Hammam Al Alba

Privacy Policy

1. Who is responsible for your data

This website is operated by STE ASILAH AL ALBA SARL, the company that runs the Hammam Al Alba hammam and spa venues in the medinas of Asilah and Tetouan, in Morocco.

  • Company: STE ASILAH AL ALBA SARL
  • Address: Lot. Nakhil 35, Asilah 90050, Morocco
  • Tax identification: 4936528
  • ICE: 001546911000051
  • Email: info@hammamalalba.com
  • Phone: +212 613 429190
  • Website: https://hammamalalba.com

We are the data controller for the personal data described below.

We are established in Morocco and we comply with Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data. Because we also offer our services to visitors located in the European Union, the EU General Data Protection Regulation (Regulation (EU) 2016/679) applies to that processing as well.

2. What this website does and does not do

This is an informational website, published in three languages: Spanish, English and French. It tells you about our venues and our treatments, and lets you request a booking.

This website sets no cookies whatsoever.

  • No session cookies and no preference cookies.
  • No use of your browser's localStorage or sessionStorage.
  • No Google Analytics, no tag manager and no Google tag.
  • No advertising and no ad networks.
  • No tracking pixels.
  • No social-media plugins, buttons or embedded feeds.

Because nothing is stored on your device, this site shows no cookie consent banner: there is nothing to accept.

Visitor statistics. We count visits with Umami, a cookie-free statistics tool that runs on our own server: what it records never leaves that server and never passes through a third party. It records which pages are visited, as they appear in the address bar, from which country, on what kind of device and browser, and where visitors come from (a search engine, another website, an ad). It also records, without any personal data, when a booking is completed and when a WhatsApp or phone link is tapped. It does not store your IP address or identify you, and we only ever look at its figures in aggregate. The visits it records are kept for three years and then deleted.

If you arrive from one of our ads. When you reach this site by clicking one of our Google ads, the page address carries a click identifier added by Google and, sometimes, campaign tags. That identifier is passed from page to page within the address itself and is never stored on your device. Our visitor statistics record it as part of the page address, and we only keep it alongside your details if you make a booking (section 3).

The typefaces you see are served from our own servers, not from Google Fonts or any other outside service.

There are no embedded third-party elements anywhere on the site: no embedded Google Map, no embedded video, no embedded social feed. The links to Google Maps, Instagram and WhatsApp are ordinary links: they take you off our site, and nothing is loaded from those services while you browse. The only exception is the last step of the booking, where the Cloudflare check described in section 5 is loaded.

The site has no user accounts, no comments, no forum, no file uploads and no newsletter.

3. What data we collect and when

When you send a booking request. The booking form is at /es/reservar/ in Spanish, /en/booking/ in English and /fr/reservation/ in French. It collects:

  • Your first name and last name
  • Your email address
  • Your phone number
  • The booking details you choose: the venue (Asilah or Tetouan), the experience, the number of people, and the date and time
  • A record that you ticked the box accepting the Terms and Conditions and this Privacy Policy, together with the date and time you did so

The form also contains a hidden anti-spam field that real visitors never see or fill in. If a request arrives with it filled in, it is discarded without being processed.

No payment is taken on this website. We never collect or store card details.

Where your booking came from. For every booking made on this site we keep, in a database of our own on our server, a record of how it came about:

  • The booking reference, the venue, the experience, the day of the treatment, the language and the price of the experience
  • The page of this site from which you went on to book
  • If you came from a Google ad, the click identifier (gclid) and the campaign tags (utm) that the address carried
  • The date and time you accepted the Terms and Conditions and this policy

To measure which campaigns bring us bookings, we also keep your email address and phone number converted into an encrypted fingerprint (SHA-256): a string of characters from which neither your email address nor your phone number can be recovered. We never keep your email address or phone number in readable form alongside where your booking came from, and the fingerprints are only kept until they are sent to Google (section 7).

When you contact us directly. If you write to us by email or WhatsApp, or call us, we process the data in your message solely to answer your enquiry.

Visitor statistics. What Umami records, as described in section 2. It does not include your name, your email address or your phone number.

Technical server logs. Our server keeps standard technical logs, which include the IP address making the request and the time of the request. They exist so the site stays secure and available.

