Privacy notice

01

Who controls your information

Mohammad Shuaib Sakunder, a sole trader trading as Hajj Umrah Taxi is the controller of personal information submitted through this website for the agency service. The Information Officer is Mohammad Shuaib Sakunder and can be contacted at support@hajjumrahtaxi.co.uk. The same contracting identity must be displayed at checkout and on your receipt.

02

Information we collect

We may collect names, account and contact details, WhatsApp number, language and nationality, traveller and emergency contacts, exact locations, journey dates, flight or train details, passenger and luggage counts, booking history, messages, consent choices, device and security logs, refund records and partner-assignment information. Payment cards are tokenised by the payment provider; we do not store the full card number.

03

Sensitive and child information

Medical, mobility, religious-journey or assistance information can reveal special-category data. We request only what is necessary to arrange safe service and rely on explicit consent or another lawful condition where required. An adult booking for a child must have authority to provide the child's information and should give only what is needed.

04

Why we use information

We use information to create accounts, verify email, quote and administer journeys, take and reconcile payment, assign partners, send essential service notices, handle amendments, cancellation and complaints, protect the service from misuse, keep required financial records, improve performance and—only with the appropriate choice—send marketing.

05

Lawful bases

Depending on the activity, processing is necessary to take steps at your request or perform the contract, comply with legal obligations, pursue legitimate interests such as service security and records, or act on consent. Marketing consent and optional channel choices can be withdrawn without stopping essential booking messages.

06

Who receives information

We share only the information needed with the assigned driver or transport operator, payment and refund providers, website hosting and email services, mapping and address providers, professional advisers, analytics services where permitted, and public authorities where lawfully required. A partner does not need to see the retail fare merely to operate the journey.

07

Main service providers and their roles

Our current service chain can include Hostinger for website, database and mail infrastructure; Stripe for tokenised card payment, receipts, refunds and fraud controls; Google for address search, mapping, Search Console and consented analytics; and the assigned Saudi transport partner for operation of the accepted journey. Each provider receives only the categories needed for its role and may act as our processor, an independent controller, or both for different purposes. Provider privacy notices explain processing they control directly.

08

UK and Saudi international transfers

Operating a Saudi journey requires relevant information to be available in Saudi Arabia. Other suppliers may process data in further countries. We assess transfer routes and use an applicable adequacy decision, contractual safeguard, exception or other lawful mechanism, with data minimisation and access controls.

09

How long information is kept

We keep information only as long as needed for its purpose. Unfinished basket capabilities normally expire within days; email-verification and password-reset links expire within their stated short period; routine security and delivery logs are reviewed on a rolling basis; account details remain while the account is active and are then reviewed; support and complaint evidence is retained for the period reasonably needed to resolve and defend the matter; and booking, payment, refund and tax records may be retained for up to seven years where required. Legal claims, safeguarding incidents, fraud investigations or regulatory directions can justify a longer hold. A deletion request does not require deletion of records that lawfully must be retained, but unnecessary identifiers should be removed or restricted.

10

Marketing and communication channels

Essential account, security, payment and live-booking messages are sent because they are necessary for the requested service, legal duty or service security. Promotional email, WhatsApp and browser notifications use separate, channel-specific choices and are not a condition of booking. Where the limited electronic-mail "soft opt-in" is available, it is used only within its legal scope and every message provides a simple opt-out. Withdrawing optional consent does not affect processing already carried out lawfully.

11

Accuracy, call and message records

Customers can correct ordinary profile details from their account and should tell us promptly when a traveller, phone number, flight or address changes. Service emails, support messages, partner instructions, consent evidence and status timestamps may be retained as part of the booking record. Telephone calls are not recorded unless a clear notice and lawful basis are provided before recording begins.

12

Your choices and rights

Depending on the applicable law, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent. You can change optional email, web and WhatsApp preferences in your account. Essential booking, safety, security and legal notices cannot be disabled while relevant.

13

Analytics, pricing and human review

Site analytics help us understand page and booking performance where the required cookie choice permits. Pricing rules use route, time, vehicle and configured demand factors to produce a quotation. Payment creates a provisional request and a person or assigned partner reviews acceptance; an automated price is not a final driver assignment.

14

Security and complaints

We use access controls, encryption in transit, logs, scoped permissions and payment tokenisation, but no internet service can promise absolute security. Contact support@hajjumrahtaxi.co.uk first. UK concerns may be raised with the Information Commissioner's Office; Saudi residents may also have rights and complaint routes under the Saudi Personal Data Protection Law.

15

Data incidents

Suspected unauthorised access, loss or disclosure is contained, investigated and documented. Where the applicable risk threshold is met, we notify the relevant regulator and affected people within the period required by law. Customers should report suspicious account or payment messages through the published support address rather than replying with credentials.