1. Scope and identity
Who is responsible for your information?
Al-Hudaa Wal-Furqaan Travels and Tours is the organisation responsible for
deciding why and how personal information covered by this policy is processed.
The company is registered in Nigeria under CAC Registration Number 7061855.
This policy applies to information collected through our website, enquiry and
booking forms, telephone calls, email, WhatsApp communications, office visits,
consultations and related travel-service interactions.
This policy should be read together with the Booking Policy and Terms and
Conditions. It does not itself create a confirmed travel booking.
2. Information collected
The categories of information we may process.
| Category |
Examples |
When collected |
| Identity and contact information |
Name, telephone number, email address, nationality and current city or state. |
When you submit an enquiry, request a consultation or contact the company. |
| Journey preferences |
Hajj or ‘Umrah interest, package choice, preferred period, departure city, number of travellers and accommodation request. |
When you complete an enquiry or discuss a possible booking. |
| Communication records |
Messages, questions, call notes, email correspondence and support requests. |
When you communicate with our staff or authorised representatives. |
| Booking and transaction information |
Payment status, invoice references, booking history and services selected. |
When an enquiry progresses towards a booking or payment arrangement. |
| Travel documentation |
Passport and visa-related details, where required through an approved process. |
Only after the information becomes necessary for travel processing. |
| Health or accessibility information |
Information reasonably required to understand travel-support or accessibility needs. |
Only where relevant and shared through an appropriate process. |
| Website and technical information |
IP address, browser type, device information, page interactions and security logs where collected by the website or service provider. |
When you access or interact with the website. |
Information about other travellers
Where you provide information about a family member or another traveller, you
should have authority to do so and should inform that person that their information
may be processed for the relevant enquiry or travel arrangement.
3. Purposes
How we use personal information.
- To receive, review and respond to Hajj and ‘Umrah enquiries.
- To recommend or explain package options based on the information provided.
- To arrange consultations and communicate about availability and next steps.
- To prepare itineraries, invoices, payment schedules and booking records.
- To assist with flights, accommodation, ground transport, visa processing and related travel services.
- To provide pre-departure information, orientation, updates and traveller support.
- To respond to complaints, questions, cancellation requests and service issues.
- To maintain business, financial, security and compliance records.
- To prevent fraud, misuse of the website and unauthorised access.
- To improve our website, forms, communications and customer service.
We do not sell personal information to advertisers. Personal information is not
used for unrelated marketing merely because you submitted a travel enquiry.
4. Lawful bases
Why we are permitted to process information.
Depending on the activity, we may rely on one or more recognised lawful bases:
- Consent: where you freely agree to a specific use, including optional communications or processing that requires consent.
- Steps requested before a contract: where you ask us to provide package information, prepare a quotation or assess a booking request.
- Contract: where processing is necessary to provide travel services you have booked.
- Legal obligation: where records or disclosures are required by applicable law, regulation or authorised public bodies.
- Legitimate interests: where reasonably necessary for customer service, security, fraud prevention, administration or improvement, provided your rights are not overridden.
- Vital interests: where processing is necessary to protect life or safety in an emergency and another lawful basis is not reasonably available.
Sensitive information, such as health-related information, will be handled only
where there is an appropriate legal basis and the information is genuinely relevant
to the travel service or a traveller’s safety and support.
5. Sharing and service providers
When information may be disclosed.
We may share relevant information only to the extent reasonably required with:
- Authorised employees, travel advisers and representatives who need the information to assist you.
- Website hosting, form, customer-relationship management, email, telephone and messaging service providers.
- Airlines, hotels, transport providers and other suppliers involved in a confirmed or proposed itinerary.
- Visa-processing partners, authorised pilgrimage bodies, regulators, immigration authorities and other public bodies where applicable.
- Banks, payment processors, accountants, auditors, insurers and professional advisers where necessary.
- Law-enforcement or regulatory bodies where disclosure is lawfully required or necessary to protect rights and safety.
Service providers are expected to process information only for authorised purposes
and to apply appropriate confidentiality and security safeguards.
