Draft, not yet in force. The company details are still to be added, and this text should be reviewed by a lawyer before launch.
Privacy notice
Version 2026-11-01
This notice explains how personal data is handled when you book a trip with a Hajj or Umrah agency that uses Zuwwar, or when you use Zuwwar to run an agency. It follows the Nigeria Data Protection Act 2023.
1. Who is responsible
Zuwwar is run by [company name], [registered address]. Privacy contact: [privacy email].
- If you book a trip, the agency you book with decides how your data is used and is responsible for it (the “controller”).Zuwwar runs the website, booking and payment tools for the agency and handles your data on its behalf (the “processor”).
- If you work at an agency, Zuwwar is responsible for your account data.
2. What we collect
- Booking: the name, WhatsApp number and email of the person booking, the trip and room, and payments made.
- Each traveller: names, sex, date of birth, nationality, passport number and expiry date as printed in the passport, an emergency contact, and anything you choose to tell the agency in the notes. Photos or scans of the passport data page, a passport photograph and vaccination cards.
- Agency accounts: staff names and emails, the agency's business details, company registration and operator licence documents, and the bank account payments are paid into.
- Technical: your IP address and browser details in our server logs, and the cookies needed to keep agency staff signed in.
We only ask for what the agency needs to book your trip and apply for your visa.
3. Sensitive data
A Hajj or Umrah booking shows your religion, and vaccination cards and notes may include health details. The law treats these as sensitive. We process them only because you give your explicit consent when you book (or before you send travel documents), and only for your trip.
4. Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Taking your booking and payments, and keeping your booking page | Contract |
| Applying for your visa and arranging travel, hotels and transport | Contract, and your explicit consent for sensitive data |
| Payment reminders, receipts and document reminders by email and WhatsApp | Contract |
| Checking agencies before they get the Verified badge | Legitimate interest in protecting pilgrims |
| Keeping the service secure and preventing fraud | Legitimate interest |
| Keeping payment and accounting records | Legal obligation |
We don't use your data for advertising, and we don't sell it.
5. Children
Children can travel on a family booking. The person booking must be 18 or over and confirm that they are the parent or guardian of anyone under 18 on the booking, or have their permission. A parent or guardian can ask for a child's data to be corrected or deleted at any time.
6. Who we share it with
- The agency you booked with, and the staff they give access to.
- Saudi visa authorities and the agency's travel partners (airlines, hotels, transport), when the agency arranges your trip.
- Service providers that run Zuwwar for us: Paystack (payments), Vercel (hosting and file storage, UK), Neon (database, UK), Clerk (sign-in for agency staff, USA), Resend (email, USA) and Meta (WhatsApp messages).
- Authorities, when the law requires it.
7. Data sent outside Nigeria
Your data is stored and processed outside Nigeria by the providers above, and your visa application goes to Saudi Arabia. We do this because it's needed to provide your booking and with your explicit consent, and we choose providers that protect data under contract.
8. How long we keep it
- Passport details and document photos: deleted automatically 6 months after the trip ends, or 30 days after a booking is cancelled.
- Booking and payment records: as long as accounting and tax law requires, usually six years.
- Agency accounts: while the account is open, and up to 12 months after it closes.
- Server logs: a few weeks.
9. Keeping it safe
Documents are kept in private storage and can only be opened by the agency's signed-in staff (and the Zuwwar team when needed to support them). Booking links are private; don't share yours. Passport numbers are partly hidden on booking pages. Data is encrypted in transit.
10. Your rights
You can ask to see your data, correct it, delete it, limit or object to how it's used, get a copy to take elsewhere, or withdraw your consent (this may mean the agency can't complete your trip). Ask your agency first; you can also email [privacy email]. We'll respond within the time the law allows. You can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
11. Cookies
We use only the cookies needed to sign agency staff in and keep the service secure. There are no advertising or tracking cookies.
12. If something goes wrong
If personal data is exposed, we'll tell the agency, report it to the Nigeria Data Protection Commission within 72 hours where required, and tell you directly if you're at high risk.
13. Changes
If we change this notice in a way that matters, we'll show the new version here with a new date and tell agencies.