Who is responsible for your data
Accrocar is responsible for the processing of personal data described in this policy.
- Controller
- Accrocar
- Address
- Lot Bouizgaren, Bd Abdelkrim Al Khattabi, Marrakech 40000, Morocco
- contact@accrocar.com
- Telephone
- +212 711 640 999
Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data applies to this processing.
The data we receive
Car booking and contact forms
The booking forms on vehicle pages and on the booking page ask for your name, your telephone number with its country code, your dates and the vehicle, and optionally a type of delivery place and an address. The contact form asks for your name, email address and telephone number, the service you are interested in and your message.
When you send one of these forms, it opens WhatsApp with your request already written and, at the same moment, sends a copy of the same request to our server over an encrypted connection, with the language and address of the page you used. Our server checks it and records it in Accrocar's internal client and booking management system, so that our team can follow up your request even if you do not send the WhatsApp message. It also records whether the page opened WhatsApp — never whether a message was sent.
Private flight request form
The private jet and helicopter request form asks for the type of service and trip, departure and destination, dates and preferred time of day, number of passengers, luggage, any aircraft preference and your notes, together with your name and email address, and optionally a telephone or WhatsApp number. The form also sends the language of the page and the page you sent it from.
Messages, emails and calls
When you write to us on WhatsApp or by email, or call us, we receive what you choose to share: usually your contact details and the details of your trip or event.
When you go ahead with a booking
To prepare and perform a service, we or the provider may ask for the information it requires: for example the names of passengers, a driving licence for a self-drive vehicle, passport or identity details for a flight manifest, and the details needed to take a payment or deposit as described in your proposal.
Technical data
To protect the request forms against abuse, our server uses your IP address to limit the number of requests, and stores it only in a coded form that cannot be turned back into the address. Our host also processes the technical connection data of every visit, such as IP address, date and page requested, as any web server does.
Content loaded from Google
The photos of reviewers in the Google reviews section of the homepage are loaded from Google's servers, and the map on our contact page is a Google Maps frame that loads only if you choose to display it. In both cases your browser connects to Google, which receives your IP address and browser details under its own policies; the map can also set Google's own cookies. See Cookies below.
Preferences and advertising measurement
Your language, your consent choice and, while the tab is open, a reference for each request you send are kept in your browser. Only if you allow advertising measurement are Google Ads, the Meta Pixel and OpenAI Ads loaded: they receive the technical details of your visit and, when a request you send is accepted, a conversion with the type of request and a random reference. They never receive your name, email address, telephone number or messages from us. The site uses no analytics tool. See Cookies below.
Fields marked as required are needed for us to answer your request; without them we cannot handle it. The other fields are optional. Please do not send sensitive information (such as health data) unless it is needed for your service — for example a mobility requirement.
Why we use it
| Purpose | Basis |
|---|---|
| Answering your enquiries | Steps taken at your request before a contract |
| Preparing proposals and quotations | Steps taken at your request before a contract |
| Arranging and performing the services you book, including sharing details with the provider concerned | Performance of the contract |
| Communicating with you before, during and after a service | Performance of the contract, or our legitimate interest in following up your request |
| Protecting the website and forms against abuse and fraud | Our legitimate interest in keeping the service secure |
| Meeting our legal obligations, such as accounting and responding to the authorities | Legal obligation |
| Measuring which of our advertisements lead to requests (advertising measurement) | Your consent |
We do not use your data for automated decisions that would produce legal effects for you, and we do not sell it.
How a private flight request is handled
- Your request is sent over an encrypted connection to a dedicated endpoint on our own server, which checks it before going further.
- It is then sent by email to Accrocar's team, who prepare your answer. The email lets the team reply to you directly.
- Where this feature is enabled, an automatic acknowledgement is sent to the email address you provided.
- If the email cannot be delivered at that moment, a recovery copy of your request is kept on the server so that it is not lost. It is deleted as soon as the request has been delivered, and in any case after 7 days at most.
Who receives your data
- Accrocar's team, to handle your request and your booking.
