Small print

Privacy policy

Plain language first: we collect as little as possible, we never sell it, and there are no analytics or advertising trackers on this site.

1. Who we are

The controller responsible for your personal data is Lalla Surf, [Street address], Imsouane, Morocco (“we”, “us”). Contact for any privacy question or request: [Contact email].

This policy is written to meet Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, the EU General Data Protection Regulation (GDPR) and ePrivacy rules, the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act as amended by the CPRA. CNDP declaration receipt no.: [CNDP declaration number].

2. What we collect

When	Data	Required?
You share a story	Name, optional Instagram handle, story title, description and text, the date of the story, the photos you upload (and anything visible in them).	Name, title, description, date and one photo are required to review a story; Instagram is optional.
You contact us	Name, email address, topic and message. A salted, one-way hash of your IP address is stored with it for spam and rate limiting — we never store the IP itself.	Yes, so we can reply.
You browse	Our host, Cloudflare, processes technical data (IP address, browser user-agent, requested URL, time) to deliver the site and protect it from abuse. We do not run analytics.	Necessary to serve the site.
On your device	Small storage items for the site to work and, only if you allow it, to remember music player settings and your language choice. See the cookie policy.	Optional items need consent.
Admin sign-in (staff only)	Staff email, name and a hashed sign-in secret; a session cookie.	Yes, for staff.

Please don't include sensitive information (health, religion, political views, ID numbers) in stories or messages. We do not ask for it.

3. Why we use it and on what basis

Publishing community stories — reviewing and, if approved, publishing your story on this site and possibly on @lallasurf. Basis: your consent, given when you submit (GDPR Art. 6(1)(a); Law 09-08 Art. 4). You can withdraw it at any time and we will take the story down.
Answering messages — Basis: steps at your request / our legitimate interest in responding (Art. 6(1)(b)/(f)).
Running and securing the site — hosting, spam prevention, rate limiting, admin sign-in. Basis: legitimate interest in a secure, working website (Art. 6(1)(f)).
Remembering preferences — only with your consent via the cookie banner.

We do not sell or “share” personal data for cross-context behavioural advertising, do not profile you and make no automated decisions with legal effects.

4. What becomes public

If we approve your story, your name, Instagram handle (if given), story text, date and photos are published and visible to anyone. Contact messages are never published.

5. Who processes it for us

We use Cloudflare, Inc. as processor for hosting (Workers), the database (D1) and file storage (R2), under its data processing addendum. Cloudflare may process data in its global network, including outside Morocco and the EEA. Fonts are bundled with the site and served from our own domain — no requests go to Google or other font services. Instagram links open Instagram (Meta), which has its own policy; we embed no Instagram code. We disclose data to authorities only where the law requires it.

6. International transfers

Because Cloudflare operates worldwide, data may be transferred outside Morocco, the EEA and the UK. Such transfers rely on Cloudflare's Standard Contractual Clauses (EU) and UK Addendum, and Cloudflare's participation in the EU-US Data Privacy Framework. For Morocco, transfers are made subject to the formalities of Law 09-08 (Art. 43–44) and the CNDP: [CNDP transfer authorisation number].

7. How long we keep it

Published stories: until you ask us to remove them or we take them down.
Rejected submissions: deleted, together with their photos, within [90 days].
Contact messages: deleted once handled, and at the latest after [12 months].
Booking requests: kept while we arrange your stay, then deleted at the latest after [24 months].
Admin session cookie: 7 days. Hosting logs: per Cloudflare's short retention periods.

8. Your rights

Depending on where you live you can ask us to: access your data; correct it; delete it; restrict or object to processing (including the right of opposition under Law 09-08); receive it in a portable format; and withdraw consent at any time without affecting earlier processing. Write to [Contact email] or use the contact form; we answer within one month. We may ask you to confirm it's you.

You can complain to a supervisory authority: in Morocco the CNDP; in the EU your local data protection authority; in the UK the ICO; in California the California Privacy Protection Agency. We'd appreciate the chance to fix things first.

9. California and other US states

In the last 12 months we collected the categories in section 2: identifiers (name, email, Instagram handle, hashed IP), user-generated content and photos, and internet activity limited to hosting logs. Sources: you, and your browser. Purposes: section 3. We have not sold or shared personal information and do not use or disclose sensitive personal information. You have the right to know, delete, correct and opt out, and not to be discriminated against for using them. We honour Global Privacy Control signals — there's nothing for them to opt you out of, as we neither sell nor share.

10. Security

All traffic is encrypted (HTTPS). The database is only reachable by the site itself; staff access requires a strong, hashed password and a signed, HTTP-only session cookie. Photo uploads go through time-limited signed links restricted to images. No system is perfect; if a breach affecting you occurs we will notify you and the authorities as the law requires.

11. Children

The site is not aimed at children. If you are under 16 (or the age of digital consent where you live), please ask a parent or guardian before sharing a story. Tell us if a child has sent us data and we'll delete it.

12. Changes

We'll update this page if what we do changes, and change the date at the top. Significant changes will be flagged on the site.