Only what we need. Only for as long as needed.
This notice explains exactly what happens to information you give us, how long we keep it, and how to get it back or have it deleted.
- No cookies
- No tracking
- No data sold
Who we are
Umrah Wayfinder operates the website at umrahwayfinder.com and is the controller of personal data submitted through it. The site is operated from Pakistan and is available internationally.
We do not publish an email address. Every enquiry, including a privacy or data-protection request, reaches us through the contact form. Choose “Privacy or data request” so it is routed correctly. If you need our identity and postal details in writing in order to exercise a legal right or to contact a regulator, ask through that form and we will provide them.
The short version
This site sets no cookies. There is no analytics product, no advertising network, no tracking pixel, no social embed and no third-party font or script of any kind. Nothing is loaded from another company’s servers while you read.
We hold personal data only when you choose to type it into a form and submit it. If you never submit a form, we hold nothing about you.
What we collect, and why
Everything below is triggered by something you choose to do.
| What | When | Why we may use it | Deleted after |
|---|---|---|---|
| Your name, email address, category, subject and message | You submit the contact form | To take steps you have asked for, and our legitimate interest in answering enquiries and keeping a record of what was asked | 12 months |
| Your email address and the trip brief you built | You tick the box and press “Request quotation” | To take steps at your request before any possible agreement, so we can review the brief and respond | 24 months |
| An event name, the page path, and a referral label from the address bar | You complete a form or download a brief | Our legitimate interest in knowing whether the core journeys on the site actually work | 13 months |
| A record of administrative actions taken on a stored enquiry | We review or update a record | Accountability, so changes to your record are traceable | 24 months |
Event records contain no part of your form content and no identifier that links them to you. Deletion is automatic: every record is written with an expiry date, and a scheduled job deletes expired rows daily. We may delete sooner when information is no longer needed or when you ask us to.
If you are in the United Kingdom or the European Economic Area, the lawful bases above correspond to Article 6(1)(b) and Article 6(1)(f) of the UK GDPR and the EU GDPR. Where we rely on legitimate interests you may object at any time, and we will stop unless we have compelling grounds that override your objection.
What we do not do
We do not sell personal data, and we never have. We do not share it with travel providers, agencies or anyone else unless we tell you first and you agree. We do not build advertising profiles, we do not use your data to train machine-learning models, and we do not make automated decisions that produce legal or similarly significant effects about you.
We do not operate a mailing list. Ticking a box on a form is an acknowledgement that we may use those details to answer you. It is not consent to marketing, and we will not add you to one.
Your connection to this site
Delivering any web page requires the host to process connection data such as your IP address, the page requested and your browser’s request headers. Our hosting provider, Cloudflare, does this on our behalf to serve pages and to protect the site from attack and abuse. It acts as a processor under contract.
Our own application code does not read, log or store your IP address, your approximate location, or your browser’s user-agent string. None of it reaches our database.
Email we send
When you use the contact form we may send you an acknowledgement, and we send ourselves a notification so the enquiry is not missed. Those messages are delivered through Cloudflare’s email service, which processes the address and message content in order to deliver them. We send from an address on our own domain and do not use a third-party marketing platform.
If you reply to one of our emails, that reply and anything you attach becomes part of the record covered by this notice.
Where your data lives
The website, its database, its access controls and its email delivery all run on Cloudflare. The database’s primary region is Western Europe. Cloudflare operates a global network, so data may be processed in other countries, including outside the UK and the EEA, under the safeguards in Cloudflare’s data processing addendum and the standard contractual clauses it incorporates.
We use no other processor. There is no customer-relationship tool, no spreadsheet service and no analytics vendor holding a copy.
Sensitive information
Please do not send passport or identity-document details, payment card or bank details, medical or disability records, or anything revealing religious belief beyond the practical fact that you are planning a journey. The forms do not ask for any of it and we have no use for it.
If you send it anyway, we will delete it as soon as we notice, and we may need to delete your whole message to do so. Tell us through the contact form if you think you have sent something you should not have.
Children
This site is intended for adults arranging travel. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has submitted information, tell us and we will delete it.
Your rights
Depending on where you live, you may have the right to ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. These rights are not absolute, but we apply them to everyone who asks, wherever they live, rather than only where the law compels it.
Make a request through the contact form, choosing “Privacy or data request.” We will respond within 30 days. We may need to confirm that the request really concerns your information before we act on it, which usually means replying from the address you originally used.
Exercising a right costs nothing and we will not treat you differently for it. If you are unhappy with our response, you may complain to the data-protection authority where you live, where you work, or where you think the problem occurred.
Security
Form submissions are accepted only from this site’s own pages, are size-limited, and are written to a database that is not publicly reachable. The operations dashboard sits behind a separate identity check and is not linked from the public site. Access to stored enquiries is limited to the people who need it, and administrative actions are recorded.
No internet service can promise absolute security. If a breach ever affects your rights and freedoms, we will notify the relevant authority and the people affected as the law requires.
Changes to this notice
If we change how we handle personal data, we will update this page. Where a change materially affects you, we will say what changed rather than quietly replacing the text, and the version here is always the one that applies.