Privacy policy

• Brand: Signed Journey.
• Legal entity: To be published before commercial launch. Tax ID: To be published before commercial launch. Registered address: To be published before commercial launch.
• Offices: Marrakech · Barcelona.
• Privacy contact: hola@signedjourney.com.

• Trip requests and enquiries: name, email, phone (optional), language, trip details (destination, dates or month, nights, travellers and children's ages, indicative budget, preferences) and your message. Purpose: replying and preparing a proposal. Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Accessibility or dietary needs: only if you choose to share them, to adapt the trip. Legal basis: your explicit consent when providing them (Art. 9(2)(a) GDPR), which you may withdraw at any time. Only the team arranging your trip can see them and every access is logged.
• Follow-up reminders: two at most, and only if you agree in the form. Legal basis: consent (Art. 6(1)(a)). Every message includes an unsubscribe link.
• Bookings: only the data needed to book each service with local suppliers (accommodation, transport, guides). Legal basis: performance of the contract (Art. 6(1)(b)) and accounting and tax obligations (Art. 6(1)(c)).
• Payments: we do not store card data. If a payment provider is enabled, it processes payment data under its own terms, shown to you before paying.
• Occasional letter (newsletter): your email, only after you confirm from the link we send. Legal basis: consent. Unsubscribe in every issue.
• Site measurement: aggregated daily counters (for example, how many forms are sent) with no identifiers, no cookies, and only if you accept analytics in the cookie notice.
• Security: to limit abuse we use an encrypted fingerprint of your IP address (never the plain IP), deleted within 24 hours.
• FAQ digital assistant: your question is used only to look up the answer and is not stored.

• Cloudflare: website hosting, server functions and database, as processor.
• Resend: delivery of transactional emails (acknowledgements, proposals, reminders), as processor, when sending is enabled.
• Suppliers of the trip you book: only the data needed for each service.
• Accountants and authorities, when the law requires it.
• We never sell or share your data for advertising.

Cloudflare and Resend are headquartered in the United States. Transfers rely on the safeguards provided by the GDPR (EU-US Data Privacy Framework or standard contractual clauses), according to each provider's data processing agreement.

When your trip is in Morocco, we share with local suppliers the data needed to deliver the services you have booked (Art. 49(1)(b) GDPR).

• Requests that do not become bookings: 24 months after the last communication.
• Booking files: 6 years, for contractual and tax obligations.
• Form draft in your browser: 30 days (you can delete it sooner).
• Security fingerprints: 24 hours. Newsletter: until you unsubscribe.

You may request access, rectification, erasure, objection, restriction and portability, and withdraw any consent, by writing to hola@signedjourney.com (include your reference if you have one). We will reply within one month.

If you are not satisfied with our answer, you may complain to the Spanish Data Protection Agency (aepd.es) or, in Morocco, to the CNDP (cndp.ma).

We make no automated decisions with legal effects on you. The system orders requests internally by urgency and missing details so that a person can handle them; it never uses health, origin or other special-category data for this.

Encrypted connection (HTTPS) across the site; internal panel access with password and second factor; every access to restricted data logged; personal links are temporary and revocable. No system is infallible: if we detect an incident affecting you, we will inform you as the law requires.

The site is not aimed at children. Ages of travelling children are provided by the responsible adult and used only to adapt the trip.

We will publish any change here with its date. If a change affects a purpose based on your consent, we will ask for it again.