Privacy notice

1.Who is responsible for your information

Sahaba Investments Pvt Ltd, trading as Sahaba Hajj & Umra, in the Republic of Maldives. If you want to know what we hold about you, or want it corrected, call our hotline and ask.

2.What we collect

We collect only what a pilgrimage actually requires. In practice that is:

• Your name as it appears in your passport, and in Dhivehi where you give it.
• Your Maldivian national identity number, date of birth and gender.
• Your passport number, issue and expiry dates, and a scan of the photograph page.
• A photograph of you, for the visa application.
• Your address — atoll, island and house — and your telephone number and email address.
• Medical or mobility needs, and whether you need wheelchair assistance, where you tell us.
• An emergency contact.
• Your payment records, including bank transfer slips you upload.

3.Why we need each of these

Your identity documents and photograph are required to apply for your Umrah visa and to register you on the Saudi Nusuk system. Without them we cannot get you into the country.

Your name, passport number and date of birth go on the airline manifest. Your gender and family grouping determine how rooms are allocated, because men and women who are not related do not share a room.

Medical and mobility information lets us seat you appropriately on a coach, room you near a lift, and arrange assistance at the airport. Telling us is voluntary; not telling us may mean we cannot make those arrangements.

Your address and telephone number are how we reach you, including at short notice if a flight time changes.

4.Who we share it with

We share the minimum necessary, and only with organisations that need it to deliver your programme:

• The Saudi authorities, through the visa application and the Nusuk system.
• The airline carrying the group, for the passenger manifest.
• The hotels in Makkah and Madinah, for the rooming list.
• Our ground handler in Saudi Arabia, for transport and assistance.
• The Ministry of Islamic Affairs, where we are required to report on a programme.

5.How it is stored

Your national identity number, your passport number and any medical notes are encrypted before they are written to our database. Anyone reading the database directly — including from a stolen backup — sees ciphertext, not your details.

Our staff screens show only the last four digits of an identity or passport number by default. The full value is decrypted only where a task genuinely needs it, such as producing the airline manifest.

Uploaded documents are never published at a public web address. They are held outside the website’s public files and are served only through a route that checks who is asking. Every export of pilgrim data is recorded, so we know who accessed what and when.

6.How long we keep itTo be confirmed

We keep your booking and payment records for as long as we are required to for tax and regulatory purposes.

Passport scans and photographs are needed only until your visa is issued and the programme has ended. We intend to delete them after that rather than keep them indefinitely.

7.Photographs taken during a programme

We photograph our groups, and we publish some of those photographs on this website and in our materials.

We do not publish a photograph in which you are identifiable without your written permission. If you would rather not appear, tell your group leader — it is no trouble, and it will not affect anything else about your programme.

If a photograph of you is already published and you want it removed, tell us and we will take it down.

8.Cookies

This website sets two cookies, both strictly necessary, and neither is used to track you:

• One keeps you signed in to your booking, so you do not have to sign in on every page.
• One remembers a booking you have started, so that closing the tab does not lose what you have entered.

9.Your rights

You may ask us for a copy of what we hold about you, ask us to correct anything wrong, or ask us to delete information we no longer need. Call our hotline and we will deal with it.

We will respond within thirty days. We may need to confirm your identity first, which is a protection for you rather than an obstacle.

10.If something goes wrong

If pilgrim information is ever exposed, we will tell the people affected directly and promptly, explain what happened and what we are doing about it, and report it to the relevant authority where we are required to.

We would rather tell you about a problem than have you learn of it elsewhere.

11.Changes to this notice

The version and date of this notice are shown at the top of the page. If we change it materially we will say so on the website rather than change it quietly.