HAYYA MOROCCO LTD
Company Registration Number: 17472452
Last Updated: 9 October 2026
1. Our Commitment to Data Protection
Hayya Morocco recognises that protecting customer information is an essential part of providing reliable travel and booking services.
As a company registered in England and Wales and organising travel experiences in Morocco, we handle personal information relating to enquiries, reservations, payments, customer accounts, travel arrangements, and communications.
This statement explains our approach to protecting that information and managing privacy-related responsibilities.
It should be read alongside our Privacy Policy, which describes the categories of information we collect, the purposes and legal bases for processing, and the rights available to individuals.
2. Applicable Data Protection Framework
HAYYA MOROCCO LTD is subject to applicable UK data protection legislation, including the UK GDPR and the Data Protection Act 2018, as amended.
Where personal information is processed in circumstances covered by Moroccan Law No. 09-08, the relevant Moroccan requirements must also be considered.
Additional laws may apply depending on the customer’s location, the services involved, and the nature of the processing.
3. Data Minimisation and Appropriate Use
We aim to collect and use personal information only when it is relevant to a clearly identified purpose.
For bookings and travel arrangements, this may include contact information, participant details, selected experiences, travel dates, payment references, and requested additional services.
Information should not be collected merely because it might be useful at a later date.
Where sensitive information is genuinely required for a specific activity or arrangement, additional data protection requirements must be considered.
4. Access to Customer Information
Customer and booking information should be accessible only to personnel and service providers who require it for an authorised purpose.
Relevant purposes may include:
- Managing customer reservations.
- Coordinating travel arrangements.
- Responding to support requests.
- Processing payments and refunds.
- Maintaining website functionality.
- Investigating security incidents.
- Meeting legal or accounting obligations.
Access permissions should be managed according to the responsibilities of the person or service provider involved.
Access should be reviewed when roles change or access is no longer required.
5. Website and Booking System Protection
Hayya Morocco uses WordPress and its Hayya Manager booking system to provide travel-related services.
Website security and maintenance activities should include appropriate consideration of:
- Software updates.
- Administrative access.
- Account permissions.
- Secure authentication.
- Vulnerability management.
- Backup and recovery procedures.
- Security monitoring.
- Protection of booking records.
The exact safeguards implemented depend on the website infrastructure and its current configuration.
We do not represent any security system as completely immune to cyber threats.
6. Payment Data Protection
Online payments are processed through Stripe.
Payment transactions may involve payment authentication, fraud-prevention measures, and relevant financial information.
Hayya Morocco personnel should not request full payment card details, card security codes, or banking passwords through ordinary email, WhatsApp, or social media messages.
Customers receiving an invoice or payment request should verify that it comes through an authorised Hayya Morocco communication channel and complete payment through the relevant secure payment process.
Stripe’s processing activities are also governed by its applicable privacy and security documentation.
7. Sharing Data with Travel Partners
Providing travel services may require limited sharing of relevant customer information with local activity providers, hotels, transport operators, guides, and other suppliers.
The information shared should be appropriate to the service the customer has booked or expressly requested.
For example, a transfer provider may need the agreed pickup location and contact details, while an accommodation provider may need reservation-related information.
Each arrangement should be assessed to determine the applicable data protection responsibilities, including whether the recipient is an independent controller or a processor.
8. International Data Protection
Because Hayya Morocco operates across the United Kingdom and Morocco, some personal information may be accessed or processed internationally.
Where cross-border data transfer restrictions apply, appropriate legal mechanisms and safeguards must be identified before the transfer.
Relevant service-provider agreements and data-processing arrangements should be reviewed where required.
The company should also evaluate whether any notification or authorisation obligations apply to particular processing activities under Moroccan law.
9. Retention and Secure Disposal
Personal information should not be retained indefinitely without a legitimate purpose.
Records may need to be retained for bookings, financial accounting, legal obligations, dispute resolution, or other justified purposes.
Retention decisions should take account of the nature and sensitivity of the information, the purpose of processing, and applicable legal requirements.
Information that is no longer required should be securely deleted, anonymised, or otherwise handled under an appropriate disposal procedure.
10. Data Protection Incidents
If a suspected personal data breach or security incident occurs, Hayya Morocco should assess the nature of the incident, identify affected information and individuals, take appropriate containment measures, and document the incident.
Where legally required, the relevant supervisory authority must be notified within the applicable time limit.
Affected individuals must also be informed where the relevant legal notification threshold is met.
Actions taken in response to an incident should be proportionate to the risks involved.
11. Customer Privacy Rights
Customers may have legal rights concerning their personal information, including access, correction, erasure, objection, restriction of processing, and data portability, subject to the applicable legal conditions.
Requests should be sent to:
We may need to verify a requester’s identity before providing access to personal information.
Requests will be handled in accordance with the applicable response deadlines and legal requirements.
For a fuller description of individual rights, please consult our Privacy Policy.
12. Complaints and Concerns
Customers who believe that their personal information has been handled incorrectly may contact Hayya Morocco directly.
We will acknowledge data protection complaints in accordance with the applicable legal requirements, investigate them appropriately, and communicate the outcome.
Individuals may also have the right to contact a relevant supervisory authority.
United Kingdom: Information Commissioner’s Office — https://ico.org.uk
Morocco: Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel — https://www.cndp.ma
13. Changes to This Statement
This statement may be revised as our services, processing arrangements, security procedures, or legal obligations change.
The updated version will be published on this page.
14. Contact Information
HAYYA MOROCCO LTD
Company Registration Number: 17472452
Registered in England and Wales, United Kingdom
Email: contact@hayyamorocco.com
Telephone / WhatsApp: +212 623-671750
Website: https://hayyamorocco.com
For further information about the handling of personal data, please consult our Privacy Policy.