Last updated: 24 September 2026
This policy explains what we do with your personal information when you enquire, book or use our website. It covers two things that matter particularly for pilgrimage travel: your religious belief is treated as sensitive information under UK law, and arranging your trip requires us to send your passport details to Saudi Arabia.
1. Who we are
Trip to Makkah is a trading name of Super Destinations Limited, which is the data controller for the information described here. We are registered in England and Wales, company number 08243733, registered office 344–348 High Road, Ilford, Essex IG1 1QP.
For anything about your data, email info@triptomakkah.co.uk with “Data protection” in the subject line, or write to us at the address above marked “Data Protection”.
2. What we collect
2.1 When you enquire
Your name, email address, telephone number, the dates and destinations you are interested in, the number of adults and children travelling, and anything you write in the message box. We also record which page the enquiry came from and, where present, the advertising parameters in the link you arrived by.
2.2 When you book
Everything above, plus: full name as it appears on your passport, date of birth, gender, nationality, passport number, issue and expiry dates, a copy or scan of the passport itself, home address, emergency contact details, payment details, and your MenACWY vaccination certificate.
2.3 Information that is sensitive under UK law
Two categories of what UK GDPR calls “special category data” arise in our work:
- Religious belief. Booking Hajj or Umrah reveals that you are Muslim. We cannot avoid this — it is inherent in the service — so we treat the fact of your booking as sensitive information and protect it accordingly.
- Health. Only where you tell us. Mobility needs, a request for assistance at the airport, a dietary requirement or a medical condition relevant to your travel.
We ask for your explicit consent to handle these categories, which you give when you confirm your booking. You may withdraw that consent at any time, but because this information is necessary to arrange pilgrimage travel, withdrawing it means we can no longer manage your booking.
2.4 When you use the website
Pages visited, time on site, the site you arrived from, approximate location derived from your IP address, and device and browser type. Collected through cookies and similar technologies — see section 8.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Answer your enquiry and prepare a quotation | Steps taken at your request before entering a contract |
| Make and manage your booking; issue tickets and vouchers | Performance of our contract with you |
| Apply for your visa and meet Saudi entry requirements | Performance of our contract; explicit consent for the sensitive elements |
| Take payment and prevent fraud | Performance of our contract; our legitimate interest in preventing fraud |
| Keep accounting and ATOL records | Legal obligation |
| Handle complaints and defend legal claims | Our legitimate interest in protecting our position |
| Send you marketing about our packages | Your consent, or our legitimate interest where you are an existing customer |
| Improve the website and understand how it is used | Your consent, through cookie settings |
4. Who we share it with
We share only what is necessary, and only with:
- Airlines — name, date of birth, gender, passport details. Airlines are required to pass passenger data to border authorities in the countries you fly to and over.
- Hotels in Makkah and Madinah — name, passport details, dates of stay. Saudi hotels are required by law to register guests with the authorities.
- Transfer and ground handling operators — name, flight details, contact number.
- Visa processors and the Ministry of Hajj and Umrah — full passport data, photograph and vaccination certificate.
- Payment providers — we do not store your full card number; card payments are handled by our provider on their own systems.
- Our professional advisers, accountants and insurers, where needed.
- The Civil Aviation Authority and other regulators, where we are required to report.
We do not sell your personal information, and we do not share it with other travel companies for their own marketing.
5. Sending your information outside the UK
Arranging Hajj or Umrah necessarily involves transferring your personal data to the Kingdom of Saudi Arabia — to hotels, ground operators and government systems. Saudi Arabia is not covered by a UK adequacy decision, which means its data protection regime has not been formally assessed by the UK government as offering equivalent protection.
We make these transfers because they are necessary for the performance of our contract with you, relying on the derogation in Article 49(1)(b) of the UK GDPR. There is no practical alternative: your booking cannot exist without them. Once your data is held by Saudi government systems it is subject to Saudi law, and the rights described in section 7 may be harder to exercise there than in the UK.
Where we use suppliers elsewhere outside the UK, we rely on adequacy regulations or on the International Data Transfer Agreement or Addendum, as appropriate.
6. How long we keep it
- Enquiries that do not become bookings — 24 months from last contact, then deleted.
- Booking and financial records — 7 years from the end of the relevant tax year, to meet HMRC and ATOL requirements.
- Passport copies and vaccination certificates — deleted within 6 months of your return, unless needed for an open complaint or claim.
- Marketing contact details — until you unsubscribe, or after 24 months of no engagement.
- Website analytics — as set out in our cookie settings.
7. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you;
- have inaccurate information corrected;
- ask us to delete information, where we have no continuing reason to keep it;
- ask us to restrict how we use it while a concern is resolved;
- object to processing based on our legitimate interests;
- receive information you gave us in a portable format;
- withdraw consent at any time, including for marketing;
- object to marketing at any time, with no reason needed.
Write to info@triptomakkah.co.uk. We respond within one month. There is no charge unless a request is clearly unfounded or excessive.
Some rights are limited where we have a legal obligation to keep records, or where information has already been passed to an airline or a foreign government in order to complete your travel.
8. Cookies
We use cookies that are strictly necessary for the website to work, and — only with your consent — cookies that help us understand how the site is used and measure our advertising. You can accept or decline the non-essential ones when you first visit, and change your mind at any time through your browser settings.
Declining non-essential cookies does not stop you browsing the site or making a booking.
9. Marketing
We will send you offers by email or WhatsApp only if you have asked us to, or if you have booked with us before and have not opted out. Every message carries an unsubscribe option, and you can ask us to stop at any time by replying or by emailing us. Unsubscribing from marketing does not affect messages about a booking you have already made.
10. Security
We hold your information on access-controlled systems, limit who can see passport data to staff who need it for your booking, and use encrypted connections for our website and email. No system is perfectly secure, but if a breach occurs that is likely to put your rights at risk we will tell you and the Information Commissioner’s Office without undue delay.
11. Children
We do not market to children. Where a child travels on a booking we hold their passport details, provided by the adult making the booking, solely for the purpose of that travel.
12. Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13. Changes to this policy
We review this policy periodically. Where a change materially affects how we use your information, we will tell customers with a live booking directly rather than relying on this page alone. The date at the top shows when it was last updated.