- Hostinger, which hosts the website, our internal client and booking management system and our mailboxes, and delivers our emails.
- Supabase, which hosts the database of our internal client and booking management system in the European Union (Ireland).
- The payment service used for your booking, to process card and online payments.
- WhatsApp (Meta), when you choose to contact us through WhatsApp; WhatsApp processes your messages under its own terms and privacy policy.
- The aviation operator that quotes or performs your flight, and any other provider named in your proposal, for the information it needs to quote or perform the service.
- Google, when your browser loads the reviewers' photos on the homepage or, if you choose to display it, the map on the contact page.
- With your consent: Google (Google Ads), Meta (Meta Pixel) and OpenAI (OpenAI Ads), for advertising measurement, as described under Cookies below.
- Public authorities, when the law requires it — for example airport, border or customs authorities for a flight.
Transfers outside Morocco
Some of the recipients above are located, or process data, outside Morocco:
- Hostinger International Ltd is established in Cyprus, in the European Union.
- The database of our internal client and booking management system is hosted by Supabase in the European Union (Ireland).
- Google (Google Ads, Google Maps and the reviewers' photos), Meta (Meta Pixel and WhatsApp) and OpenAI (OpenAI Ads) are established in, or process data in, the United States and other countries.
- For international trips, and for helicopter flights in France and Switzerland, the operator concerned may be located abroad.
Moroccan law allows transfers to countries that ensure an adequate level of protection, and otherwise in specific cases such as your express consent or the performance of a contract made with you or in your interest. Advertising measurement tools are loaded only after you have allowed them. Data shared with a provider abroad is limited to what that provider needs to perform the service you booked.
How long we keep it
We keep personal data only as long as necessary for the purpose for which it was received, then delete it — unless we must keep it longer to meet a legal obligation, for example for accounting records relating to a booking.
The following periods are applied automatically:
| Data | Period |
|---|---|
| Recovery copy of a flight request that could not be emailed | Until delivered; deleted after 7 days |
| Copy of a car or contact request kept on our server while our management system cannot be reached | Until delivered; deleted after 7 days |
| Coded IP address used to limit abuse of the request forms | 24 hours, then deleted at the next automatic clean-up |
| Coded reference preventing a flight request from being sent twice | 3 days, then deleted at the next automatic clean-up |
| Technical logs of the flight request service, which do not contain the content of requests | 12 months |
| Your consent choice, stored in your browser | 6 months, then you are asked again |
| References of the requests sent from a browser tab, stored in that tab | Until you close the tab |
| Your language preference, stored in your browser | Until you change it or clear your browser data |
The periods applied by the advertising measurement tools are given under Cookies below.
Security
We protect personal data with measures appropriate to the risks: encrypted connections, access limited to the people who need it, credentials kept on the server side and never in the website code, storage of request data outside the publicly accessible part of the server, and protection of forms against automated abuse.
No transmission over the internet is entirely secure, and messages sent over open networks may circulate without guarantees of security. Please avoid sending documents through channels you do not trust, and ask us for the best way to share them.
Your rights
Under Law 09-08, you have the right:
- to be informed about the processing of your data, as in this policy;
- of access — to obtain confirmation that we process data about you, and a copy of it with information about how it is processed;
- of rectification — to have inaccurate or incomplete data corrected or updated, and data processed in breach of the law erased or blocked;
- to object — on legitimate grounds, to the processing of your data, and at any time and free of charge to its use for marketing.
You can withdraw your consent to advertising measurement at any time from "Cookie settings" at the bottom of every page.
If the European Union General Data Protection Regulation applies to our processing of your data, you also have the rights it provides, including erasure, restriction, data portability and the right to lodge a complaint with your data protection authority.
You may also contact the Moroccan data protection authority, the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP): cndp.ma.
How to exercise your rights
Write to contact@accrocar.com and tell us which right you wish to exercise. To protect your data, we may ask you to confirm your identity. We answer within the time limits set by law, and exercising your rights is free of charge.
Changes to this policy
We update this policy when our services or the way the website works change. The date at the top of this page shows the latest version.