Privacy policy

11. Who is responsible for your data

TMC, a French simplified joint-stock company (société par actions simplifiée), 9 rue des Colonnes, 75002 Paris, France, entered in the Paris Trade and Companies Register under number 109 771 360, which operates this site under the trading name TMC Conciergerie. For any question about your data: contact@tmcconciergerie.com.

This policy applies Regulation (EU) 2016/679, known as the GDPR, and French law no. 78-17 of 6 January 1978, known as the Data Protection Act (Loi Informatique et Libertés).

22. Your visit to the site

Like any website, ours is served by a hosting provider, IONOS SARL (France), whose servers automatically record, for each page requested, the IP address, the date and time, the page, the browser and the referring page. These logs are used to run and secure the site; they are kept for a limited period by the host. Legal basis: our legitimate interest in keeping the site secure.

No font, video or library is loaded from a third-party service: everything is served from our own hosting. The only exception: the audience measurement and advertising tools from Google and Microsoft, loaded only if you accept them (section 10).

We count our visitors, but without tracking you. Each page viewed sends to our own server alone three pieces of information: the page address, the site you arrived from if there is one, and the width of your screen. If you arrived through a campaign link, the name of that campaign as it appears in the address is added (for example "instagram", "bio") and, if an advertising platform added a click identifier, only the fact that it did, never its value; and, if the site is opened inside an app (Instagram, Facebook), the name of that app, read from your browser's signature. Your IP address is not stored: together with your browser, it is used only to calculate a fingerprint scrambled by a secret key and by the current date, and, at that same moment, to work out the country you are browsing from and, for some countries, the approximate city, never anything more precise. This is done on our own server, with a lookup database installed there (DB-IP), without calling any outside service; only the country and city are kept, never the address. This fingerprint only shows that two pages were viewed by the same person on the same day: it changes every night, and the key that computes it cannot reveal your address. It stays recorded, with the page viewed, in our audience log, which is deleted after thirteen months; to link a request to where the visit came from, it is kept for two days at most. It cannot be matched to another site. It is pseudonymous data, never associated with your name or contact details. This data is shared with no one and is deleted after thirteen months.

On the booking page, we also count, in the same anonymous way, what helps us improve the service: the steps reached and requests sent or abandoned (service, route, vehicle, number of travellers, price shown, month of travel), the requests we cannot serve and why (a place missing from our list, with the name typed, a date too close, a group too large), the names of the fields that block the form, never what is typed in them, and clicks on our phone number, WhatsApp link or email address. Each request and each click is linked to where that day's visit came from (Google, Instagram, a campaign), so we know which sources bring requests: this link uses the fingerprint of the day, kept for two days at most, and only the source is recorded in this anonymous count: it is never attached to your booking request or your message. A source is attached to your request only if you have accepted audience measurement (section 10). No name, email address or identifier is part of these counts. They are deleted after thirteen months.

This counting does not depend on the cookie banner, and sets no cookie: an audience measurement this limited is exempted from consent by the CNIL (the French data protection authority). Legal basis: our legitimate interest in measuring and improving the site's audience. It is also what lets us count all our visitors, rather than only half of them. The tools that require your consent are described in section 10.

You can object to this counting at any time, with no effect whatsoever on your browsing. Your choice is kept in your browser, on this device. Stop counting my visits

33. Your preferences

The site stores, in your browser's local storage, three choices you make yourself: the currency used to display prices, on the English version; your answer to the cookie banner, with its date (section 10); and, if you asked for it, your refusal to be counted by our audience measurement (section 2). These three items stay on your device and are never sent to us. They are exempted from consent, as they are used only to apply your own choices. Your answer to the banner is kept for six months, after which the banner asks you again. You can delete this information at any time in your browser settings.

In your tab's memory. During a booking, the site also keeps three items in your tab's session memory, which is erased when you close the tab:

• the answers you have given in the booking steps (journey, places and addresses entered, date and time, flight number, number of travellers, vehicle chosen), so that they can be found again if you reload the page or switch the language of the page (they are then copied for the other language, in the same tab). They are picked up again for six hours at most, contain neither your name, nor your email address, nor your phone number, nor your message, and are not sent to us this way;
• the token of your request in progress, a random identifier created when you enter a valid email address on the booking page. It is sent to our server with that request, to link it to its updates (section 4);
• the origin of your visit, only if you have accepted audience measurement: it is described in section 10.

What the site keeps in your browser only with your consent is described in section 10.

44. Your booking request or your message

The form on the Booking page asks our server for the price, from the journey and the number of travellers, without your contact details. Your request is sent to our server when you choose to proceed to payment yourself: it is kept in our management tool, then you are taken to Stripe's secure payment page. Once the payment is received, a summary is sent to the address you give and the booking is forwarded to us by email. If the payment does not go through, the request stays in our tool, marked as unpaid, and we may write to you at the address you gave to offer to complete your booking: this is a pre-contractual measure, linked to your request, which uses no cookie. While you type, the address search queries our server (article 5). The form on the Contact page sends your message to our server: it is kept in our management tool, forwarded to us by email, and an acknowledgement is sent to the address you give. A message set aside by our spam filter is kept for thirty days, without being forwarded, then deleted.

