Privacy notice

About this notice

This notice explains how Lumarah Travel Agency Ltd (“Lumarah”, “we”, “us”, “our”) collects and uses personal information when you visit our website, send us an enquiry, message us on WhatsApp, or book travel with us. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Lumarah Travel Agency Ltd is a travel agency registered in England & Wales (Company No. 17528238). Our registered office is 62 Tong Street, Bradford, England, BD4 9LX. We are the controller of the personal information described in this notice, which means we decide how and why it is used.

Information we collect

Depending on how you deal with us, we may collect the following:

• Contact details: your name, email address and phone or WhatsApp number.
• Traveller details: the names (as shown on the passport), dates of birth, gender and nationality of each person travelling, which airlines, hotels and visa services need to make a booking.
• Trip details: destinations, dates, airports, number of travellers, the package, flights or hotels you have selected, room preferences, budget and any special requests you tell us about.
• Booking and payment records: quotes we send, what you accept, amounts paid, payment dates and the name on the paying bank account. We do not take card details and nothing is paid on the website.
• Messages: the content of emails, enquiry forms and WhatsApp conversations with us.
• Technical information: limited information your browser sends when you visit the website, such as IP address, browser type and the pages requested, which our hosting provider uses to deliver the site and protect it from attack.

Information we do not collect on the website

We do not ask for passport numbers, card details or bank login details on the website. If a supplier or visa service later needs your passport number or a copy of your passport, we will ask you for it directly and explain why at that point.

Some requests may reveal sensitive information, for example a wheelchair request or a medical need, or the fact that you are travelling for Umrah may indicate your religious beliefs. We only use this to arrange the travel and assistance you ask for, and we share it only with the suppliers who need it to provide that service. Where the law requires it, we will ask for your explicit consent.

Booking for other people

If you send us details of other travellers, such as family members or friends, please make sure they are happy for you to share their information with us and that they know about this notice. If you are booking for a child, you should be their parent or guardian or have their parent or guardian’s permission.

Why we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for each way we use personal information. We rely on the following:

• Contract and steps before a contract: to answer your enquiry, prepare a quote, make and manage your booking, apply for visas you ask us to help with, and send you travel documents and updates.
• Legitimate interests: to run and improve our business, keep records of our conversations, protect our website and customers from fraud and misuse, and deal with complaints or legal claims. We balance these interests against your rights and do not use your information in ways you would not reasonably expect.
• Legal obligation: to keep accounting and tax records, respond to lawful requests from authorities, and meet our obligations under consumer and travel law.
• Consent: where we ask for it, for example to send you offers or newsletters, or to use optional cookies if we introduce them. You can withdraw consent at any time without affecting anything we did before.

Who we share your information with

We share only what is needed for each purpose. Recipients include:

• Travel suppliers who provide your trip: airlines, hotels, transfer companies, ground handlers and Umrah service providers in Saudi Arabia, and other tour operators.
• Visa services and government portals, such as the Saudi e-visa system, when you ask us to help with a visa application.
• Cloudflare, Inc., which hosts our website and the database (Cloudflare D1) where enquiries are stored, as our processor.
• Resend, which we may use to send email notifications about enquiries, as our processor.
• Duffel, which provides live flight prices and is used to check flight availability.
• LiteAPI (Nuitée), which provides live hotel prices and is used to check hotel availability.
• WhatsApp (Meta Platforms), when you choose to message us on WhatsApp. Your use of WhatsApp is also covered by WhatsApp’s own privacy policy.
• Our accountants, insurers, banks and professional advisers, and the police, regulators or courts where the law requires it.

International transfers

Your trip may involve suppliers outside the UK, for example hotels and ground handlers in Saudi Arabia. Where we pass your details to a supplier abroad so that they can provide the travel you have booked, the transfer is necessary to perform your contract with us.

Some of our service providers are based in, or may access data from, other countries including the United States and the European Economic Area. Where personal information leaves the UK we make sure appropriate safeguards are in place, such as a UK adequacy decision, the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

How long we keep your information

• Enquiries that do not lead to a booking: deleted or anonymised 24 months after our last contact with you.
• Booking records, including traveller details, quotes, invoices and payment records: kept for 6 years after the end of the financial year in which you travelled, to meet tax, accounting and legal requirements.
• Records relating to a complaint or claim: kept until the matter is resolved and any time limits for legal claims have passed.
• Marketing preferences: kept until you unsubscribe, after which we keep a short record so that we do not contact you again.

How we protect your information

The website is served over an encrypted connection (HTTPS). Enquiries are stored in a secured database that only authorised Lumarah staff can access, using individual accounts with strong passwords. We limit access to people who need it, and we expect our suppliers and processors to protect your information too. No system is completely secure, so please contact us straight away if you think your information has been put at risk.

Your rights

Under UK data protection law you have the right to:

• Access: ask for a copy of the personal information we hold about you.
• Rectification: ask us to correct information that is wrong or incomplete.
• Erasure: ask us to delete your information where we no longer need it or have no lawful reason to keep it.
• Restriction: ask us to limit how we use your information, for example while a correction is checked.
• Objection: object to us using your information on the basis of legitimate interests, and to direct marketing at any time.
• Portability: ask us to provide information you gave us in a commonly used electronic format, or send it to someone else, where the law allows.
• Withdraw consent: where we rely on consent, withdraw it at any time.

Using your rights

To use any of these rights, contact us using the details below. We will normally reply within one month and there is usually no charge. We may need to confirm your identity first. Some rights have limits; for example, we may need to keep booking records for tax purposes even if you ask us to delete them, and we will explain if that applies.

Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: website https://ico.org.uk, helpline 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed.

Contact us

• WhatsApp or phone: +44 7950 739581
• Email: lumarahtravelagency@gmail.com
• Post: Lumarah Travel Agency Ltd, 62 Tong Street, Bradford, England, BD4 9LX
• Website: https://lumarahtravelagency.co.uk