Privacy Notice

1.1Hoggaan Travels is the data controller for the information described in this notice. That means we decide what is collected and why, and we are accountable for it.

1.2This notice covers information collected through hoggaantravels.com, through the My Hoggaan ID service, at our Mogadishu office, and through the phone, WhatsApp and email channels we publish.

1.3For any question about this notice, or to exercise a right described in section 9, write to info@hoggaantravels.com or to TCC Tower, Floor 4, A43, Talex, Mogadishu.

2.1We collect only what a pilgrimage booking actually requires. Most of it comes directly from you or from your passport.

2.2Health information is sensitive, and we treat it accordingly. It is recorded only when you tell it to us, visible only to the staff arranging that specific need, and never shared beyond the provider who has to act on it.

3.1Contract. Most of what we hold is necessary to deliver the booking you asked for. Without a passport number there is no visa; without a name there is no ticket.

3.2Legal obligation. Somali business and tax law, and the requirements of the Saudi Ministry of Hajj and Umrah, oblige us to create and retain certain records about travellers and transactions.

3.3Legitimate interests. Keeping our systems secure, preventing fraud, defending a legal claim, and understanding in aggregate which pages of our site are used. We do this only where it does not override your interests.

3.4Consent. For anything optional , marketing messages, and the health information you volunteer. You may withdraw consent at any time, and withdrawing it does not affect a booking already in progress.

4.1We share your information only with those who need it to deliver your journey or who we are legally obliged to give it to:

• (a)The Saudi Ministry of Hajj and Umrah, the Nusuk platform, and Saudi service companies, for permit issuance and pilgrim administration.
• (b)The Ministry of Endowment and Islamic Affairs of the Federal Republic of Somalia and its Hajj Affairs Office, for Hajj registration, quota allocation and pilgrim administration.
• (c)Consular and visa processing centres, for visa applications.
• (d)Airlines, for ticketing, and hotels and ground transport operators, for the reservations in your itinerary.
• (e)SomBank, where and only where you apply for installment financing with them.
• (f)Our technology suppliers, who host and operate the systems that store this data under contract to us.
• (g)Government authorities and courts, where the law requires us to disclose.

5.1Our booking records are held on managed infrastructure located in the European Union, in Stockholm, Sweden.

5.2Delivering a pilgrimage necessarily involves transferring data to Saudi Arabia, and to whichever countries your airlines and hotels operate from. There is no way to book a Hajj without giving your passport details to the Kingdom that issues the permit.

5.3These transfers are made under the cross-border transfer provisions of the Data Protection Act, 2023, on the basis that they are necessary to perform the contract you entered into with us.

6.1We do not keep data indefinitely on the chance it may one day be useful. Where a retention period ends and no legal obligation requires us to keep a record, it is removed.

7.1Access is granted on a least-privilege basis. A member of staff can see a pilgrim's record only where their role genuinely requires it, and access is removed when a role changes.

7.2Data is encrypted in transit and at rest, and the pilgrim database is closed to anonymous access , a Hoggaan ID record is released only after our server has verified the surname, passport number and nationality together.

7.3Passport scans and financing documents are held in restricted storage, separate from ordinary booking records.

7.4No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and the Somalia Data Protection Authority without undue delay, and we will tell you what happened rather than what sounds reassuring.

8.1This site sets only strictly necessary cookies. There are two: NEXT_LOCALE, which remembers the language you chose, and the authentication cookies that keep you signed in to My Hoggaan ID.

8.2Under the Data Protection Act, 2023 these require no consent banner, because they are essential to deliver a service you asked for. We do not show you a cookie banner because we have nothing to ask you about.

8.3Page views are counted in aggregate without setting a cookie and without a persistent identifier. We run no advertising pixels, no cross-site tracking and no session recording.

9.1Under the Data Protection Act, 2023 you have the right to:

• (a)Ask what personal data we hold about you and receive a copy of it.
• (b)Have inaccurate or incomplete information corrected.
• (c)Have your data deleted, where no legal obligation requires us to keep it.
• (d)Object to or restrict processing that relies on our legitimate interests.
• (e)Withdraw consent for anything you consented to, at any time.
• (f)Receive the data you gave us in a portable form.

9.2To exercise any of these, write to info@hoggaantravels.com. We may ask you to confirm your identity first , this protects you, since a request to release travel documents is exactly what an impersonator would make.

9.3We respond within thirty days. There is no charge.

10.1We do not accept independent bookings from anyone under 18, and this website is not directed at children.

10.2Where a child travels under a sponsor or guardian, we process the child's identity and travel data on the sponsor's instruction and for the sole purpose of the journey. It is held to the same standard as an adult's, and deleted on the same schedule.

11.1If you believe we have handled your information wrongly, tell us first at info@hoggaantravels.com. We would rather fix it than have you discover we would not.

11.2If you are not satisfied with our response, you may lodge a complaint with the Somalia Data Protection Authority, the supervisory body established under the Data Protection Act, 2023 (Law No. 005 of 2023), at dpa.gov.so.

12.1We update this notice when what we do with data changes. The effective date and version number at the top of the page tell you which version you are reading.

12.2Where a change materially affects how we use information about you, we will tell you directly rather than rely on you noticing a new date.