International processing and transfers
Hajj and ‘Umrah travel arrangements may require information to be processed outside
Nigeria, including in Saudi Arabia or in countries where airlines, hotels, technology
providers or other travel suppliers operate. Where applicable, we will take
reasonable steps to use lawful transfer mechanisms and appropriate safeguards.
6. Security
How we seek to protect information.
- Limiting access to staff or providers who reasonably require the information.
- Using password protection, access controls and appropriate technical safeguards.
- Keeping sensitive documents away from public website forms.
- Reviewing suspicious access, misuse or disclosure where detected.
- Using reputable service providers for website, communication and record-management functions.
- Taking reasonable steps to respond to a confirmed personal-data breach.
No website, email, messaging platform or electronic storage method is completely
risk-free. You should use trusted devices, protect your accounts and verify company
payment instructions before transferring money.
7. Retention
How long information is kept.
We retain personal information only for as long as reasonably necessary for the
purposes described in this policy, including responding to enquiries, providing
travel services, maintaining business records, handling disputes and complying with
legal or regulatory obligations.
- Unsuccessful or inactive enquiries may be deleted or anonymised when no longer reasonably required.
- Booking and payment records may be kept for longer where needed for accounting, legal or dispute-resolution purposes.
- Passport, visa and health-related information should not be retained longer than required for the relevant purpose and applicable obligations.
- Backup copies may remain temporarily until they are overwritten in the ordinary backup cycle.
Retention periods may differ according to the type of information, the service
provided and any applicable legal requirement.
8. Your rights
Requests concerning your personal information.
Subject to applicable law and any lawful limitations, you may request:
- Information about whether and how your personal information is processed.
- Access to personal information held about you.
- Correction of inaccurate or incomplete information.
- Deletion of information where there is no lawful reason to retain it.
- Restriction of processing in appropriate circumstances.
- Objection to certain processing, including processing based on legitimate interests.
- Withdrawal of consent where consent is the basis of processing.
- Data portability where the applicable legal conditions are met.
- A review of a significant decision made solely through automated processing, where applicable.
- Submission of a complaint to the Nigeria Data Protection Commission.
To protect personal information, we may ask for reasonable proof of identity before
acting on a request. Some requests may be limited where retention or processing is
required by law, necessary for legal claims or otherwise permitted by applicable law.
9. Cookies and website technology
How the website may store or receive technical information.
The website and embedded services may use essential cookies or similar technologies
required for security, form operation, page functionality and user preferences.
Analytics, advertising or non-essential tracking technologies should not be added
without updating this policy and, where required, providing an appropriate consent
mechanism. Browser settings may allow you to block or remove cookies, although some
website functions may not work correctly afterwards.
10. External links and platforms
Third-party websites have their own privacy practices.
The website may link to WhatsApp, Google Maps, airlines, hotels, government
platforms or other third-party websites and services. Their handling of information
is governed by their own policies and is outside our direct control.
Before sending sensitive information through a third-party platform, confirm that
the account, website or recipient is genuine and that the method has been approved
for the intended purpose.
11. Children
Information relating to travellers under 18.
A parent, guardian or authorised adult should submit and manage travel enquiries
concerning a child. We do not intentionally ask children to submit independent
booking enquiries through the website.
Where information about a child is necessary for a family booking, it should be
limited to what is reasonably required and handled with additional care.
12. Contact and complaints
How to raise a privacy request.
Contact us with the subject line “Privacy Request” and describe the
information or concern involved.
- Email: [email protected]
- Telephone: +234 816 393 9441
- Head Office: 44B, Ita Olookan Street, Osogbo, Osun State, Nigeria
- Business Hours: Monday–Friday, 9:00 a.m.–6:00 p.m.
You may also raise a complaint with the Nigeria Data Protection Commission where
you believe your privacy rights have been infringed.
This policy is a practical website privacy notice and should be reviewed by a
qualified Nigerian data-protection professional before final legal adoption,
particularly after the company confirms all processors, booking systems and
document-handling procedures.
13. Changes to this policy
Updates may be made when practices change.
We may update this Privacy Policy to reflect changes in the website, forms, service
providers, travel processes or applicable requirements. The revised effective date
will be displayed at the top of this page.
Material changes should be communicated through an appropriate channel where
reasonably practicable.
