Who processes your data
ICON TRANS SARL, a tourist transport company established in Morocco, is the data controller for data collected through icontrans.org and in the course of its services.
Two regimes apply depending on your situation:
- Moroccan law 09-08 on the protection of individuals with regard to the processing of personal data, supervised by the CNDP;
- the GDPR (EU 2016/679), where you reside in the European Union — which covers most of our clients.
Dedicated contact: privacy@icontrans.org
What we collect
What you give us
- Quote request — name, email, phone or WhatsApp, pickup and destination, date and time, passenger and luggage numbers, flight number where relevant, preferred vehicle and your free-text notes.
- Confirmed booking — billing details, hotel or riad name, and correspondence about the journey.
- Corporate or agency clients — company name, tax identifiers and contact details.
Collected automatically
- Server logs — IP address, timestamp, page requested, response code, referrer and user agent, recorded by our host for security and diagnostics.
- No advertising tracking — no pixels, no ad networks, no third-party analytics. See our cookie policy.
What we don't want to receive
Please don't send card numbers, passport or ID scans, or health data through the form or by email. If a booking genuinely requires something specific — reduced mobility, for instance — tell us only what's strictly needed to organise the transport.
Why, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answering a quote request | Contact details, journey details | Pre-contractual steps — art. 6.1.b |
| Performing the transport service | Route, flight, hotel, contact | Contract performance — art. 6.1.b |
| Invoicing and accounting | Billing details | Legal obligation — art. 6.1.c |
| Site security, abuse prevention | Logs, form metadata | Legitimate interest — art. 6.1.f |
| Handling complaints and disputes | Booking file | Legitimate interest — art. 6.1.f |
We carry out no profiling and no automated decision-making producing legal effects concerning you.
Who has access
We neither sell nor rent your data. Access is limited to what's necessary:
- Your assigned driver receives your name, pickup place and time, destination and phone number — nothing more.
- Our host (Namecheap, USA) hosts the site and routes form emails.
- Our business mail provider stores email correspondence.
- Our accountant accesses invoicing records, as their legal obligations require.
- A partner operator may be engaged in the event of exceptional unavailability; they receive only the information needed for the journey and remain bound by confidentiality.
We also disclose data where the law compels us — a court order or a request from a competent authority.
Transfers outside Morocco and the EU
Our hosting and email are located in the United States. For people resident in the EU, that constitutes a transfer outside the European Economic Area.
These transfers rely on the European Commission's Standard Contractual Clauses in our providers' agreements, supported by encryption in transit and at rest and access limited to what is strictly required.
For individuals covered by law 09-08, transfers abroad are made in accordance with CNDP requirements.
Retention periods
| Record | Period |
|---|---|
| Quote requests that go nowhere | 18 months from last contact |
| Client file and correspondence | Duration of the relationship + 3 years |
| Invoices and accounting records | 10 years (Moroccan legal requirement) |
| Server logs | 12 months maximum |
Beyond those periods, data is deleted or anonymised.
Security
- TLS encryption across the whole site and the form
- Two-factor authentication on mailbox access
- The request log directory is not reachable from the web
- Information passed to drivers is limited to the journey itself
- No card data stored: payment is cash to the driver, bank transfer, or via a payment provider that handles card details itself
No system is perfectly secure and we won't pretend otherwise. In the event of a breach likely to result in a high risk to your rights, we inform you promptly and notify the competent authority within 72 hours.
Your rights
If you reside in the European Union
You have rights of access, rectification, erasure, restriction, portability and objection to processing based on our legitimate interest.
You may lodge a complaint with the supervisory authority in your country of residence. We'd naturally rather resolve it with you directly first.
If law 09-08 applies
You have rights of access, rectification and objection, and may refer the matter to the CNDP (Morocco's data protection authority).
Exercising your rights
Write to privacy@icontrans.org from the address you gave us, or provide enough detail for us to locate your file. We respond within 30 days. There's no charge unless a request is manifestly unfounded or excessive.
Minors
Our services are aimed at adults. We do not knowingly collect data about minors beyond what is strictly needed to organise family transport — typically a child's age and weight, so the right seat is fitted. That information is deleted after the journey.
Changes
This policy changes if our practices or the law change. The effective date appears at the top of the page. A substantive change affecting a booking in progress is notified to you by email.
Contact
ICON TRANS SARL
Marrakech, Maroc
Last updated 13 September 2026. The version in force is the one published at icontrans.org/en/privacy/.
Questions: legal@icontrans.org