Payments & Security
Who takes your payment, what we can and cannot see, and what the charge will look like on your statement.
1. Who processes your payment
Card payments are processed by Stripe. Where offered and where you choose it, PayPal payments are processed by PayPal. Both are regulated payment institutions and both are named in our Privacy Policy as processors.
You pay on the site you are already on. We do not redirect you to a different brand or a different domain to take your money, because being bounced to an unfamiliar site at the moment of payment is exactly when people abandon a booking — and rightly so.
2. What we never see
Your card number, expiry date and security code are entered directly into a payment form hosted by Stripe and are transmitted to Stripe. They do not pass through our servers and are never stored in our systems. We could not retrieve your card number if you asked us to.
Stripe is certified to PCI DSS Level 1, the highest level defined by the card schemes. Our own use of it is designed so that the card data environment stays entirely on their side.
What we do hold is listed in the Privacy Policy: your name, email, phone number if you gave one, the monument you booked and the visit date you gave us, the amount, and a payment reference from the processor.
3. What appears on your statement
The charge is shown with a descriptor identifying the site you booked on, so the line on your statement matches the brand you remember buying from. The exact descriptor for your booking is shown to you before you pay and repeated in your confirmation email.
This is deliberate. Most card disputes are not fraud; they are someone failing to recognise a line on a statement weeks later. If you cannot place a charge from us, email [email protected] with the amount and date and we will identify it for you the same day.
4. Strong customer authentication
Payments from customers in the European Economic Area and the United Kingdom are subject to strong customer authentication. Your bank may ask you to confirm the payment in its app or by a code — this is 3-D Secure, it is required by law, and it is your bank asking, not us.
If authentication fails the payment does not complete and no booking is created. Nothing is taken and you can try again.
5. Currency
All prices are shown and charged in euro (EUR). The official monument entry price is also shown in Moroccan dirham (MAD) beside our price, so you can see exactly what the gate charges and what our service costs on top of it.
If your card is denominated in another currency, your bank performs the conversion at its own rate and may add its own fee. That conversion is between you and your bank; we receive the euro amount shown.
6. Fraud prevention
Stripe and PayPal run fraud checks on payments made through this site, which involves them processing technical information about the device and the transaction. This is necessary to take payment safely and runs on the basis of our legitimate interest in preventing fraud; it is described in our Privacy and Cookie Policies.
We may decline or cancel and refund a booking where a payment is flagged as high risk. Where we do, we refund in full to the original payment method.
7. Disputes and chargebacks
If something is wrong with a booking, contact us before contacting your bank. Where a refund is due we pay it quickly, and a chargeback takes considerably longer to resolve than an email does.
Where a booking was delivered as described and our terms were accepted at checkout, we will contest a chargeback and provide the processor with the record of exactly what was shown and agreed at the time of purchase, including the price comparison and the refund policy as they appeared on screen.