Who is responsible for your information
Visit Majorelle is operated by Apollo Trading UG, Arnstädter Str. 50, 99096 Erfurt, Germany, represented by Robert Smith. Apollo Trading UG is the controller for the personal information it processes to operate this website and provide its independent ticket procurement and support service.
For privacy enquiries or to exercise your rights, email booking@visitmajorelle.com or write to the address above. This notice explains our website, booking and communications processing. The attraction and external service providers may also process information for their own purposes under their notices.
Information we collect
Website requests provide connection information to the hosting service, such as your IP address and information about your browser and request. Security controls also use session identifiers, verification tokens and information needed to detect repeated or suspicious submissions.
A booking requires your first name, last name, email address and telephone number, including its country calling code. We use your telephone number for important updates about your visit. We process the experience, selected visit date and time, ticket categories, quantities, prices and currency, together with booking references, order identifiers, status and correspondence. The custom booking form does not request a postal address, date of birth or identity document, or receive raw card numbers or security codes. Category quantities do not collect the names or birth dates of every visitor.
The contact form requires your name, email, topic and message; a booking reference is optional. Please include information relevant to your enquiry and avoid sending card details or unnecessary identity documents. A reference helps us locate an order without asking you to repeat its details.
Purposes and legal grounds
- Requests and bookings: Article 6(1)(b) GDPR applies to information necessary to take steps you request before a contract and perform our service, including procurement, delivery, support and agreed changes or refunds.
- Legal responsibilities: Article 6(1)(c) applies where a specific legal obligation requires processing, such as keeping applicable business records or handling a valid regulatory request.
- Site operation and protection: Article 6(1)(f) applies where necessary for our legitimate interests in operating a reliable website, preventing misuse, handling general enquiries and establishing or defending claims, subject to your interests and rights.
- Consent: where we ask for consent for a particular optional activity, Article 6(1)(a) applies to that activity. Providing booking details or accepting a contract is not blanket consent to unrelated uses.
Without required booking information, we cannot process your request or deliver tickets by email. Without the required contact fields, the contact form cannot submit an enquiry. A telephone number, including its country calling code, is required when making a new booking.
Payment processing
Our online card checkout uses hosted payment fields through the booking integration. We pass the information needed to initiate and reconcile the payment, including the booking contact's name and email, amount, currency and order identifiers. Our custom booking form does not read or store your full card number or security code.
The payment interface and relevant financial providers process the payment details, authentication and transaction-security information they need. We retain transaction references, amounts and status to manage the order, refunds, enquiries and applicable records. The relevant grounds are contract performance, applicable legal obligations and legitimate interests in preventing fraud and resolving disputes, according to the purpose.
Payment processors and financial institutions involved in a transaction may also process information for their own payment administration, security and legal obligations. Their privacy notices describe their own processing and do not replace our responsibilities for the information we handle. Contact us for information about the recipients involved in your payment.
Integration of Novalnet / Full payment service provider
The controller in charge of processing has integrated components of Novalnet AG into this website. Novalnet AG is a full payment service provider which handles payment processing, among other things. If the data subject selects a payment method during the order process in our online shop, data of this person are sent automatically to Novalnet AG. By choosing a payment option, the data subject agrees to the transmission of personal data for the purposes of payment. As a rule, the personal data sent to Novalnet include the first name, surname, address, gender, e-mail address, IP address and possibly date of birth, tel. no., mobile no. and other data as required for payment processing.
The conclusion of a purchase contract also requires personal data that relate to the respective order. This includes, but is not limited to, the exchange of payment information such as bank details, card number, expiry date and CVC code, data on goods and services, and prices.
Data transmission is intended in particular for verification of identity, payment administration and fraud prevention. The controller will transmit personal data to Novalnet AG particularly if there is a legitimate interest in transmission. The personal data exchanged between Novalnet AG and the controller may be sent by Novalnet AG to credit agencies. This transmission is for the purposes of verifying identity and creditworthiness.
Novalnet AG will also share the personal data with service providers or subcontractors if so required to fulfil the contractual obligations or if the data must be processed.
The data subject has the option to revoke consent for the handling of personal data at any time with Novalnet AG. This will have no effect on personal data that must be processed, used or transmitted for (contractual) payment processing
People and providers receiving information
Our team uses relevant information to manage orders and respond to enquiries. Kinsta hosts the website. Booking records are managed through LatePoint on the website server. Hostinger provides the SMTP service used to send contact messages to our booking mailbox and order notifications to our business operator.
