents)
- withdraw your consent, where consent is the basis
Write to privacy@sunrisesurfhouse.com. We’ll reply within 30 days. You can also complain to the CNDP in Morocco, or to the data protection authority in your EU country.
Some records we can’t delete on request — signed agreements, tax records and guest registration are kept because the law requires it.
Changes
We’ll post changes here with a new date. If a change affects an existing booking, we’ll email you.
Last updated: 9 October 2026
Booking terms
Who you’re booking with. Your booking is with James Carter, trading as Sunrise Surf House. The rental agreement you sign at checkout governs your stay; these terms summarise it and, where they differ, the signed agreement applies.
A booking is a request until approved. Every booking is reviewed by the owner before it is confirmed, usually within a few hours. Your card is authorised, not charged, until then. If we can’t accept your booking, the authorisation is released and you pay nothing.
Payment. The dated payment schedule shown at checkout is what you agree to. Later instalments are charged automatically to the card you saved, on the dates shown. We email you before each one. If an instalment fails, we’ll send you a link to pay another way.
Cancellation. Cancellation terms are set out in our FAQ and in your rental agreement. Refunds are calculated on the total booking value and never exceed the amount you have paid so far.
Prices and currency. Prices are set in Moroccan dirhams. Card payments are charged in euros at the exchange rate fixed when you book, and every later instalment uses that same rate.
Security deposit. A refundable deposit of 500 MAD is paid in cash at check-in and returned after the post-stay inspection. It is not part of the online total.
House rules. Set out in your rental agreement and the house manual.