Privacy policy
Last updated: 13 October 2026
Entre Dunes protects the personal data of its customers and visitors, in accordance with Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data. This policy explains what data we collect on entredunes.com, why, who we share it with and how to exercise your rights.
1. Data controller
The controller of your data is:
| Company | [NOM DE LA SOCIÉTÉ], [FORME JURIDIQUE] |
|---|---|
| Brand | Entre Dunes |
| Registered office | [ADRESSE], [CODE POSTAL] Dakhla, Morocco |
| RC / ICE / IF | [RC] / [ICE] / [IDENTIFIANT FISCAL] |
| contact@entredunes.com | |
| Phone / WhatsApp | [WHATSAPP +212…] |
| CNDP declaration | [N° DÉCLARATION CNDP] |
2. Data we collect
We only collect the data needed for your orders and for the site to work.
| Category | Data | When |
|---|---|---|
| Identity and contact | Last name, first name, phone, email | Order, account creation, contact |
| Delivery | City, address, delivery instructions | Order |
| Order | Boxes chosen, quantities, amount, payment method, history | Order |
| Personalization | Card message, recipient’s name and date (La Traversée box) | Order |
| Account | Email, password (encrypted), or Google ID | Account creation |
| Card payment | Payment status and reference. We never see or keep your card numbers: they are entered directly on CMI’s secure page | Online payment |
| Browsing | IP address, device and browser type, pages viewed, cookies (see section 7) | Visiting the site |
| Exchanges | Messages sent by email, WhatsApp or social media | When you write to us |
Data about the recipient of a gift (name, address) is given to us by the buyer, who confirms they are entitled to share it.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Processing, confirming (call or WhatsApp), preparing and delivering your orders | Performance of the sales contract |
| Collecting payment (on delivery or by card) | Performance of the contract |
| Personalizing the box’s card | Performance of the contract |
| Managing your customer account | Performance of the contract |
| Answering your questions and complaints, handling returns | Performance of the contract and legitimate interest |
| Keeping accounts and invoices | Legal obligation |
| Preventing fraud and fake orders | Legitimate interest |
| Measuring the site’s audience to improve it | Your consent (cookies) |
| Sending you our news and offers | Your consent, which you can withdraw at any time |
We never sell your data and make no automated decisions about you.
4. Recipients and processors
Your data is accessible to the Entre Dunes team and shared only with the providers the service needs, each limited to what it requires.
| Provider | Role | Data shared |
|---|---|---|
| [COURIER, e.g. Amana] | Delivery and collecting cash on delivery | Name, phone, address, amount to collect |
| CMI, through [BANK] | Card payment | Amount, order reference, email (card details are entered at CMI) |
| Vercel | Website hosting | Technical browsing data |
| Supabase | Order and account database | Order and account data |
| Resend | Sending confirmation emails | Email, name, order contents |
| Sign in with Google (if you choose it) | Google ID and email | |
| [ANALYTICS TOOL] | Audience measurement, only with your consent | Browsing data |
| Meta (WhatsApp) | Order confirmation and customer service | Phone number, messages exchanged |
| [ACCOUNTING FIRM] | Accounting | Invoices |
We may also disclose data to the Moroccan authorities when the law requires it.
5. Transfers outside Morocco
Some providers (Vercel, Supabase, Resend, Google, Meta) store or process data on servers outside Morocco, notably in the European Union or the United States. These transfers comply with law 09-08 and, where required, follow authorization by the CNDP [TRANSFER AUTHORIZATION NO.]. Where possible, we choose servers in the European Union.
6. Retention periods
| Data | Period |
|---|---|
| Orders and invoices | 10 years, for accounting and tax obligations [TO CONFIRM WITH THE ACCOUNTANT] |
| Customer account | While the account is active, then 3 years after the last activity |
| Card messages and personalization | 12 months after delivery |
| Exchanges with customer service | 3 years after the last exchange |
| Marketing (newsletter) | Until you unsubscribe, or 3 years without interaction |
| Audience measurement cookies | 13 months at most |
At the end of these periods, data is deleted or anonymized.
7. Cookies
A cookie is a small file saved on your device. On your first visit, a banner lets you accept, decline or choose non-essential cookies.
| Type | What it is for | Your consent |
|---|---|---|
| Necessary | Bag, language, sign-in, security, remembering your cookie choice | Not required: the site cannot work without them |
| Audience measurement | Understanding which pages are visited, to improve the site | Required |
You can change your choice at any time with the “Manage cookies” link at the bottom of every page, or in your browser settings.
8. Security
We protect your data with appropriate measures:
- an encrypted connection (HTTPS) across the whole site;
- encrypted passwords, never stored in plain text;
- card payment on CMI’s secure page, without your card numbers passing through our servers;
- access to orders limited to the people who need it, protected by a password.
If a data breach is likely to harm you, we will inform you and the CNDP as soon as possible.
9. Your rights
Under law 09-08, you have the following rights over your data:
- Access: to know what data we hold about you and get a copy;
- Rectification: to have inaccurate data corrected or completed;
- Objection: to object, on legitimate grounds, to the processing of your data, and without grounds to its use for marketing;
- Withdrawal of consent: for audience cookies and the newsletter, at any time;
- Deletion: to ask for your account and data to be erased, except what the law requires us to keep (invoices).
To exercise these rights, write to contact@entredunes.com with your name and the email or phone number used for the order. We reply within 30 days at most. We may ask you to prove your identity.
If you believe your rights are not respected, you can contact the Moroccan data protection authority (CNDP, www.cndp.ma).
10. Minors, changes and contact
- Minors: The site is intended for adults. We do not knowingly collect data about minors under 18.
- Changes: We may update this policy, for example when we add a new service. The date of the last update is shown at the top of the page; for any significant change, we will let you know on the site or by email.
- Contact: For any question about your data: contact@entredunes.com · [TÉLÉPHONE +212…] · [ADRESSE], Morocco.
This policy is available in French, English and Arabic. In case of any difference, the French version prevails.