Privacy Policy
Last updated: 8 November 2026
1. Who we are
The Umrah Workshop (“we”, “us”) organises post-Umrah workshops in Medina for pilgrims. Umrah agencies book these workshops through this website. We are responsible for the personal data described in this policy.
This website is meant for Umrah agencies (businesses). The personal data we handle is mostly the business contact details of the people who work for an agency.
Questions about this policy or about your data: info@umrahworkshop.com.
2. What personal data we use
We only collect what the website needs to work. We do not ask for the names or other personal data of the pilgrims who take part in a workshop: agencies only tell us how many women and how many men take part.
When you register an agency account
- Agency name, country, name of the contact person, e-mail address and phone number.
- Optional: website, Umrah licence or registration number, and VAT / tax number.
- Your password. It is stored by our authentication provider in a protected (hashed) form. We cannot read it.
- The language you use, the moment you accepted the Terms and the Privacy Policy, and which version you accepted.
- The status of the account (waiting for approval, approved or blocked) and when it was created and approved.
When you book and pay
- Bookings: booking number, date, group, status, the number of women and men taking part, the price, a reason if a booking is cancelled, and notes our team makes about a booking.
- Invoices: invoice number and dates, the amounts and numbers of participants, the VAT number of the agency as it was when the invoice was made, and the payment date and reference. The invoice shows the agency name, contact person, country, e-mail address and licence number.
- Notifications that you see in the portal about your bookings and invoices.
E-mails we send
- We send service e-mails about your account, bookings, invoices (with the invoice as a PDF) and reminders. We keep a log of them: the recipient address, the type and subject, the language, whether it was sent, an error message if it failed, and the booking or invoice it belongs to.
- If you write to info@umrahworkshop.com, we keep your message and our reply in our mailbox.
Security and administration
- An administration log records important actions in the system (for example approving an account, confirming, moving or cancelling a booking, deleting or restoring an item) with who did it, when, and the details of the action.
- Our hosting provider processes technical data about each request to the website, such as the IP address, the browser type and the time, to deliver the website and to keep it secure.
Cookies
The website uses a small number of cookies and nothing else for tracking. See the Cookie Policy.
What we do not do
We do not use analytics or advertising tools, we do not build profiles, we do not make automated decisions about you, and we do not sell personal data.
3. Why we use it and on what basis
| Purpose | Basis |
|---|---|
| Creating and managing your agency account, approving it, letting you sign in | Performing our agreement with you (or taking steps before it) |
| Handling bookings, participant numbers, invoices and payments, and contacting you about them | Performing our agreement with you |
| Keeping invoices and the related records as accounting and tax rules require | Legal obligation |
| Service e-mails and reminders about your bookings and invoices; answering your messages | Performing our agreement with you; our legitimate interest in running the service well |
| Keeping the website and accounts secure, preventing misuse and fraud, the administration log, and finding and fixing problems | Our legitimate interest in security and in being able to show what happened |
| Remembering your language and that you closed the cookie notice | These cookies are strictly necessary or only store your own choice (see the Cookie Policy) |
We do not rely on consent for any of this. If that ever changes, we will ask you first.
4. Who we share it with
We do not share personal data with anyone for their own purposes. We use a few service providers that process data for us, under their own data protection terms:
- Supabase: the database and the sign-in system (your account data, bookings, invoices and logs). Our database is hosted in the European Union.
- Vercel: hosting of the website, which processes the technical data of each request.
- Resend: sending our service e-mails (it receives the recipient address and the content of the e-mail, including the invoice PDF). We use its European region.
- Strato: hosting of our info@umrahworkshop.com mailbox, where messages you send us are stored.
We may also share data where the law requires it, for example with a tax authority, or to protect our rights in a dispute.
5. Transfers outside the European Economic Area
Some of our service providers, such as Vercel and Resend, can process data in countries outside the European Economic Area, including the United States. When personal data is transferred outside the EEA, this is done under the transfer mechanisms that data protection law provides for, such as an adequacy decision or standard contractual clauses.
If you want to know more about this, write to info@umrahworkshop.com.
6. How long we keep it
- Account data: as long as your agency account is active. If an account is deleted, the agency can no longer sign in. We then keep only what we still need, such as invoices.
- Bookings and invoices: as long as the law requires us to keep accounting and tax records.
- E-mail log: as long as we need it to avoid sending the same e-mail twice and to investigate delivery problems. When our team deletes entries, they are first hidden and then removed for good 180 days later, once the workshop date of the booking has passed.
- Administration log: as long as it is needed to show what happened and to keep the service secure.
- Messages to info@umrahworkshop.com: as long as needed to deal with your question and for follow-up.
- Cookies: for the periods listed in the Cookie Policy.
7. Your rights
You have the right to:
- ask us for access to the personal data we have about you;
- ask us to correct data that is wrong or incomplete (you can also change most of your details yourself in the portal under Profile);
- ask us to delete your data, as far as we are not required to keep it;
- ask us to restrict how we use your data;
- receive the data you gave us in a common format;
- object to the use of your data that is based on our legitimate interests.
Send your request to info@umrahworkshop.com. We may ask you to confirm who you are, and we answer within one month.
If you think we handle your data in a way that does not follow the law, you can complain to the data protection supervisory authority in your country. We would appreciate the chance to put it right first.
8. How we protect your data
We take reasonable technical and organisational measures. For example: the website is only available over an encrypted connection (HTTPS); passwords are stored in hashed form; agencies can only see their own bookings and invoices; only our team can use the admin area; and the keys that give full access to the database are kept on the server only.
No system is completely secure. If something happens that puts your data at risk, we will act and inform those concerned as the law requires.
10. Changes to this policy
We may update this policy, for example when the website changes. The date at the top shows when it was last updated. If the changes are important for agencies, we will tell you on the website or by e-mail.
11. Contact
The Umrah Workshop
info@umrahworkshop.com