Privacy policy

Data controller

The data controller is IMALA SAS, a company incorporated under Senegalese law with a share capital of 1,000,000 FCFA, RC SN.DKR.2025.B.39206, registered office NL-45 Ndiarème Limamoulaye, Guédiawaye, Dakar (Senegal).

Contact for any question about your data: contact@umrah-fly.com.

Representative in the European Union

As the controller is established outside the European Union, a representative in the Union has been appointed in writing in accordance with Article 27 of the GDPR.

Our representative in the European Union is: Demba SOUMARE — contact@umrah-fly.com.

Data collected and purposes

Umrah Fly collects only what the service requires. No bank card data is processed: comparison bookings are paid with partners and the Guides deposit goes through PayPal.

• User account (optional): email address, display name, preferred language and currency — to create and operate the account and to send transactional emails (address verification, password reset, inactivity warning before deletion).
• Account content: favourite hotels, manually entered 'my trip' entries, reading progress in the rites module, favourite invocations — to provide these features.
• Guide bookings: service, dates, number of people, amounts, status, phone number, technical PayPal references, reviews and dispute exchanges — to perform the booking service, provide follow-up, maintain accounts and handle disputes.
• Search log: search criteria (cities, dates, travellers), language, currency, anonymous session — for service improvement and internal statistics. When you are signed in, the search is linked to your account and feeds the 'History' page of your account area; when the account is deleted, these entries are anonymised (detached from the account) rather than deleted.
• Clicks towards partners: vertical concerned, partner, target URL with no personal data, anonymous session, country code inferred from the connection (the IP address is never stored) — for accounting follow-up of affiliate commissions.
• In-house audience measurement: anonymous events (page views, searches, clicks) tied to an anonymous session identifier, with no measurement cookie, no IP address and no account identifier — only the country code is kept.
• Google account (optional): Google identifier and email address provided by Google at sign-in.

Retention periods

• User account: until deletion is requested, or 24 months after the last activity, with an email warning 30 days before deletion.
• Favourites, 'my trip', rites progress, favourite invocations: tied to the account and deleted with it.
• Guide bookings and associated accounting records: 10 years, followed by deletion or anonymisation.
• Guides dispute files: 5 years after the dispute is closed, followed by deletion or anonymisation.
• Traveller and guide phone contact details: masked at J+30 after the end of the service; records that must be retained are then detached from these contact details.
• Clicks towards partners: 36 months.
• Search log: 12 months.
• Audience measurement events: 12 months.
• Account session: expires after 30 days.
• Password reset token: 1 hour.

Cookies

Only cookies strictly necessary for operation are set: 'session' (account authentication, 30 days), 'sid' (anonymous browsing session, 13 months) and 'csrf' (protection against forged requests). Your chosen language and currency, as well as your rites reading progress and ritual counters when you are not signed in, are remembered in your browser's local storage (localStorage), not in a cookie: they stay on your device.

Audience measurement uses no dedicated cookie. As no non-essential cookie is set, no consent banner is displayed.

Legal bases

• Performance of the requested service and contract: account, favourites, 'my trip', rites module, transactional emails, guide bookings and transmission of contact details required by the guide.
• Accounting and record-keeping obligations: booking records are retained for 10 years.
• Legitimate interest: anonymised audience measurement, search logs, accounting follow-up of clicks towards partners, site security and dispute handling.

Transfers outside the European Union

The site is hosted in France (o2switch). As the controller is established in Senegal, access to data from Senegal is governed by standard contractual clauses compliant with the GDPR.

For a confirmed booking, the phone number and required contact details are transmitted to the guide concerned in Saudi Arabia. This transmission is necessary for performance of the contract for the guide service and limited to information needed to organise it.

Your rights

You have the rights of access, rectification, erasure, portability, objection and restriction.

From your account area, you can download a JSON export of your data and delete your account in self-service. Linked data is deleted except where retention is required: that data is anonymised or detached from the account at the end of the applicable period.

For any request: contact@umrah-fly.com. You may also lodge a complaint with the supervisory authority of your country of residence.