Privacy policy
Provisional content — must be validated by Moroccan legal counsel before publication (applicable law, CNDP, terms of sale, cancellation).
Data controller: SPA_LEGAL_NAME. Purposes: booking management, payment, service communication.
Legal basis: contract performance for bookings; separate consent for marketing communications.
Recipients: spa team, payment provider. No data is sold to third parties.
Retention periods, access/rectification/deletion rights and CNDP (law 09-08) formalities: see docs/privacy-data-map.md — to validate before production.
Health data: limited to a checkbox; no free-text diagnosis field.
SPA_LEGAL_NAME
ICE: SPA_ICE · RC: SPA_RC
88, Rue Bab Agnaou — Derb Sidi Bouloukate, Médina, Marrakech