Order notifications are delivered to an operator mailbox using Gmail, so Google processes the information in those emails. Notifications can include your email, booking reference, selected experience, visit details, ticket quantities, total and availability advice. Contact correspondence can include the information you put in your message.
Information needed to obtain or deliver admission may be shared with the relevant attraction or ticket supplier. Professional advisers or authorities may receive information where necessary for an applicable obligation or claim. A provider's role depends on its particular service; its own processing may be covered by its privacy notice.
Language and translation
Eligible public information pages use GTranslate with Google translation according to a supported browser language or your language choice. Public page text and ordinary connection information can reach Google. Translation can activate automatically before you make a cookie-banner choice; those choices do not currently control this feature.
Booking labels use a separate catalogue of public text. Customer names, email addresses, telephone numbers, form values, booking references and selected visit details are excluded from that catalogue's translation request. This separation does not prevent Google receiving connection information when translation resources load. Contact and protected pages are excluded from public-page translation.
Selecting English restores the original text. It cannot reverse information already transmitted. Google explains its processing in its Privacy Policy.
Cookies and browser storage
Browser storage supports booking and contact security, remembers language choices and preserves ticket selections during a browser session. The saved visit selection does not contain your contact details. A language preference can remain until you change or clear it. Translation resources may also use language-related cookies.
Our Cookie Policy describes these technologies and available controls. Under §25 TDDDG, storing or accessing information on your device requires consent unless a statutory exception applies, including strict necessity for a service you expressly request. The GDPR separately governs any personal information involved.
How retention is determined
Retention depends on the information's purpose: completing procurement and delivery, answering an unresolved enquiry, handling refunds or disputes, meeting applicable recordkeeping obligations, and protecting against misuse. Relevant factors include whether an order is complete, whether an obligation or claim remains open, and whether the information is still needed.
Temporary form sessions and security records have technical expiry rules. An expired session, review link or access permission does not necessarily mean that the related booking, correspondence, backup or business record has been deleted. Provider systems and mailboxes may retain their own copies. Contact us for information about a particular record or to request deletion where the law allows.
Information processed outside the EEA
Our service concerns attractions in Morocco, and external providers may process information outside the European Economic Area. The location and applicable protection depend on the recipient and processing activity. Morocco is not currently covered by a European Commission adequacy decision.
Transfers must meet the GDPR's international-transfer requirements. Depending on the actual circumstances, a lawful route may involve an applicable adequacy decision, appropriate contractual safeguards, or a narrowly applicable statutory exception. Booking necessity alone does not establish that every transfer qualifies. Contact us for details of the recipient, transfer basis and any applicable safeguards, including how to obtain relevant information or a copy.
Automated processing
Our systems validate submissions and update order records. The post-payment availability checker provides advice to an operator; it does not buy or reserve tickets, change your booking, or choose an alternative visit for you. We seek your agreement to an alternative if your chosen visit is unavailable. These functions do not establish how every external provider makes its own decisions.
Your rights under the GDPR
Subject to the applicable conditions, you can request access to and a copy of your personal information, correction, deletion and restriction. Where the conditions apply, you can request portability of information you supplied. You can object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. The GDPR also provides protections concerning solely automated decisions with legal or similarly significant effects, including human intervention and the opportunity to express your view and contest a decision where applicable.
Email us to exercise a right. Requests are normally free. We may request proportionate information where needed to confirm your identity. We respond without undue delay, normally within one month. Where complexity or the number of requests permits an extension of up to two further months, we explain this within the first month. Rights have limits, including necessary legal retention and the rights of others. You can also ask about recipients notified of relevant corrections, erasure or restrictions.
You may complain to a supervisory authority without contacting us first, including where you habitually live, work or believe an infringement occurred. Our local authority is the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit, Postfach 900455, 99107 Erfurt, Germany; poststelle@datenschutz.thueringen.de. This is not your only complaint route.
Security, children and policy updates
The website uses encrypted HTTPS connections and controls designed to protect booking and contact submissions against unauthorised access and duplicate processing. Security measures reduce risk but cannot guarantee that every transmission or system is free from risk. Keep booking references and admission documents private, and contact us if you believe your booking or information has been accessed improperly.
An adult should arrange bookings for children. Our category selector records ticket quantities, including child tickets; it does not require each child's name or birth date. Please do not send children's identity documents or other sensitive information unless it is necessary and a suitable method has been agreed.
We update this notice when relevant practices or requirements change and show the revision date above. A new notice does not itself authorise an unrelated new use of your information. Where additional information or consent is required, publishing a revised policy does not replace it.