Privacy policy

Data controller

The data controller is IMALA SAS, a company incorporated under Senegalese law with a share capital of 1,000,000 FCFA, RC SN.DKR.2025.B.39206, registered office NL-45 Ndiarème Limamoulaye, Guédiawaye, Dakar (Senegal).

Contact for any question about your data: contact@umrah-fly.com.

Representative in the European Union

As the controller is established outside the European Union, a representative in the Union must be appointed in accordance with Article 27 of the GDPR.

[ÉDITEUR — À COMPLÉTER AVANT MISE EN LIGNE : name and contact details of the European Union representative appointed in writing (milestone J5 of the specification).]

Data collected and purposes

Umrah Fly collects only what the service requires. No banking or payment data is processed: booking and payment take place with the partners.

• User account (optional): email address, display name, preferred language and currency — to create and operate the account and to send transactional emails (address verification, password reset, inactivity warning before deletion).
• Account content: favourite hotels, manually entered 'my trip' entries, reading progress in the rites module, favourite invocations — to provide these features.
• Search log: search criteria (cities, dates, travellers), language, currency, anonymous session — for service improvement and internal statistics. When you are signed in, the search is linked to your account and feeds the 'History' page of your account area; when the account is deleted, these entries are anonymised (detached from the account) rather than deleted.
• Clicks towards partners: vertical concerned, partner, target URL with no personal data, anonymous session, country code inferred from the connection (the IP address is never stored) — for accounting follow-up of affiliate commissions.
• In-house audience measurement: anonymous events (page views, searches, clicks) tied to an anonymous session identifier, with no measurement cookie, no IP address and no account identifier — only the country code is kept.
• Google account (optional): Google identifier and email address provided by Google at sign-in.

Retention periods

• User account: until deletion is requested, or 24 months after the last activity, with an email warning 30 days before deletion.
• Favourites, 'my trip', rites progress, favourite invocations: tied to the account and deleted with it.
• Clicks towards partners: 36 months.
• Search log: 12 months.
• Audience measurement events: 12 months.
• Account session: expires after 30 days.
• Password reset token: 1 hour.

Cookies

Only cookies strictly necessary for operation are set: 'session' (account authentication, 30 days), 'sid' (anonymous browsing session, 13 months) and 'csrf' (protection against forged requests). Your chosen language and currency are remembered in your browser's local storage (localStorage), not in a cookie: they stay on your device.

Audience measurement uses no dedicated cookie. As no non-essential cookie is set, no consent banner is displayed.

Legal bases

• Performance of the requested service: account, favourites, 'my trip', rites module, transactional emails.
• Legitimate interest: anonymised audience measurement, search logs, accounting follow-up of clicks towards partners, site security.

Transfers outside the European Union

The site is hosted in France (o2switch). As the controller is established in Senegal, access to data from Senegal is governed by standard contractual clauses compliant with the GDPR.

Your rights

You have the rights of access, rectification, erasure, portability, objection and restriction.

From your account area, you can download a JSON export of your data and delete your account in self-service; deletion erases the data tied to the account.

For any request: contact@umrah-fly.com. You may also lodge a complaint with the supervisory authority of your country of residence.