YourStay — by MartilRealEstate Effective Date: April 1, 2026 | Version 1.0 | Governed by Moroccan Law — Loi n° 09-08

Our Commitment to Your Privacy

At YourStay, we take your privacy seriously. This Privacy Policy explains how MartilRealEstate, operating under the YourStay brand, collects, uses, stores, and protects your personal data when you use our platform or make a booking with us.

We process your personal data in strict compliance with Loi n° 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel, enforced by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). Our data processing activities have been declared to the CNDP in accordance with our legal obligations.

Please read this policy carefully. By using the YourStay platform or making a booking, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

MartilRealEstate — operating under the YourStay brand Registered in Morocco Address: N22 Kissariat Al andalus Av Hassan II, Martil Email: privacy@yourstay.ma

As data controller, MartilRealEstate determines the purposes and means of processing your personal data and is responsible for ensuring its lawful and secure handling.

2. What Personal Data We Collect

We collect only the data that is necessary to provide our services, comply with our legal obligations, and improve your experience. This principle of proportionality is required under Loi 09-08.

Identity Data

• Full name
• Date of birth
• Nationality
• Government-issued ID number (CIN for Moroccan nationals; passport number for foreign nationals)

Contact Data

• Email address
• Phone number
• Billing or correspondence address

Booking & Transaction Data

• Reservation history and booking details (dates, property, number of guests)
• Payment records and transaction references
• Security deposit amounts and refund records
• Communications exchanged with our team regarding your booking or stay

Technical & Usage Data

• IP address and device identifiers
• Browser type and operating system
• Pages visited on the Platform, time spent, and interaction data
• Cookies and similar tracking technologies (see Section 8)

Identity Verification Data (at check-in)

• Copy or reference number of government-issued identification document, as required by Moroccan tourism regulations (Loi 61-00)

We do not collect sensitive personal data as defined by Loi 09-08 (such as data revealing racial or ethnic origin, political opinions, religious beliefs, or health data), unless you voluntarily provide it and explicitly consent to its use.

3. How We Collect Your Data

We collect your personal data through the following means:

• Directly from you: when you create an account, make a booking, contact our support team, or fill out any form on the Platform.
• At check-in: when you present your identification document as required by Moroccan law.
• Automatically: through cookies and similar technologies when you browse the Platform (see Section 8).
• From third parties: such as payment processors who confirm transaction status, or identity verification services where applicable.

4. Why We Use Your Data (Purposes & Legal Bases)

We process your personal data only for specific, explicit, and legitimate purposes, as required by Loi 09-08. Below are the purposes for which we use your data and the legal basis for each:

To process and manage your booking We use your identity, contact, and payment data to confirm reservations, send Booking Confirmations, process payments, and manage your stay. This is necessary for the performance of the contract between you and MartilRealEstate.

To comply with Moroccan legal obligations We are legally required under Loi 61-00 (tourism accommodation) to record and retain the identity of all guests staying in properties we manage, and to make this information available to competent authorities (police, gendarmerie) upon lawful request. This processing is mandatory and cannot be refused.

To process payments and manage security deposits We use your payment data to collect booking amounts, manage security deposits, and process refunds. This is necessary for the performance of the contract.

To communicate with you about your stay We use your contact data to send you pre-arrival information, check-in instructions, receipts, and any important updates related to your booking. These are service communications, not marketing.

To handle complaints and disputes We use booking and communication data to investigate complaints, resolve disputes, and exercise or defend legal claims, in accordance with our legitimate interests and legal obligations.

To improve our Platform and services We use anonymised and aggregated usage data to analyse how our Platform is used and to improve its features and performance. This processing does not identify you personally.

To send marketing communications (only with your consent) If you have given us explicit consent, we may send you promotional offers, news about YourStay, or information about new properties. You can withdraw this consent at any time (see Section 7).

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law. Specific retention periods are as follows:

• Booking and transaction data: 5 years from the date of the stay, in compliance with Moroccan commercial and fiscal law.
• Identity documents (check-in records): As required by Moroccan tourism regulations (Loi 61-00), typically 1 year unless a longer period is required by law enforcement.
• Account data: For the duration of your registered account, plus 2 years after the last activity or account deletion request.
• Payment records: 5 years, as required by Moroccan accounting and tax law.
• Marketing consent records: Until you withdraw your consent, plus 1 year thereafter as proof of compliance.
• Technical and usage data: 13 months maximum from collection.

When data is no longer needed, it is securely deleted or anonymised.

