Privacy and GDPR

Document being finalised before opening.

Who is responsible for your data

The myumrahvisa site and service are published by NAF Consulting. For passports an agency entrusts to us, the agency is the controller and NAF Consulting acts as its processor: we process this data only on its instructions, to obtain the visas it requests (GDPR, Article 28).

For an individual traveller who orders their visas, and for our own purposes (accounts, billing, security), NAF Consulting is the controller.

The data processed, and why

Depending on your situation, we process:

• Travellers: the passport information (surnames, given names, sex, date and country of birth, nationality, number, issue and expiry dates), the passport image and the photo, civil status, occupation and home address, the trip's dates, flights and accommodation, the link between a minor and the adult travelling with them, and the visa issued. Depending on the request, these are joined by a proof of residence and, for an Umrah visa requested by an agency, the names in Arabic, the place of birth and a proof of vaccination. Purpose: prepare and submit the visa application, then deliver the visa.
• Accounts: the email address or WhatsApp number, the password fingerprint, the chosen language and, if you use one, the linked Apple, Google or Microsoft account. For an individual traveller, their name and country. For an agency, its company name, its country and, to verify it, its address, phone number, registration and licence numbers, the name and role of its representative, and its supporting documents. Purpose: open and protect the account, verify the agency.
• Security and proof: the audit log (who did what, and when), the service's technical logs, acceptance of the terms and the signature of each processing order. Purpose: protect the service and keep proof of what was done.
• Visiting the site: the country cookie and audience measurement, described below.

How long we keep it

The periods the service applies today:

• A traveller's files (passport, photo, final file, visa): erased 30 days after the trip's return date; the file is deleted from storage and its key destroyed.
• A traveller's identity information kept in the database: erased at the same deadline, or 30 days after the final file is delivered if that is later; without a return date, one year after the traveller was added, plus 30 days. A proof of processing remains, without content: dates, status, nationality and a fingerprint of each file.
• An agency's verification documents: 5 years after they are provided; a document replaced or removed before the verification is submitted is erased within 24 hours.
• The service's technical logs: 14 days.
• The country cookie, on the site: 30 days.

Where your data is

The application's data and files are hosted by Supabase in Ireland (eu-west-1 region), in the European Union; the application's servers run at Vercel, in its Dublin region. The public site is hosted by Vercel Inc., a company established in the United States.

The data of a visa application is sent to the official Saudi portal: this is inherent to the application.

Our processors

Each one handles a specific task:

• Vercel Inc. (United States): hosting of the public site, running the application in its Dublin region, audience and speed measurement of the site.
• Supabase: database and storage of encrypted files, in Ireland (eu-west-1 region).
• Brevo (Sendinblue SAS, France): sending the service's emails, including sign-in codes, and receiving the site's forms.
• Google (Google Cloud Vision): reading the text of passports, and locating the face to crop the photo.

If you choose to sign in with Apple, Google or Microsoft, that service confirms your identity; we receive your email address and an account identifier from it.

Cookies and audience measurement

The site sets a single cookie, “mv_cc”: it only holds the code of the country you are visiting from, is used to show agency prices in your currency, and is kept for 30 days.

The site measures its traffic with Vercel Web Analytics and the speed of its pages with Vercel Speed Insights. According to Vercel's documentation, Web Analytics does not use third-party cookies: a visitor is recognised, for the length of a visit, by a hash computed from the request and discarded after 24 hours. The data is anonymous, cannot be used to follow a visitor from one site to another, and reaches us only as aggregated statistics: page viewed, referring page, country, operating system, browser, device type and, for Speed Insights, page speed measurements.

The application sets only the cookies it needs to work: the sign-in session, which disappears when the browser closes (and which we close after 30 minutes without activity or 12 hours); temporary cookies, lasting from a few minutes to two hours, during sign-in or sign-up; the chosen language (one year); the space, agency or individual, you sign in through (six months). No advertising cookies.

“Be told when we open” form (travellers)

We collect your email address and, if you give them, your first name, your nationality, the type of application and the language of the page, for one purpose only: to write to you when applications open. Legal basis: your consent, given by ticking the box; we keep its version and date. Retention period: until applications open, then 12 months at most.

“Be contacted” form (agencies)

We collect the agency's name and country, the contact person's name, email address and phone or WhatsApp number, the approximate number of passports, the mode of interest and the message, to answer the request and present the service. Legal basis: pre-contractual steps taken at the agency's request; for service news, the consent given with the separate box. Retention period: 3 years without contact from the agency.

Brevo, our processor for these emails

This information is stored with Brevo (Sendinblue SAS, France), which also sends the confirmation and reply emails and acts on our instructions as a processor. It is not stored on the website itself, nor sold, nor shared with other companies.

Unsubscribing and deleting your information

Every email contains an unsubscribe link. To have your information corrected or deleted, write to the contact address shown on the Contact page: we delete the contact at Brevo and confirm it to you in writing.

Your rights, and how to exercise them

You can ask for:

• access to your data, and a copy (GDPR, Article 15);
• correction of inaccurate data (Article 16);
• erasure of your data (Article 17);
• restriction of processing (Article 18);
• portability of the data you provided to us (Article 20);
• objection to processing (Article 21).

To exercise a right, write to contact@myumrahvisa.com with “Personal data” as the subject. We reply within one month (GDPR, Article 12).

In your account, you can already correct the information you entered, as long as the request has not been submitted; information read from the passport is corrected by our team, at your request.

You are travelling with an agency

Your agency is the controller of your data: send your requests to it, and it must reply within one month. As its processor, we help it reply (GDPR, Article 28).

Security incident

If a personal data breach occurs, we apply the GDPR: we inform the agency whose data is affected without undue delay, and it notifies the CNIL within 72 hours; for data we are responsible for, we notify the CNIL ourselves within 72 hours when the law requires it, and we inform the people concerned if the risk to them is high (Articles 33 and 34). Protection measures are detailed on the security and data protection page.

Complaint

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with the data protection authority of your country of residence in the European Union (GDPR, Article 77).