Privacy policy

TSTOV LTD (company number 15919027), registered in England and Wales, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, operates this website and is responsible for the personal data collected through it. Contact: taghazoutsurfers.teams@gmail.com.

To deliver your booking, we share the necessary details with our partners in Morocco: Taghazout Surfers (surf lessons, rentals, guiding and transfers) and Amlal (accommodation).

• Contact form: name, email, phone number (optional), subject and message.
• Bookings: first and last name, email, phone number, dates, number of guests, notes, selected services and add-ons, totals, payment method and payment status, and the date, time and version of the terms you accepted.
• Payments: from Stripe or PayPal we receive the payment confirmation, amount, currency and transaction reference. We never receive or store your full card number or security code.
• Messages you send us by email or WhatsApp.
• Website usage: pages viewed and booking steps reached, through the analytics tools listed below.

• Card payments are made on Stripe’s secure checkout page. You are redirected from our website to Stripe, enter your card details there, and are sent back to our confirmation page. Your card details go directly to Stripe over an encrypted (HTTPS) connection and never pass through or stay on our website or booking system.
• PayPal payments are made in PayPal’s own secure window. We receive only the confirmation and the transaction reference.
• Stripe and PayPal process your payment data under their own privacy policies and the card industry security standard (PCI DSS).
• Our website and booking system are only served over HTTPS.

• To answer your enquiry and to confirm, deliver and manage your booking, including sending confirmations, meeting point and pickup details (to perform our contract with you).
• To take payments, issue refunds and keep accounting records (contract and legal obligations).
• To protect the contact form from spam (Cloudflare Turnstile) and keep the website secure (legitimate interests).
• To measure and improve the website and our advertising (legitimate interests or your consent where required).

• Our booking management system, hosted on Amazon Web Services, stores bookings and enquiries and sends confirmation emails to you and booking notifications to our team.
• Stripe and PayPal, for online payments.
• WhatsApp (Meta), when you choose to message us there.
• Cloudflare Turnstile, to check that contact form submissions are not spam.
• Google Tag Manager, Google Analytics 4, Microsoft Clarity and the Meta Pixel, which load after you interact with the page and record pages viewed and booking steps. We do not send them your card details.

We share your data only with the partners and providers above, when needed for the purposes described, or when the law requires it. We do not sell your personal data. Some providers are based outside the United Kingdom and Morocco (for example in the United States); they protect transfers with recognised safeguards such as standard contractual clauses.

We keep booking and payment records for 6 years for accounting and legal purposes, and enquiries that do not lead to a booking for up to 2 years. Then we delete or anonymise them.

You can ask to access, correct or delete your data, to restrict or object to its use, to receive a copy of it, and to withdraw your consent at any time. Write to taghazoutsurfers.teams@gmail.com or call +212 668 366 890. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).