What we receive

What you send us, namely your name, your email address, your phone number if given, the service requested, your flight, your departure and arrival locations and addresses, the date and time of the return if you ask for one, the number of travellers and, for a Fast Track, the first and last name of each one (given after payment, so that the agent can meet you) and your message.

Why

To reply to you, confirm your booking and arrange the service.

Legal basis

Pre-contractual measures taken at your request, then performance of the contract.

How long

If no booking follows: three years after our last exchange. For a booking: the data needed for the service (flight, addresses, travellers' names, message) three years after the service; the accounting record and the proof of the contract ten years, in an archive with restricted access.

Request started but not sent. As soon as you enter your email address on the Booking page, the request in progress (service, journey and places chosen, date and time, number of travellers, vehicle, price shown, your name, your email address and your phone number, and where your visit came from if you have accepted audience measurement) is kept on our server so that you can pick it up again, and we may write to you once to offer to complete it. Legal basis: pre-contractual measures taken at your request. Nothing is kept before you enter your email address: earlier drop-offs are counted without any personal data (section 2). The request in progress is deleted 30 days after it was last changed if it does not go through; if it does, it becomes your booking. This is not audience measurement: the "Stop counting my visits" button does not apply to it, but you may ask us to delete it at any time (section 9).

Wheelchair. Since 23 September 2026 we no longer ask for this information: the form no longer offers it and our server no longer records it. If you need a wheelchair, tell us by phone or in the free message of your request, and we will plan the vehicle with you. Information collected before that date is erased, together with the proof of the consent given at the time, 90 days after the journey; you may ask us to erase it sooner.

Proof of your agreement. When you accept our terms, ask for a Fast Track Premium to be performed or exercise your right of withdrawal, we record the date, the time, the version of the terms, your IP address and your browser's signature. Legal basis: our legitimate interest in proving the contract. Duration: ten years, like the proof of the contract, in the archive with restricted access; three years after our last exchange if no booking follows.

Withdrawal. For Fast Track Premium, you can exercise your right of withdrawal from your booking page, or through the Withdraw from the contract form, available at the bottom of every page: it sends you by email the private link to your booking, from which the withdrawal is recorded. The information you enter there is used only to find your booking and send you this link.

Where your visit came from. If you have accepted audience measurement, your request or message also carries where your visit came from (campaign, advertisement or referring site), as described in section 10.

Our technical logs. Refusals and errors in our forms are recorded in logs that may contain your IP address; they are deleted after twelve months. Legal basis: our legitimate interest in securing the service.

55. The addresses of your journeys

The addresses you type. On the Booking page, when you type an address, our server sends only the text typed to Google Maps Platform (Google Ireland Limited, Ireland, for Google LLC, United States), to suggest matching addresses. Neither your IP address, nor your name, nor your browser is sent to it, and no external script is loaded in your browser. The text and the results are cached on our server for thirty days, with no link to your identity. Legal basis: pre-contractual steps taken at your request.

The address you choose. Its coordinates are used to find the nearest location and to calculate the price, in your browser and on our server, with distances stored on our own site: it is not sent to any external service. It is attached to your request when you send it, as a map link intended to guide the chauffeur.

66. Who receives your data

• Our team, within the limits of their duties.
• The person who carries out your service in Morocco, meet-and-greet agent or chauffeur, for the necessary data only: your name, your flight, your locations and your phone number.
• Google Maps Platform (Google Ireland Limited, Ireland), for address search and for journey distance and duration, when you prepare a booking: our own server queries it, with only the text you typed. Your IP address and your browser are never sent to it, and no external script is loaded in your browser. The text and the result are cached on our server for thirty days, with no link to you.
• Stripe Payments Europe, Limited (Ireland), our payment provider: it receives your email address, the amount, and the number and description of your booking, and collects your card details itself; we never receive them. For its own purposes (security, fraud prevention, financial obligations), Stripe acts as a separate controller, under its privacy policy.
• Only if you accept them (section 10): Google Ireland Limited (Ireland), for Google Analytics and Google Ads, and Microsoft Ireland Operations Limited (Ireland), for Microsoft Clarity. Through their tools loaded in your browser, they receive your IP address, information about your browser and device, the pages viewed, the identifiers in their cookies and, for a paid booking, its number and amount.
• Our host, IONOS SARL (France), which hosts the site, the bookings database and our email: our emails are sent from the addresses no-reply@tmcconciergerie.com and contact@tmcconciergerie.com, and your messages, booking notices and our exchanges are received and kept on its server.
• Lera Concept, which maintains the site technically on our behalf and keeps a backup copy of the bookings database.
• The people who keep or audit our accounts, for accounting records only.
• The authorities, where the law requires it.

We neither sell nor rent your data.

77. Transfers outside the European Union

Your services take place in Morocco: the necessary data is passed to the person who carries them out there. Morocco is not covered by an adequacy decision of the European Commission; this transfer is necessary for the performance of the contract you request (Article 49(1)(b) of the GDPR).