6. Who We Share Your Data With

We do not sell, rent, or trade your personal data to third parties for commercial purposes. We share your data only in the following limited circumstances:

Moroccan authorities We are legally obligated to communicate guest identity information to competent Moroccan authorities (police nationale, gendarmerie royale) upon lawful request, in accordance with Loi 61-00 and applicable public order legislation.

Payment service providers We share payment data with our authorised payment processors solely to handle transactions. These providers are contractually bound to handle your data securely and only for the purpose of processing payments on our behalf.

IT and platform service providers We use trusted third-party providers to host our Platform, manage communications, and maintain our technical infrastructure. These providers act as data processors under our instructions and are bound by confidentiality obligations.

Legal and professional advisors We may share data with lawyers, accountants, or auditors where strictly necessary for legal compliance, dispute resolution, or regulatory obligations.

International transfers If any of our service providers are located outside Morocco, data transfers are subject to prior authorisation from the CNDP in accordance with Article 43 of Loi 09-08. We only transfer data internationally where adequate protections are in place.

7. Your Rights Under Loi 09-08

Loi n° 09-08 grants you the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@yourstay.ma with your full name, booking reference (if applicable), and a description of your request. We will respond within 30 days.

Right of Access You have the right to request a copy of all personal data we hold about you, along with information on how it is used, where it comes from, and with whom it is shared.

Right of Rectification You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

Right of Erasure (Right to be Forgotten) You have the right to request deletion of your personal data, subject to our legal retention obligations. We cannot delete data we are legally required to retain (e.g., guest identity records required by Moroccan tourism law).

Right to Object You have the right to object to the processing of your personal data for marketing purposes at any time. You may also object to other forms of processing where we rely on legitimate interests, unless we can demonstrate compelling reasons that override your interests.

Right to Withdraw Consent Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You can withdraw consent by clicking “unsubscribe” in any marketing email or by contacting us directly.

To submit a data rights request: privacy@yourstay.ma For complaints about our data practices, you may also contact the CNDP directly: www.cndp.ma or by calling 3020.

8. Cookies & Tracking Technologies

Our Platform uses cookies and similar technologies to ensure it functions properly, to analyse usage, and where you have consented, to deliver relevant content.

Strictly Necessary Cookies These cookies are essential for the Platform to work (e.g., maintaining your session, enabling secure login). They cannot be disabled without impairing your use of the site. No consent is required for these cookies.

Analytics Cookies We use analytics tools to understand how visitors use our Platform — which pages are visited, how long people stay, and where they come from. This data is aggregated and does not identify individuals. These cookies are only activated with your consent.

Preference Cookies These cookies remember your language, currency, or display preferences to improve your experience. Activated with your consent.

Marketing Cookies If you have given consent, these cookies allow us to show you relevant content and track the effectiveness of our communications. You can withdraw consent at any time through your browser settings or our cookie preference centre.

You can manage or withdraw cookie consent at any time through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform.

9. Data Security

MartilRealEstate implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction, as required by Loi 09-08.

These measures include:

• Encryption of data in transit (SSL/TLS) and at rest where applicable.
• Access controls limiting data access to authorised personnel only.
• Regular security reviews of our systems and infrastructure.
• Confidentiality obligations for all staff and service providers who handle personal data.
• Secure deletion procedures when data retention periods expire.

In the event of a personal data breach that poses a risk to your rights, we will take immediate action to contain and assess the incident, and will inform affected individuals and the CNDP as required by applicable law.

10. Children’s Privacy

The YourStay Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a person under 18, please contact us at privacy@yourstay.ma and we will promptly delete it.

11. Links to Third-Party Websites

Our Platform may contain links to third-party websites or services (e.g., payment providers, map services). This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party services you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the services we offer. When we make material changes, we will notify you by email and/or by posting a prominent notice on the Platform at least 15 days before the changes take effect, in accordance with Loi 31-08.

The date at the top of this page always reflects the most recent version. We encourage you to review this policy periodically.

13. Contact & Data Protection Officer

For any questions, concerns, or requests related to your personal data or this Privacy Policy, please contact us:

Data Privacy — YourStay / MartilRealEstate Email: privacy@yourstay.ma

Legal Department Email: legal@martilrealestate.ma

Registered Office MartilRealEstate — N22 Kissariat Al andalus Av Hassan II, Martil

Supervisory Authority Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) Avenue Al Arz, Secteur 4, M1, Hay Riad — Rabat, Maroc Tel: 3020 | www.cndp.ma

This Privacy Policy was drafted in compliance with Loi n° 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel (Morocco), and is consistent with the requirements of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).