1. Who we are
Haraka Tours is a Shia Islamic tour operator. The data controller is Haraka Tours, contactable at admin@haraka-tours.com.
2. What we collect
You provide to us
- Account: email, name, phone, date of birth.
- Registration for a trip: nationality, country of birth, country of residence, occupation, gender, dietary or medical preferences, your passport number and passport expiry date, a passport-page photograph for visa processing, and a recent photograph (selfie) used for identity verification. We use the expiry date to check your passport is valid for the whole trip: a passport that expires before the trip ends cannot be booked, and we warn you if it expires within six months of your return date.
- Party members travelling with you (provided by you on their behalf): their name, date of birth, gender, nationality, country of birth and residence, occupation, dietary and medical requirements, relationship to you, their passport number and passport expiry date (required for every traveller, children included, and checked against the trip dates in the same way), and (where required) a passport-page photograph for visa processing.
- Details kept on your profile for your next booking: each time you book a trip or complete your travel details, the app saves your own passport number and expiry date, with your other registration details, to your profile so your next booking is filled in for you. You can clear them at any time (see section 5). If you also choose to save a co-traveller to your saved travellers, we keep their details, including their passport number, expiry date and passport copy; saving a co-traveller is optional.
- Communication: messages you send to scholars or admins through the app.
- User-generated content: testimonials, photographs you share with your trip group, questions you ask our scholars, and notes you post about holy places. A photo you share with your group is shown, once our team has checked it, to the members of that trip, with the name on your profile (or, if you have not added one, your email address) and any caption.
- Photos you let us feature: when you share a trip photo you choose between sharing it with your group only and also letting Haraka feature it, and we record that choice and when you made it. Only if you chose to let us feature it, and our team then picks it, does a copy of the photo appear in the app's Photos section on the Home screen, where anyone using the app can see it, including people who have not signed in. The featured copy is credited to the trip it was taken on, never to you by name, and shows no caption. It carries no name or account identifier, only a random code that is the same on each of your featured photos, so that other users can choose to block their author; someone who travelled with you, and so already sees your photos with your name in that trip's group photos, could use that code to recognise your other featured photos. A photo may show other people as well as you.
- Photos our staff add to the Photos section: pictures taken or received by our team, published with the permission of the people recognisable in them.
- Anyone pictured in a photo in the app, whether or not they use the app, can ask us to remove it by emailing admin@haraka-tours.com, and any user can report a photo from within the app.
- Testimonials you give us outside the app (for example by WhatsApp, email or in person): with your permission, our staff may publish them in the app under the name you agree to. Anyone named in a testimonial can ask us to remove it at any time by emailing admin@haraka-tours.com.
- Service requests: currency-exchange and SIM-card requests you submit, and bug reports you send us (your description, plus your account email, device type, OS version and app version).
Provided to our team on your behalf
- If you book with us by phone or in person, our staff may enter your booking for you from the details you give them: your name and, if you give them, your email address, phone number, date of birth, gender and nationality, plus the trip, package and amount paid. Your passport and other travel details can be added later, by you in the app or by our staff from what you send us.
- At your request, our staff may create an app account for you under your email address. We tell you when we do: normally by an email with a link to this policy, and otherwise our staff tell you themselves. The account starts working when you sign in with the email link sent to that address; our Terms apply from your first sign-in. We create app accounts only for adults (18 or over).
- Someone who will not use the app, including a child, can be booked as a traveller only: we hold their booking without an app account. Our staff tell them (for a child, the parent or guardian booking them) about this policy when they book, and we keep a record that they did.
Collected automatically
- A unique account identifier (Firebase user ID), assigned when you create your account, used to link your data to you.
- Your daily-quiz activity: the answers, attempts, points earned and reward tier associated with your account.
- Push notification token (so we can send trip updates and announcements).
- Approximate device location (only if you grant permission, for prayer-time and qibla calculations — processed on your device, never transmitted to us, never tracked or stored).
- On our download page (app.haraka-tours.com) we anonymously count visits and taps on its store buttons, to see how people find the app. Each count records only where the visit came from (for example our main website or the page's QR code), the kind of device (iPhone or iPad, Android, or computer) and the time. The page sets no cookies, and the counts contain nothing that identifies you or your device. To opt out, turn on Global Privacy Control or "Do Not Track" in your browser settings and the page will count nothing.
3. Why we collect it
- To operate the tour: process visa, room assignments, deliver welcome packs, broadcast announcements.
- Legal obligation: keep accounting records of memberships and payments for the period required by UK tax law.
- Legitimate interests: improve the service, prevent fraud, moderate user-generated content for safety.
- Consent: send marketing emails (opt-in), use device location (opt-in), and feature your trip photos in the app's Photos section (your choice when you share a photo, which you can withdraw at any time).
Some of what you provide is special-category data under UK/EU GDPR — health information (your medical and dietary needs) and data that can reveal religious beliefs, inherent in booking a pilgrimage. We process it only with your explicit consent, given when you provide it during registration, and solely to operate your trip safely (Article 9(2)(a)). Photos taken on a pilgrimage can reveal religious belief too, so we show a photo in the app's Photos section only with your explicit consent, given by choosing to let Haraka feature it, which you can withdraw at any time.
4. Who processes and receives your data
Our processors
We use the following sub-processors:
- Google Firebase (Authentication, Firestore database, Cloud Storage, Cloud Functions) — the database, file storage and functions are in the EU. Firebase Authentication, which holds your sign-in email address, name and sign-in records (including for an account our staff create for you), is hosted by Google in the United States; some operational metadata may also transit US infrastructure.
