Privacy Policy
How we collect, use, and protect your personal data.
Table of Contents
1. Data Controller
The data controller responsible for your personal data is:
- Organisation: Association Nawrass
- Location: Kingdom of Morocco
- Email: contact@nawrass-asso.com
- Website: www.nawrass-asso.com
Nawrass is committed to protecting the privacy and security of the personal data entrusted to us by our clients, parents, guardians, and camp participants. This Privacy Policy explains how we collect, use, share, and safeguard your information in alignment with the General Data Protection Regulation (GDPR) and applicable Moroccan data protection law (Law 09-08).
2. What We Collect
We collect the following categories of personal data, depending on your relationship with Nawrass:
| Category | Data Types |
|---|---|
| Identity Data | Full name, date of birth, nationality, gender, passport or national ID number |
| Contact Data | Email address, phone number, postal address |
| Company Data | Company name, job title, corporate email, company address (for B2B clients) |
| Child Data | Participant's full name, date of birth, age, school, language preferences |
| Health Data | Allergies, medical conditions, dietary restrictions, current medications, disability information, medical certificates |
| Financial Data | Payment method details, billing address, transaction records |
| Communication Data | Correspondence via email, contact forms, and phone calls |
| Technical Data | Language preference (stored via cookie), browser type, pages visited (aggregated, non-identifying) |
Health data is classified as special category data under the GDPR and is processed only with explicit consent and strictly for the purpose of ensuring the safety and well-being of camp participants. The on-site pediatrician handles all health data under medical confidentiality.
3. Why We Collect Your Data
We process your personal data for the following purposes:
- Camp Registration: To process bookings, confirm enrolment, and assign participants to the appropriate programmes and age groups.
- Safety & Well-being: To manage health requirements, administer medication where authorised, respond to medical emergencies, and maintain appropriate supervision ratios.
- Communication: To send pre-departure information, camp updates, departure logistics, and post-camp feedback surveys to parents/guardians and corporate clients.
- Legal Obligation: To comply with Moroccan regulations regarding the supervision of minors, insurance reporting, and financial record-keeping.
- Contractual Performance: To fulfil our obligations under the service agreement with corporate clients, including invoicing, reporting, and programme delivery.
- Improvement: To analyse aggregated, anonymised usage data in order to improve our website, programmes, and services.
4. Legal Basis for Processing
Under the GDPR, we rely on the following legal bases for processing your personal data:
- Consent: Where you have given explicit consent for us to process your data for a specific purpose (e.g., health data, photo/video consent, marketing communications). You may withdraw your consent at any time by contacting us.
- Contract Performance: Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g., processing a booking, providing camp services).
- Legitimate Interest: Where processing is necessary for our legitimate business interests, provided that such interests are not overridden by your rights and freedoms (e.g., improving our services, ensuring site security, communicating with corporate clients about their employees' children's camp experience).
- Legal Obligation: Where processing is necessary for compliance with a legal obligation to which Nawrass is subject (e.g., financial reporting, child protection regulations).
5. Data Sharing
Nawrass does not sell, rent, or trade your personal data to third parties for marketing purposes. We share personal data only in the following limited circumstances:
- Camp Staff: Relevant personal and health data is shared with camp coordinators, animators, and the on-site pediatrician on a need-to-know basis to ensure the safety and well-being of participants.
- Insurance Providers: In the event of an incident or claim, relevant data may be shared with our insurance provider to process the claim.
- Emergency Services: In the event of a medical emergency or safety incident, relevant data will be shared with local emergency services, hospitals, or law enforcement as required.
- Corporate Clients: Aggregated, non-identifying programme reports may be shared with the corporate Client that sponsored the participant's enrolment. Individual health data is never shared with corporate Clients.
- Legal Authorities: We may disclose data where required by law, court order, or governmental regulation.
We do not share your data with any third-party marketing, advertising, or analytics companies.
6. Cookies
The Nawrass website uses essential cookies only. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
6.1 What Cookies We Use
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
nawrass_lang | Stores your preferred language (EN, FR, or AR) so that the website displays in your chosen language on return visits. | 1 year | Essential |
Because we use only essential cookies that are strictly necessary for the website to function, no cookie consent banner is required. However, you may delete or block cookies through your browser settings at any time. Please note that disabling the language preference cookie will cause the website to default to English on each visit.
6.2 Third-Party Scripts
The Nawrass website loads icon libraries and font files from external content delivery networks (CDNs). These services may set their own cookies or collect aggregated technical data. Nawrass does not control these third-party cookies and recommends reviewing the privacy policies of these providers if you have concerns.
7. Data Retention
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, and in accordance with our legal obligations:
- Registration and contact data: Retained for 3 years after the last interaction with Nawrass (e.g., last booking, last correspondence).
- Health data: Retained for the duration of the camp Programme plus 3 years, after which it is securely deleted.
- Financial records: Retained for 5 years in accordance with Moroccan commercial law requirements.
- Communication records: Retained for 3 years after the last interaction.
After the applicable retention period, personal data is securely deleted or irreversibly anonymised. You may request earlier deletion of your data by exercising your right to erasure (see section 8 below).
8. Your Rights
Under the GDPR and applicable Moroccan data protection law, you have the following rights regarding your personal data:
Right of Access
You have the right to request a copy of the personal data we hold about you, along with information about how it is being processed.
Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
You have the right to request deletion of your personal data where there is no compelling reason for its continued processing.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object
You have the right to object to the processing of your personal data where we rely on legitimate interest as the legal basis.
Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy.
Please note that certain rights may be limited where we have a legal obligation to retain data or where data is necessary for the performance of a contract.
9. How to Exercise Your Rights
To exercise any of the rights described above, or to ask questions about how your data is processed, please contact us:
- Email: contact@nawrass-asso.com
- Subject line: "Data Protection Request"
We will respond to your request within 30 calendar days of receipt. In order to verify your identity, we may ask you to provide a copy of a valid identification document. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.
If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority. For residents of the European Union, this is the data protection authority in your member state. In Morocco, complaints may be directed to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).
10. Changes to This Policy
Nawrass reserves the right to update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes:
- The "Last updated" date at the top of this page will be revised.
- Registered clients and parents/guardians will be notified via email of any significant changes affecting the processing of their personal data.
- The updated policy will be published on this page at www.nawrass-asso.com/privacy.html.
We encourage you to review this page periodically to stay informed about how we protect your data. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.