- ATOL & IATA protected bookings
- ATOL & IATA protected
Please read this page carefully. If anything is unclear, contact our team before booking.
Last updated: 26/08/2026
This Privacy Policy explains how Al Hidayah Tours (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you visit alhidayahtours.com (the “Site”) or use our Hajj and Umrah travel services.
We are committed to handling your data responsibly, particularly given the sensitive nature of travel documents (such as passports and visa applications) that our services require. If you do not agree with this policy, please do not use the Site or our services.
Before publishing: please confirm and insert the following, as we could not verify them independently:
- Full registered company name and company number (Companies House)
- Registered office address
- ICO registration number (search the ICO register to confirm yours)
- A contact email/address for data protection queries This document is a working draft, not legal advice — see the note at the end of this file.
Al Hidayah Tours is a UK-based Hajj and Umrah travel agency.
We act as the “data controller” for the personal data described in this policy — meaning we decide how and why your data is used.
Depending on how you interact with us, we may collect:
Information you give us directly
Information collected automatically
Some information needed for Hajj and Umrah travel — for example, health conditions relevant to travel insurance, or dietary requirements — may count as “special category data” under UK GDPR. We only collect this where you choose to provide it, and only use it to arrange appropriate travel arrangements on your behalf, with your explicit consent.
| Purpose | Legal basis |
|---|---|
| Processing your Hajj/Umrah booking, visa application and travel arrangements | Performance of a contract with you |
| Responding to enquiries and providing customer support | Performance of a contract / legitimate interest |
| Sending you marketing about future packages (only if you’ve opted in) | Consent |
| Complying with UK travel, tax and financial regulations | Legal obligation |
| Improving the Site and understanding how it’s used | Legitimate interest |
| Processing special category data (health/dietary needs) for travel arrangements | Explicit consent |
If the legal basis we rely on changes, we will notify you and explain the new basis before continuing to process your data. Where we rely on consent, you may withdraw it at any time.
We share personal data only where necessary to deliver your travel arrangements, including with:
We do not sell your personal data to third parties.
Because Hajj and Umrah require sharing certain data with authorities and service providers in Saudi Arabia, some of your data will be transferred outside the UK. Where this happens, we take steps to ensure it is protected to a standard consistent with UK data protection law, and such transfers are generally necessary to perform your booking contract (i.e. to obtain your visa and confirm your travel).
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including:
Card payments are processed by our third-party payment provider. We do not store complete card numbers on our own systems. Please refer to your payment provider’s own privacy policy for how they handle your payment data.
You have the right to:
To exercise any of these rights, contact us at [insert email address]. We will respond within the timeframes required by UK GDPR.
If you are unhappy with how we’ve handled your data, you have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk, though we’d appreciate the chance to resolve any concern directly first.
The Site uses cookies and similar technologies to operate correctly, remember your preferences, and understand how visitors use the Site. You can control or disable cookies through your browser settings; doing so may affect how some parts of the Site function. [Expand this section, or link to a dedicated Cookie Policy, once your cookie consent tool/plugin is confirmed.]
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse, including secure hosting, restricted access to booking and passport data, and encrypted transmission of payment details. No online system is completely secure, but we take reasonable steps to protect your information.
Our packages sometimes include family travel involving children. Where we collect data about a child (e.g. for a visa application), we do so with the consent and involvement of the child’s parent or guardian, who is responsible for the accuracy of the information provided.
We may update this policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on this page with a revised “last updated” date, and where changes are significant, we will take reasonable steps to notify you.
If you have questions about this policy or how we handle your data, contact us at:
This document was drafted as a starting point and has not been reviewed by a solicitor. Given that this business handles passport data, visa applications and international data transfers to Saudi Arabia, we’d recommend having a solicitor or GDPR consultant review the final wording before publishing — particularly Sections 4, 7 and 8 — to make sure it accurately reflects your actual data flows, retention periods, and any specific systems (booking software, CRM, payment gateway) you use.
Our team is happy to explain anything before you book.
