Privacy Notice

1.1Hoggaan Travels is the data controller for the information described in this notice. That means we decide what is collected and why, and we are accountable for it.

1.2This notice covers information collected through hoggaantravels.com, through the My Hoggaan ID service, at our Mogadishu office, and through the phone, WhatsApp and email channels we publish.

1.3For any question about this notice, or to exercise a right described in section 9, write to info@hoggaantravels.com or to TCC Tower, Floor 4, A43, Talex, Mogadishu.

2.1We collect only what a pilgrimage booking actually requires. Most of it comes directly from you or from your passport.

2.2Health information is sensitive, and we treat it accordingly. It is recorded only when you tell it to us, visible only to the staff arranging that specific need, and never shared beyond the provider who has to act on it.

3.1Contract. Most of what we hold is necessary to deliver the booking you asked for. Without a passport number there is no visa; without a name there is no ticket.

3.2Legal obligation. Somali business and tax law, and the requirements of the Saudi Ministry of Hajj and Umrah, oblige us to create and retain certain records about travellers and transactions.

3.3Legitimate interests. Keeping our systems secure, preventing fraud, defending a legal claim, Hoggaan's own internal reporting, and understanding in aggregate which pages of our site are used. We do this only where it does not override your interests.

3.4Consent. For anything optional, such as the health information you volunteer. You may withdraw consent at any time, and withdrawing it does not affect a booking already in progress. We do not send marketing messages, with one exception: when you write to us through the contact form, the confirmation we email back also introduces our services and current packages. We do not add you to a mailing list.

4.1We share your information only with those who need it to deliver your journey or who we are legally obliged to give it to:

• (a)The Saudi Ministry of Hajj and Umrah, the Nusuk platform, and Saudi service companies, for permit issuance and pilgrim administration.
• (b)The Ministry of Endowment and Islamic Affairs of the Federal Republic of Somalia and its Hajj Affairs Office, for Hajj registration, quota allocation and pilgrim administration.
• (c)Consular and visa processing centres, for visa applications.
• (d)Airlines, for ticketing, and hotels and ground transport operators, for the reservations in your itinerary.
• (e)SomBank, where and only where you apply for installment financing with them.
• (f)Our technology suppliers, who host the website, the database and our email, and operate the systems that store this data under contract to us.
• (g)Google, only where you choose to allow the map on our contact page. Your browser then connects to Google directly, and Google receives your IP address.
• (h)Government authorities and courts, where the law requires us to disclose.

5.1Our booking records are held on managed infrastructure located in the European Union, in Stockholm, Sweden.

5.2Delivering a pilgrimage necessarily involves transferring data to Saudi Arabia, and to whichever countries your airlines and hotels operate from. There is no way to book a Hajj without giving your passport details to the Kingdom that issues the permit.

5.3These transfers are made under the cross-border transfer provisions of the Data Protection Act, 2023, on the basis that they are necessary to perform the contract you entered into with us.

6.1We keep these records for Hoggaan's internal reporting. They are used only inside Hoggaan and are not shared for that purpose. You can ask us to delete your data at any time (section 9); where no legal obligation requires us to keep a record, it is removed.

7.1Access is granted on a least-privilege basis. A member of staff can see a pilgrim's record only where their role genuinely requires it, and access is removed when a role changes.

7.2Data is encrypted in transit and at rest, and the pilgrim database is closed to anonymous access , a Hoggaan ID record is released only after our server has verified the surname, passport number and nationality together.

7.3Passport scans and financing documents are held in restricted storage, separate from ordinary booking records.

7.4No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and the Somalia Data Protection Authority without undue delay, and we will tell you what happened rather than what sounds reassuring.

8.1This site sets no cookies of its own. It keeps one item in your browser's local storage: your privacy choice, so that we do not ask you again on every visit. It contains no identifier and is never sent to us.

8.2When you first visit we ask one question: whether Google Maps may load on our contact page. The map stays off until you allow it. If you allow it, Google may set its own cookies and receives your IP address, under Google's own privacy policy. You can change your choice at any time with the cookie settings button.

8.3Page views are counted in aggregate without setting a cookie and without a persistent identifier. We run no advertising pixels, no cross-site tracking and no session recording.

9.1Under the Data Protection Act, 2023 you have the right to:

• (a)Ask what personal data we hold about you and receive a copy of it.
• (b)Have inaccurate or incomplete information corrected.
• (c)Have your data deleted, where no legal obligation requires us to keep it.
• (d)Object to or restrict processing that relies on our legitimate interests.
• (e)Withdraw consent for anything you consented to, at any time.
• (f)Receive the data you gave us in a portable form.

9.2To exercise any of these, write to info@hoggaantravels.com. We may ask you to confirm your identity first , this protects you, since a request to release travel documents is exactly what an impersonator would make.

9.3We respond within thirty days. There is no charge.

10.1We do not accept independent bookings from anyone under 18, and this website is not directed at children.

10.2Where a child travels under a sponsor or guardian, we process the child's identity and travel data on the sponsor's instruction and for the sole purpose of the journey. It is held to the same standard as an adult's, and deleted on the same schedule.

11.1If you believe we have handled your information wrongly, tell us first at info@hoggaantravels.com. We would rather fix it than have you discover we would not.

11.2If you are not satisfied with our response, you may lodge a complaint with the Somalia Data Protection Authority, the supervisory body established under the Data Protection Act, 2023 (Law No. 005 of 2023), at dpa.gov.so.

12.1We update this notice when what we do with data changes. The effective date and version number at the top of the page tell you which version you are reading.

12.2Where a change materially affects how we use information about you, we will tell you directly rather than rely on you noticing a new date.