4. Why we use it, and on what legal basis

  • Booking data. We use it to arrange and provide the service you have asked for. The legal basis is the performance of a contract with you and the steps taken at your request before entering into it.
  • Keeping records of bookings after the service has taken place. The legal basis is compliance with the legal, tax and accounting obligations that apply to us.
  • Where your booking came from, and visitor statistics. We use them to understand which pages are visited and which ads bring us bookings, so that we can decide where to spend on advertising. For that measurement we pass the click identifier to Google, together with the date and the amount of the booking. The legal basis is our legitimate interest in knowing what our advertising spend achieves. You can object at any time by writing to us.
  • Encrypted fingerprints of your email address and phone number. We share them with Google to measure which ads bring in bookings even when you did not book straight from the ad, on the same day or on the same device. The legal basis is your consent, which you give by accepting this Privacy Policy when you book and can withdraw at any time by writing to info@hammamalalba.com. Withdrawing it has no effect whatsoever on your booking.
  • Technical server logs. The legal basis is our legitimate interest in keeping this website secure and available.
  • Cloudflare check when you confirm your booking. We use it to stop automated programs from making fake bookings. The legal basis is our legitimate interest in protecting the booking system.

5. Who we share it with

There are only four recipients.

Bókun, the booking platform where your reservation is created and managed. It is operated by Tripadvisor LLC, 400 1st Avenue, Needham, MA 02494, United States. Bókun acts as a processor on our behalf. Its privacy policy:

https://www.bokun.io/privacy-policy

OVH SAS, based in Roubaix (France), the provider of the server this website runs on, located in the European Union. That server holds the record of where bookings came from, the visitor statistics and the technical logs described above. The visitor statistics run on that same server: they are not a third-party service.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, solely to measure the results of our Google Ads advertising. For each booking, Google receives only the date and time of the booking and its amount, the click identifier if you arrived with one, and the encrypted fingerprints of your email address and phone number. It never receives your name, your unencrypted email address or phone number, or what you booked: only irreversibly encrypted data, used to tell which bookings come through our Google campaigns. We handle this with the utmost care and do not keep this data in our Google accounts. Its privacy policy:

https://policies.google.com/privacy

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States, only when you confirm your booking: Cloudflare then checks that the person booking is a human and not an automated program (Cloudflare Turnstile). The check is invisible and uses no tracking cookies; to carry it out, Cloudflare receives technical data about your connection and browser, such as your IP address. It does not receive your booking details. Its privacy policy:

https://www.cloudflare.com/privacypolicy/

We do not sell or rent your data, and we do not pass it to anyone else. There are no other recipients.

6. International transfers

Bókun, Google and Cloudflare may process data in the United States, so using them involves transferring data outside the European Economic Area.

According to their privacy policies, those transfers are covered either by an adequacy decision of the European Commission or by Standard Contractual Clauses.

Our server, with OVH, is in the European Union: what is stored on it does not leave the EU.

7. How long we keep it

We keep booking data for as long as it is needed to provide the service, and afterwards for the periods required by the legal, tax and accounting obligations that apply to us. The record of your acceptance of the Terms and Conditions and of this policy is kept with the booking.

The record of where your booking came from, described in section 3, is kept for as long as the booking is kept.

The encrypted fingerprints of your email address and phone number are deleted as soon as they have been sent to Google and, at the latest, 90 days after the booking, which is the period within which Google accepts linking a booking to an ad.

8. Your rights

You have the right to ask for access to your personal data, and for its rectification, its erasure, the restriction of its processing, or its portability. You may also object to processing. Where processing is based on your consent, you may withdraw it at any time, without affecting processing already carried out.

To exercise any of these rights, write to info@hammamalalba.com. We may ask you for proof of identity before acting on the request.

You also have the right to lodge a complaint with a supervisory authority. In the European Union, that is the data protection authority of the country where you live. In Morocco, it is the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

9. Security

The whole site is served over an encrypted connection (HTTPS). Your booking data travels from your browser to our server and from there to Bókun. The only thing stored on our server is the record of where your booking came from, described in section 3, in a database that can only be reached from the machine itself. What is sent to Google also travels over an encrypted connection.

10. Links to other websites

Our pages link to other sites, such as Google Maps, Instagram and WhatsApp. Once you follow one of those links, this policy no longer applies. We do not control them, and we suggest you read their own privacy policies.

11. Children

Our services are contracted by adults, and this website is not directed at children; we do not knowingly collect their data. When a booking includes minors, it is made by the adult responsible for them.

12. Changes to this policy

We may update this policy if the way we work changes or if a new legal requirement makes it necessary. The version published on this page is always the current one.

Last updated: 28 October 2026