Privacy at Wingfoil Academie

Who looks after your information

For the activities described in this policy, Wingfoil Academie decides how personal information is used. We are a wingfoil, kitesurf and surf school in Essaouira, Morocco.

Privacy questions or requests can be sent to contact@wingfoilacademie.com. Our public location is Beach, Av. Mohammed V, Rue Lalla Hasna, Essaouira, Morocco.

What we receive

When you use the contact page, you give us your name, email address, phone or WhatsApp number, subject and message. The phone or WhatsApp field is required so we have a practical way to follow up about time on the water.

A booking request contains the activity, lesson format, duration, number of people, preferred date and time, name, email, required phone or WhatsApp number, optional message, and the package price calculated by our server. Please do not add passport details, payment information, health information or other sensitive data to an open message field.

To keep the forms reliable, the server uses limited request details to create keyed, pseudonymous abuse-control identifiers. These counters are held in a private security database and are not added to your booking record. Cloudflare Turnstile may also process technical browser and network information to distinguish genuine visitors from automated traffic.

Why we use it

We use these details to answer questions, calculate the selected package total, check wind and scheduling preferences, organise a requested session, follow up about availability, and keep a record of what was requested. We also use limited technical information to protect the forms, maintain the website and meet legal or administrative obligations.

In legal terms, this processing is connected to responding to your request and taking steps toward providing a service, our legitimate need to operate and secure the website, compliance with applicable obligations, or your consent where consent is required. We do not sell or rent personal information, and we do not add you to marketing messages without a separate choice.

How a booking request travels

When you press Book Your Session, the server checks the details and security token, recalculates the current package price and promotion, records the inquiry in the protected booking system, and sends the validated request to Wingfoil Academie by email. The success message appears only after that email delivery succeeds.

The website can then open WhatsApp with a localized copy of the same inquiry. This is an optional way to continue the conversation. Opening WhatsApp does not send the message; you still choose whether to tap Send. Your email inquiry and protected booking record have already been received either way. A request is not a confirmed reservation, and no online payment is taken.

Who may handle it

Access is limited to people authorized to manage Wingfoil Academie inquiries and the technical services needed to run the website. Those service categories may include secure hosting, database and media storage, website maintenance, and email delivery. They should receive only the information needed for their role.

We do not publish booking details, sell personal information, or share it with unrelated businesses for their own advertising. We may disclose information where the law requires it, to protect a person’s safety or rights, or to investigate misuse of the website.

Google Maps, WhatsApp, Turnstile and email delivery

The contact page contains an embedded Google Map. When that page loads, Google may receive technical details such as an IP address, device or browser information, interactions and approximate location signals, according to your settings and Google’s own policy.

WhatsApp is an external Meta service. If you open or send a WhatsApp inquiry, WhatsApp processes your account, device and message information under its own terms. You may close the prepared WhatsApp message without sending it because the booking request has already reached us by email.

Cloudflare Turnstile protects the public forms from automated abuse and may process network, device and interaction signals for that check. Our hosting mailbox and SMTP service handle the automatic email copy of a contact or booking request.

Cookies and similar technology

Wingfoil Academie does not currently use its own analytics or advertising cookies on the public website. Essential session cookies protect the private CMS used by authorized administrators; public visitors do not need an account.

The embedded Google Map and external services may use their own cookies, local storage or identifiers. Your browser can restrict third-party cookies, although the map or another external feature may then work differently. If analytics or advertising tools are introduced later, this policy and any consent choices required at that time will be updated first.

How long we keep it

Booking inquiries are kept while we answer, organise and follow up on the requested activity, and afterwards only for as long as reasonably needed for administration, legal or accounting duties, disputes and security. When the information is no longer needed, it should be deleted or anonymised.

Messages that reach us by email follow the retention settings of the academy mailbox. A WhatsApp draft that you close without sending is not received through WhatsApp. Keyed anti-abuse counters become eligible for deletion after seven days and are cleared by daily or startup maintenance. They do not contain the plain network address, email or phone number and are not added to the booking record.

How we protect it

The website uses server-side validation, strict request-size and time limits, same-origin checks, Cloudflare Turnstile, short-term throttling and durable daily quotas on public forms. Email delivery is pooled and capped to prevent a burst of requests from exhausting the mailbox. Booking records sit behind authenticated CMS access and role permissions. Database credentials, email-provider keys and other secrets stay on the server, and production traffic uses HTTPS.

No internet service can promise zero risk. We limit the data requested, restrict access and review the safeguards around the systems that carry an inquiry. Please avoid sending sensitive information through ordinary email, WhatsApp or free-text fields.

Your choices and rights

Morocco’s Law No. 09-08 gives people rights over their personal data, including the right to ask what is held, request correction, object on legitimate grounds, and request deletion where the law allows. If processing relies on consent, you may withdraw that consent for the future. Depending on where you live, other privacy rights may also apply.

Write to contact@wingfoilacademie.com and describe the request clearly. We may need enough information to confirm your identity before acting, so another person’s data is not disclosed by mistake. If you believe a request has not been handled properly, you may contact Morocco’s Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

Requests involving a child

A parent or legal guardian should submit and manage an inquiry for a child. Share only the information needed to discuss the activity and suitability of the session. If you believe a child has sent personal information through the website without appropriate permission, contact us so we can review and remove it where required.

Services operating across borders

Some hosting, email, Google or WhatsApp infrastructure may process information in countries outside Morocco. When cross-border processing is involved, we take reasonable steps to use appropriately secured services and to address transfer requirements under applicable law. The external-service policies linked on this page explain where those providers operate and the choices they offer.

When this policy changes

We will revise this page when the booking flow, contact channels, providers, cookies or legal requirements change in a way that affects privacy. The date at the top shows the latest published version. Material changes will be explained clearly rather than hidden in technical language.