Your privacy

Privacy Policy

Name: Palmexc
Address: Circuit des jardins de la palmeraie, Marrakech, Marrakech-Safi, 40060, MA
Telephone: +212 671-660985
Price range: $$
Rating: 4.9

Last updated: 2026-08-29

This policy explains what information the PalmExc website (www.palmexc.com) collects, why, who it is shared with, and the choices you have. It covers the website only — a WhatsApp conversation you start with us is governed by WhatsApp's own terms and by how our team handles the messages you send.

PalmExc runs private quad, camel and pony tours in the Marrakech Palmeraie. Most people reach us to ask about or arrange a tour, and the data below reflects that.

Notice: pending professional review

This page is drafted to describe the website's actual data practices accurately. Items marked TODO(owner) below still need a real-world detail confirmed by the business owner or a lawyer before this policy is final. They do not change what the site does today; they are gaps in the formal disclosure.

TODO(owner): Confirm the legal entity name, trading name and any company/commercial registration number for PalmExc, and name the data controller.
TODO(owner): Add a postal business address for privacy correspondence.
TODO(owner): Decide whether to publish a dedicated privacy/data-request email address. The site currently exposes only the WhatsApp/phone line (+212 671-660985); data-subject requests route there until an email is added.
TODO(owner): Set the retention period for booking enquiries held in the Google Sheet and the notification mailbox, and who has access to them.
TODO(owner): Have counsel confirm the lawful bases for each processing purpose (e.g. consent for analytics/ads, legitimate interest or contract for handling a booking enquiry).
TODO(owner): Document the international data-transfer safeguards for Google, Meta and Vercel (e.g. Standard Contractual Clauses / Data Privacy Framework) that apply to the business's jurisdiction.
TODO(owner): State the applicable data-protection law(s), the specific data-subject rights that follow, and the supervisory authority a visitor may complain to.
TODO(owner): If EU/UK visitors are targeted, confirm whether an Art. 27 representative or a Data Protection Officer is required and add their details.
TODO(owner): Confirm the Google Apps Script webhook and its Google account owner, and whether booking rows are ever exported elsewhere.

1. What we collect

Analytics data (Google Analytics 4). When you allow it, Google Analytics sets cookies and collects usage data: pages viewed, referring links, approximate location (derived from your IP address by Google — we do not receive your full IP), device and browser type, language, and on-page interactions such as opening the booking dialog or clicking a WhatsApp button. We configure these as events with no name, phone number or email attached.

Advertising data (Google Ads). When you allow it, we measure the performance of our Google Ads. If you arrive from a Google ad, the click carries an identifier (a "GCLID", or the related "wbraid"/"gbraid" values) in the page URL. We read that identifier once and store it in your browser for up to 90 days so that, if you later send a booking enquiry, we can attribute it to the ad click. It is included with your enquiry (see section 2) and is used only for conversion measurement.

Enhanced Conversions (Google Ads). When you allow it and you submit the booking form, the email address and phone number you entered are converted in your browser into a one-way SHA-256 hash (an irreversible fingerprint) and sent to Google alongside the conversion. Google uses the hash to match the conversion to an ad click. The plain-text email and phone are never sent to Google — only the hash.

Advertising data (Meta Pixel). When you allow it, the Meta (Facebook/Instagram) Pixel loads and reports standard events to Meta — that a page was viewed, and a "Lead" event when you submit the booking form or open a WhatsApp chat link. The booking form's "Lead" event includes the chosen experience name; it does not include your name, phone or email.

Booking form enquiries. When you submit the booking form you provide: your name, phone number, email address (optional), preferred date, number of people, and the experience you want. If you arrived from a Google ad, the stored click identifier from the point above is attached to this submission.

Consent choice. Your cookie choice is stored in a first-party cookie named palmexc_consent so we can honour it on later visits without asking again.

2. What happens to a booking enquiry

A booking form submission is sent to our own server endpoint (/api/booking on this domain), which validates it and then forwards it to a Google Sheet through a Google Apps Script webhook. The same submission also generates an email notification to the business so we can respond quickly.

We use these details only to contact you about your enquiry and to arrange the tour. We do not sell them, and we do not use them for marketing email lists.

The Google Sheet and the notification mailbox are hosted on Google Workspace. TODO(owner): the retention period for these enquiry records, and the list of people with access, is to be confirmed.

3. Third parties

The website relies on the following third-party services, each with its own privacy policy:

Google — Google Analytics 4 and Google Ads (measurement and advertising), and Google Maps / Places (the embedded map and the live rating and review snippets shown on the site). See policies.google.com/privacy.
Meta Platforms — the Meta Pixel for advertising measurement on Facebook and Instagram. See facebook.com/policy.php.
Vercel — hosting and content delivery for the website and its /api endpoints; Vercel processes standard server request logs. See vercel.com/legal/privacy-policy.
Google Workspace (Apps Script + Sheets + Gmail) — stores and notifies the business of booking enquiries, as described in section 2.

4. Cookies and similar technologies

Before you make a consent choice, and if you choose "Reject non-essential", no analytics or advertising cookies are set and the Google Analytics, Google Ads and Meta Pixel tags do not send data. This is enforced in the site's code, not only by the tag vendors.

Strictly necessary only: palmexc_consent (your consent choice; about 6 months). This is always set once you make a choice.

Set only after you choose "Accept all": Google Analytics cookies (for example _ga and _ga_*), Google Ads cookies (for example _gcl_*), and the Meta Pixel cookies (_fbp, and _fbc if you arrived from a Meta ad). The Google click identifier is also kept in your browser's local storage (key palmexc_click_id) for up to 90 days.

If you later change your choice to "Reject non-essential", the site clears the stored click identifier and asks your browser to drop the Google and Meta cookies listed above.

5. Your choices and how to change consent

On your first visit a banner asks you to choose between "Reject non-essential" and "Accept all". Both buttons are given equal weight — rejecting is a single click, the same as accepting.

You can change your mind at any time using the "Cookie settings" link in the site footer, which reopens the banner. Rejecting after previously accepting stops analytics and advertising going forward and triggers the cookie clean-up described in section 4.

You can also block or delete cookies in your browser settings, and use your browser's or operating system's ad-tracking controls.

For the booking details you have already submitted, you can ask us to show you what we hold, correct it, or delete it — contact us using the details in section 7.

6. International transfers, retention and legal basis

Google, Meta and Vercel are US-headquartered and may process data on servers outside your country.

TODO(owner): the specific transfer safeguards (such as Standard Contractual Clauses or the EU-US Data Privacy Framework), the lawful basis for each purpose, the applicable data-protection law, your resulting rights, and the supervisory authority for complaints are to be confirmed in professional review. See the notice at the top of this page.

Known retention today: the palmexc_consent cookie lasts about 6 months; the stored Google click identifier expires after 90 days; Google Analytics and Google Ads apply their own account-level retention to the data they hold.

7. Contact

For any question about this policy or a request about your data, contact PalmExc — WhatsApp or phone: +212 671-660985.

TODO(owner): add a postal address and, if desired, a dedicated privacy email address here.

8. Children

The website is intended for adults arranging a tour. It is not directed at children, and we do not knowingly collect data from children through the site. Bookings that include children are made by the accompanying adult.

9. Changes to this policy

If we change how the site handles data we will update this page and the "last updated" date above. Material changes to tracking take effect only after you have made (or renewed) a consent choice.