This policy explains what personal data Sun On Our Skin collects from visitors, why we collect it, how long we keep it, and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, and Moroccan Law 09-08 on the protection of personal data.

Section 01Who is responsible for your data

The data controller responsible for your personal data is Ayman Kandoussi, an individual operating the website Sun On Our Skin (sunonourskin.com) in a personal capacity, based in Morocco. Sun On Our Skin is not an incorporated company — the site is run personally by Ayman Kandoussi.

Section 02EU representative (Article 27 GDPR)

Sun On Our Skin is operated from Morocco, outside the European Union. Article 27 of the GDPR normally requires controllers based outside the EU to appoint a representative within it. Article 27(2) provides an exemption where the processing is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to people’s rights and freedoms.

Our processing consists only of a contact form, an optional email newsletter, and aggregate website analytics. It is occasional, small in scale, involves no special-category or criminal-offence data, and presents a low risk to individuals. On that basis we rely on the Article 27(2) exemption and have not appointed an EU representative. You can raise any data protection matter with us directly at privacy@sunonourskin.com, and you keep the right to complain to your national supervisory authority — see Section 09.

Section 03What data we collect

Data you give us directly

• Contact form — your name, your email address, and the content of your message.
• Newsletter sign-up — your email address, plus your first name if you choose to give it.
• Comments (where enabled on a post) — the name, email address, and comment you submit, plus your IP address and browser user-agent, which WordPress records for spam prevention.

Data collected automatically

• Website analytics — pages viewed, approximate location at country or city level, device type, browser, and referring site. Collected by Google Analytics 4 and used in aggregate.
• Pinterest Tag — a page-view signal sent to Pinterest, used to measure how visitors arriving from Pinterest use the site.
• Server logs — our host records IP addresses and request data automatically, for security and troubleshooting.

Analytics and Pinterest tracking only run after you consent through the cookie banner. If you decline, those scripts are never loaded.

What we never collect

We do not sell products directly, so we never collect payment card details, billing addresses, or financial information. We do not collect special categories of data — health, religion, political opinions, biometric data, sexual orientation, or anything similar — and we ask that you don’t send such information through the contact form.

Section 04Why we process your data, and on what legal basis

Purpose	Data used	Legal basis (GDPR Art. 6)
Replying to your message	Name, email, message	Legitimate interest — answering someone who contacted us
Sending the newsletter	Email address, first name	Consent — you opted in, and can opt out any time
Understanding site traffic	Analytics data	Consent, given through the cookie banner
Measuring Pinterest referrals	Pinterest Tag data	Consent, given through the cookie banner
Publishing your comment	Name, email, comment, IP	Consent — you chose to submit it
Security and abuse prevention	IP address, server logs	Legitimate interest — keeping the site online and secure

Section 05Cookies

Cookies are small text files stored in your browser. Sun On Our Skin uses three categories:

• Necessary — required for the site to work, such as remembering your cookie choice. Always active; no consent needed.
• Analytical — set by Google Analytics 4 (cookies beginning _ga) to measure visits and page views. Loaded only with your consent.
• Advertising — set by the Pinterest Tag (_pinterest_ct_ua and similar) to measure traffic arriving from Pinterest. Loaded only with your consent.

You can change or withdraw your consent at any time using the cookie settings link in the site footer, and you can delete existing cookies through your browser. Blocking analytical and advertising cookies does not affect your ability to read anything on the site.

Section 06Who we share your data with

We do not sell your personal data, and we never share it for anyone else’s marketing. We use the following service providers, each of which handles data only in order to provide their service to us:

• Hostinger — website hosting and server logs.
• MailerLite — newsletter delivery and subscriber management.
• Google — website analytics via Google Analytics 4.
• Pinterest — measurement of referral traffic from Pinterest.

We may also disclose data where the law requires it, for example in response to a valid order from a competent authority.

Section 07International transfers

Sun On Our Skin is operated from Morocco, and the providers above process data on servers in the European Union, the United Kingdom, and the United States. Where data belonging to EU or UK visitors is transferred outside those regions, our providers rely on the European Commission’s Standard Contractual Clauses or an equivalent approved transfer mechanism. Google and Pinterest each publish their own transfer safeguards in their respective privacy policies.

Section 08How long we keep your data

• Contact form messages — deleted 12 months after our final reply, unless an ongoing conversation means we need them longer.
• Newsletter subscribers — kept for as long as you stay subscribed. If you unsubscribe, your record is deleted from MailerLite within 30 days, apart from a minimal suppression entry (your email address alone) kept so we don’t accidentally email you again.
• Google Analytics — retained for 14 months, after which Google automatically deletes user-level and event-level records. Aggregate reports containing no personal data may be kept longer.
• Comments — kept for as long as the comment stays published. Deleted on request.
• Server logs — kept by our host on a short rolling cycle, typically no more than 30 days, for security and diagnostics.

Section 09Your rights

If you are in the EU, the UK, or Morocco, you have the right to:

• Access the personal data we hold about you
• Rectify data that is wrong or incomplete
• Erase your data — the “right to be forgotten”
• Restrict or object to our processing of it
• Receive a copy in a portable, machine-readable format
• Withdraw consent at any time, without affecting processing that already happened on the basis of your earlier consent

To exercise any of these, email privacy@sunonourskin.com. You can unsubscribe from the newsletter instantly using the link at the bottom of every email we send.

Complaints

If you think we’ve handled your data badly, we’d rather you told us first so we can put it right. You also have the right to complain directly to a supervisory authority:

• Morocco — Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP): www.cndp.ma
• European Union — your national data protection authority. The full list is published by the European Data Protection Board: edpb.europa.eu
• United Kingdom — the Information Commissioner’s Office: ico.org.uk/make-a-complaint

Section 10Affiliate links

Some articles on Sun On Our Skin contain affiliate links. If you click one and make a booking or purchase, we may earn a commission at no extra cost to you. Clicking an affiliate link takes you to a third-party website, which sets its own cookies and applies its own privacy policy. We never receive your personal data from those partners — only aggregate reports of how many bookings were made. Once you leave our site this policy no longer applies, so it’s worth reading the privacy policy of whichever site you land on.

Section 11Children

Sun On Our Skin is not aimed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@sunonourskin.com and we will delete it promptly.

Section 12Security

The site is served only over HTTPS. Access to the WordPress admin area is protected by strong, unique credentials, and the site and its plugins are kept up to date. No method of transmission over the internet is completely secure, so while we take reasonable measures to protect your data, we cannot guarantee absolute security.

Section 13Changes to this policy

We may update this policy as the site changes or as legal requirements evolve. Any new version is posted on this page with a revised “Last updated” date. If we make a material change to how we use your personal data, we will tell newsletter subscribers by email.

Section 14Contact