- Google Cloud Vision — automated safe-search scanning of images you upload. Images are scanned once and the result is stored as a flag; the image is not retained by Vision.
- Resend (transactional email) — sign-in links, payment references, approval emails, and the email telling you our staff created an app account for you. Sender is
noreply@haraka-tours.com. - Expo Push Service — delivers push notifications via Apple's APNs and Google's FCM.
Each is under a Data Processing Agreement that meets UK GDPR and EU GDPR requirements.
Who we share your travel details with
Your details and your party's are used by Haraka Tours staff to process your booking, and shared only as your trip requires. To arrange visas, transfers and accommodation we share the details each of them needs, which can include the name, date of birth, nationality, passport number, passport expiry date and passport copy of you and each party member, with:
- Visa authorities of the countries your trip visits, to apply for your visas.
- Visa agents and ground handlers who arrange visas, transport and services for the group on the ground.
- Hotels where the group stays, for check-in and the registration some countries require of hotel guests.
These are independent organisations, not our processors: each is responsible for how it handles what it receives. Some are outside the UK and the European Economic Area, in the countries your trip visits; we send your details there because it is necessary to arrange the trip you booked.
We do not sell your personal data, and we do not share it with third parties for advertising or cross-app tracking, or with marketing services. The app contains no advertising or third-party analytics SDKs; the providers listed under "Our processors" act solely as our processors, on our instructions.
5. How long we keep it
- Account profile: while the account is open; deleted on request.
- Membership records: kept indefinitely for accounting purposes; anonymised (your name + email removed, trip + amount + date kept) when you delete your account.
- Push tokens: removed after 180 days of inactivity.
- Passport details and photos on a booking (the passport number, passport expiry date, passport copy and photograph of you and each party member): deleted 90 days after the trip ends, or 90 days after the booking is cancelled if that comes first. Deleting your account deletes them straight away from every booking you made. If someone else booked you as a member of their party, your details on their booking belong to that booking and follow its timetable instead; you can ask us to remove them sooner by emailing admin@haraka-tours.com. Uploads that were never attached to a booking are deleted within 24 hours. The 90-day wait exists so a cancelled booking can be reinstated, and any payment dispute or visa question after the trip resolved, before the documents go.
- Passport details kept on your profile (your own passport number and expiry date, saved automatically each time you book, and a saved traveller's passport number, expiry date and passport copy): kept until you remove them or delete your account. To remove them, clear them in your profile (in Settings, tap your name) or edit or remove that traveller; your next booking saves your own details to your profile again. They are not deleted when a trip ends.
- Bookings our staff entered for you, and accounts they created: kept like any other booking or account, with the same passport-data deletion. If you have no app account, or never signed in to the one we created, email admin@haraka-tours.com to have them removed: we erase your name, contact and passport details (and an account nobody signed in to), keeping only the anonymised accounting record described above. If you shared a room on a trip whose room list we had already published, your name stays in your roommates' room details in the app until we publish that trip's room list again.
- Trip photos and featured copies: a photo you share stays in your trip's group photos until you delete your account or ask us to remove it. Its featured copy in the Photos section is deleted as soon as you withdraw your permission, our team rejects or stops featuring the photo, or you delete your account.
- Photos our staff add to the Photos section: kept until we remove them, or until someone pictured in one asks us to.
- Database backups: 7 days rolling.
6. Your rights
Under UK GDPR / EU GDPR you have the right to:
- Access the data we hold about you (visible in-app on the Profile / Settings screen).
- Correct inaccurate data (editable in-app).
- Delete your account — Settings → Delete account. Triggers immediate erasure of personal data and anonymisation of accounting records.
- Port your data — request a machine-readable copy in the app (Settings → Export my data) or by emailing admin@haraka-tours.com.
- Object to processing based on legitimate interests.
- Withdraw consent at any time. For a featured photo, open it in your trip's group photos, or in Settings → Your trip photos (which lists your photos from every trip you booked, including cancelled and past trips), and choose to stop Haraka featuring it, or email admin@haraka-tours.com. Withdrawing does not affect how the photo was shown before you withdrew.
- If our staff booked you without an app account, or you never signed in to the account they created, you have the same rights: email admin@haraka-tours.com to see, correct, export or delete what we hold. We reply within one month.
- Complain to the Information Commissioner's Office (UK) or your local data protection authority.
7. Security
Authentication tokens are stored in the OS Keychain (iOS) / Keystore (Android) — not in plain text. Communication between the app and our servers is TLS-encrypted. The photos you upload for your bookings and saved travellers (passport pages and photographs of you and your party) and to your trip's group photos, and the photos our staff add to the Photos section, are stripped of EXIF metadata (including embedded GPS coordinates) by our servers as soon as they are uploaded, before other app users see them; featured copies are made from the stripped image. Images attached to messages are not processed this way; only you and our team can see them.
8. Children
The app is not intended for children under 13. Children of any age may travel as part of a family booking, but their personal data is provided and managed by the booking primary, who must have parental responsibility. Our staff may also book a child as a traveller only, from details given by a parent or guardian; they never create an app account for anyone under 18. A parent or guardian can ask us to remove any photo of their child from the app by emailing admin@haraka-tours.com.
9. Changes
We may update this policy. Material changes will be announced in-app before they take effect. The "Last updated" date at the top reflects the most recent revision.
10. Contact
Questions or requests: admin@haraka-tours.com.