Privacy policy

Who is responsible for your data?

IMMOBILIUS SARL, publisher of the Hosteo platform (Avenue Louis Van Beethoven, Léonore Offices N° 28, Tanger, Maroc), is the controller of the data collected on this website and about its customers. Contact: support@hosteo.ma.

We apply Moroccan law no. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data (dahir no. 1-09-15), enforced by the National Commission for the Control of Personal Data Protection (CNDP).

Two situations to tell apart

• Your own data (website visitor, demo request, Hosteo customer, workspace user): we are responsible for it.
• Guests’ data entered by our customers in their Hosteo workspace (reservations, identity, messages…): the customer, the property or manager, is the data controller; Hosteo acts on its behalf and on its instructions, only to provide the service.

The data we process

• Demo request: name, email, phone, property, type of business, number of units, message.
• Account and billing: name, email, phone, company, billing details, sign-in log.
• Customer workspace (on the customer’s behalf): properties, reservations, guest profiles, copies of ID documents, WhatsApp numbers, emails, messages, payments, housekeeping and maintenance data.
• Website audience measurement: pages viewed and device, through the Google tools described below.

Why, and on what basis

• Answering your contact or demo request: with your consent.
• Providing the service, invoicing, support and security: to perform the contract between us.
• Meeting our legal obligations, including accounting and tax.
• Measuring website audience and improving its content.

We do not sell any data, and we do not use our customers’ guests’ data for targeted advertising.

Who receives your data

Only the members of our team who need it, and technical providers who help us run the service:

• hosting and infrastructure of the platform;
• transactional email delivery (SendGrid);
• encrypted backups kept away from the main server (Backblaze B2);
• automatic message translation, when the customer turns it on (OpenAI);
• synchronisation with Airbnb, Booking.com, Expedia and other channels (Channex), when the customer connects them;
• audience measurement and advertising for our website (Google);
• payment gateways chosen by the customer (CMI, Stripe, PayPal), which process payments themselves.

No provider is allowed to use your data for its own purposes.

Transfers outside Morocco

Some of these providers are established outside Morocco. Transfers of data abroad are governed by articles 43 and 44 of law no. 09-08: they are only possible to countries offering a sufficient level of protection, or in the cases provided for by law.

How long we keep it

• Account data is kept for the duration of the contract. When the relationship ends, it is handed over to the customer in a usable format, then deleted on request.
• Photos of guests’ ID documents are deleted automatically after the stay.
• Billing data is kept for the periods required by Moroccan accounting and tax rules.
• Backups are renewed regularly; deleted data disappears from them as older backups expire.

How we protect it

• encrypted connection (HTTPS) and passwords stored in hashed form;
• a separate space for each customer company, with role-based access;
• two-step verification available, team sign-in with a WhatsApp code;
• sign-in attempt limits and a log of important actions;
• daily backups.

Cookies and audience measurement

The hosteo.ma website uses Google Analytics (audience measurement) and Google Ads (measuring our ads and personalisation). These cookies are only set with your consent: on your first visit, a banner lets you accept all, reject all or choose. Without your consent, no measurement or advertising cookie is set; Google then only receives anonymous, cookieless signals under its “consent mode”.

Your choice is kept for 12 months in your browser. You can change it at any time with “Cookie settings” at the bottom of every page, or delete cookies in your browser settings. The application itself only uses the session cookie needed to sign in.

Your rights

Under law no. 09-08, you have the right to information (article 5), access (article 7), rectification (article 8) and objection, including to direct marketing (article 9).

To exercise them, write to support@hosteo.ma, describing your request and attaching proof of identity. If you are a guest whose data a property entered into Hosteo, please contact that property first, as the data controller; we will help it answer you.

If you believe your rights are not respected, you can contact the CNDP (cndp.ma).

Updates

This policy may change, for example if we add a service. Version of 9 October 2026.