Stripe may process some payment data outside the European Union, in particular in the United States. These transfers are covered by the EU-U.S. Data Privacy Framework, to which Stripe has signed up, and by the European Commission's standard contractual clauses, provided for in the data processing agreement entered into with Stripe.

If you accept audience measurement or advertising (section 10), Google and Microsoft may process the data collected in the United States, at Google LLC and Microsoft Corporation. These transfers are covered by the EU-U.S. Data Privacy Framework, to which both companies have signed up, and by the European Commission's standard contractual clauses.

88. Security

The site is served exclusively over HTTPS. Payment is made on Stripe's secure page: your card details never pass through our servers. The bookings database is kept outside the public part of the server, and access to it is restricted to our team, protected by a password and a one-time code sent by email.

99. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You may also set directives on what happens to your data after your death. To exercise them, write to contact@tmcconciergerie.com: we reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. If you live in Morocco, you may also refer the matter to the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP), the Moroccan data protection authority.

1010. Cookies

Nothing without your consent. This site uses audience measurement and advertising tools that set cookies, only if you accept them. On your first visit, a banner lets you accept, decline, or choose category by category, with buttons of equal prominence. Until you answer, and if you decline, none of these tools is loaded and the site sets no cookies: browsing and booking work exactly the same way. Our anonymous visit count (section 2) is not affected: it sets no cookie and runs in all cases.

Audience measurement: Google Analytics and Microsoft Clarity

Google Analytics counts visits, pages viewed, where visitors come from and the key steps: moving on to payment (with the service and the price), the paid booking (with its number and amount), sending a message, and clicks on our phone number, WhatsApp link or email address. Microsoft Clarity records, under a random identifier, clicks, scrolling and movements on the pages, to spot what gets in the way of reading or booking; the text you type in form fields is masked in your browser and is not sent to Microsoft. We send these tools neither your name, nor your email address, nor your phone number. Accepting this category also lets us keep where your visit came from (see below).

Advertising: Google Ads

If you reach the site through one of our Google ads, Google Ads tells us that a paid booking followed, so we know which ads bring customers. Google receives the booking number, its amount and its currency, never your name or contact details.

Cookies set after your consent.

In addition, after a paid booking and if you have accepted these tools, a marker is kept in your browser's local storage: it holds only the booking number and prevents the booking from being counted twice.

How long. Each cookie expires at the end of the duration shown above. In Google Analytics, data linked to your browser's identifier is kept for fourteen months at most. In Clarity, page recordings are kept for thirty days and click data for nine months, periods set by Microsoft. Google Ads keeps conversion data under its own rules.

Who receives this data. Google Analytics and Google Ads are provided by Google Ireland Limited (Ireland), Clarity by Microsoft Ireland Operations Limited (Ireland); what they receive is described in section 6. Google states that Google Analytics neither logs nor stores IP addresses, and uses them to work out an approximate location (country, city). For Google Analytics, Google acts on our behalf. For ad measurement, Google acts as a separate controller; so does Microsoft, for Clarity and for its own cookies. Their practices are described in Google's privacy policy, on the page How Google uses information from sites and in the Microsoft Privacy Statement. These companies may process the data in the United States: see section 7.

Where your visit came from. If you accept audience measurement, the site keeps, during your visit and in your browser alone (session storage, cleared when you close the tab), where you arrived from: the source, medium and campaign name as they appear in the link address (for example "google", "cpc", "summer-2026"), only the fact that you came from an ad, never the click identifier, or otherwise the site you came from, and the first page viewed. When you send a booking request or a message, this information is attached to it, so we know which campaigns bring us customers. It is kept in our management tool with your request or message, for as long as they are (section 4), seen by our team only, and passed to no one. If you decline audience measurement or withdraw your consent, it is neither kept nor attached to your requests.

Legal basis and withdrawal. These tools and the record of where your visit came from rely on your consent (Article 82 of the French Data Protection Act and Article 6(1)(a) of the GDPR). Your choice is kept in your browser for six months (section 3), after which the banner asks you again. You can change it or withdraw your consent at any time, just as easily as you gave it, through the "Manage cookies" link at the bottom of every page or with this button: Manage cookies. After a withdrawal, none of these tools is loaded any more; those already running stop when the page is reloaded, and cookies already set are no longer read. You can also delete them in your browser settings. Withdrawal does not affect what was done before it. Your other rights are described in section 9.

Other tools. The list above is the list of active tools. Before any tool is added, this page is updated, the new tool is placed in one of the two categories, and you are asked for your choice again.

Links and payment. The contact links, phone and email, are plain links: they call no outside service. The WhatsApp link, offered for urgent requests, is also a plain link: nothing is sent to WhatsApp unless you click it. If you write to us on WhatsApp, your conversation goes through that service (Meta), which handles it under its own terms. When you pay, you leave our site for the payment page hosted by Stripe, which sets its own cookies, needed to secure the payment and to prevent fraud; they are described in Stripe's privacy policy.

1111. Changes

We will update this policy if our processing changes, and before any new audience measurement or advertising tool is added. The date of the last update appears at the top of the page.