Privacybeleid
How Unity Umrah collects, uses and protects your personal data, in line with the GDPR. Last updated: 31 October 2026.
1. Who is responsible for your data
Unity Umrah is the data controller for the personal data described in this policy.
- Legal name: TODO: legal name
- Address: TODO: address
- Enterprise number (KBO/BCE): TODO: KBO/BCE number
- Email for privacy questions: unityumrah1@gmail.com
2. What data we collect
| Who | Data | Source |
|---|---|---|
| Buyers | Name, email address, phone number, billing address, order details, payment status, personal message for the recipient. Card details are handled by our payment provider; we do not store them. | You, when you order |
| Recipients and travellers | Full name, name as shown on the passport, passport number and expiry date, nationality, date of birth, preferred travel month, number of travellers, room preference, departure airport, phone number, email address and best time to contact. The same passport details for a second traveller, where applicable. | The recipient, through our redemption form |
| People who contact us | Name, email address, phone number, company (for partner enquiries), the content of your message and your consent. | You, through our contact or partner forms |
| Website visitors | Technical data such as IP address and browser type, and cookie data as described in our Cookie Policy. | Your device |
Data that may reveal religious beliefs
Because Umrah is a religious journey, the fact that you buy or receive an Umrah gift may indirectly reveal religious beliefs, which are a special category of data under the GDPR. We process this data only to provide the service you request, and on the basis of your explicit consent, which you give when you place an order or submit the redemption form.
Legal review: confirm the Article 9 GDPR basis and how explicit consent is collected at checkout and in the redemption form.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing your order, payments and instalments, and issuing the gift certificate | Performance of a contract (Art. 6(1)(b)) |
| Handling redemption and coordinating the journey with a partner operator, including the visa application | Performance of a contract (Art. 6(1)(b)) and explicit consent for data revealing religious beliefs (Art. 9(2)(a)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Answering your questions and partner enquiries | Your consent (Art. 6(1)(a)) and our legitimate interest in responding (Art. 6(1)(f)) |
| Keeping our website secure and working | Legitimate interest (Art. 6(1)(f)) |
| Non-essential cookies and any marketing messages | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
5. Transfers outside the EU
Traveller data needed for the visa is transferred to Saudi Arabia, because this is necessary to perform the service you have requested (Art. 49(1)(b) GDPR). Some service providers may process data in the United States; where they do, the transfer is covered by the EU–US Data Privacy Framework or by standard contractual clauses.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Passport details and travel preferences from the redemption form | Deleted TODO: confirm, e.g. 3 months after the traveller returns, or after the gift expires if it is never used |
| Order, invoice and payment records | 10 years, as required by Belgian accounting law |
| Messages from the contact and partner forms | TODO: confirm, e.g. 2 years after our last contact |
| Cookie consent records | As described in our Cookie Policy |
7. How we protect your data
Our website and business software run on Odoo's hosting with an encrypted (HTTPS) connection. Access to passport details is limited to the people who need it to coordinate the journey. We use the data only for the purposes described in this policy.
8. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing. To exercise your rights, email unityumrah1@gmail.com. We respond within one month.
You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) at www.dataprotectionauthority.be.
9. Data about other people
If you give us data about someone else, for example the recipient of your gift or a second traveller, please make sure they are aware of this policy.
10. Changes to this policy
We may update this policy. The latest version is always available on this page.
Draft version – pending legal review.