This policy explains how MiqatHub (“we”, “us”) collects, uses and protects personal data when travel agencies use our B2B Umrah visa services and when you visit miqathub.eu.
We are established in Portugal and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Portuguese data protection law.
1. Who is responsible for your data
For enquiries submitted through this website, we act as the controller.
For pilgrim data that a partner agency submits to obtain a visa, the agency is normally the controller and we act as a processor on its instructions. Partner agencies should have a written data processing agreement with us covering this relationship.
Data protection contact: miqathub.eu@gmail.com
2. What data we collect
Agency and business contact data
- Agency name, country and business registration details
- Contact name, email address, telephone or WhatsApp number
- Estimated monthly visa volume and target market
- Correspondence you send us
Pilgrim and visa application data
To process an Umrah visa we handle data about the traveller, submitted by the partner agency:
- Full name, date of birth, gender, nationality and country of residence
- Passport number, issue and expiry dates, and passport scans or copies
- Photographs meeting visa requirements
- Residence permit or immigration status documents where required
- Travel dates, accommodation and transport details
- Where relevant to assisted services, mobility or accessibility requirements
Some of this may constitute special category data under Article 9 GDPR (for example health information relevant to assisted Umrah, or data revealing religious belief inherent in a pilgrimage booking). We process it only where necessary to deliver the requested service, on the basis of explicit consent or another applicable Article 9 condition, and we do not use it for any other purpose.
Website and technical data
- IP address, browser type, device and operating system
- Pages viewed and referring URL
- Server logs needed for security and abuse prevention
3. Why we process it, and our legal basis
- To respond to partnership enquiries — legitimate interests, and steps taken at your request prior to entering a contract.
- To process visa applications and deliver services — performance of a contract with the partner agency; explicit consent where special category data is involved.
- To comply with Saudi immigration and visa requirements — compliance with legal obligations and the substantial public interest in immigration control.
- To keep accounting and tax records — legal obligation under Portuguese law.
- To secure our platform and prevent fraud — legitimate interests.
4. Who we share data with
We disclose personal data only as necessary, to:
- Saudi government authorities and official visa platforms, which is unavoidable for visa issuance
- Our affiliated operating company in Saudi Arabia, for ground services you request
- Hotels, transport providers and other suppliers, limited to what a booking requires
- IT, hosting and email providers acting as processors under contract
- Professional advisers, auditors, or authorities where legally required
We do not sell personal data, and we do not use it for third-party advertising.
5. International transfers
Delivering an Umrah visa necessarily involves transferring data to Saudi Arabia, which is outside the EEA and is not covered by a European Commission adequacy decision. Where we make such transfers we rely on appropriate safeguards — Standard Contractual Clauses with supplementary measures where applicable, or the Article 49 derogation for transfers necessary to perform a contract with the data subject.
You can request information about the safeguards applied to a particular transfer by contacting us.
6. How long we keep it
- Enquiries that do not become partnerships — up to 24 months from last contact.
- Visa application data — retained for the period required by Saudi authorities and for our own legal defence, then deleted. Passport scans are deleted once the application is complete and any dispute window has closed.
- Invoicing and accounting records — 10 years, as required by Portuguese law.
- Server and security logs — typically 12 months.
7. Your rights
Subject to conditions in the GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have data erased where we no longer need it
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where processing relies on consent
To exercise a right, email miqathub.eu@gmail.com. We respond within one month. If your data was submitted by a travel agency, we may direct your request to that agency as the controller.
You may also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live.
8. Security
We apply technical and organisational measures appropriate to the sensitivity of passport and identity data, including encryption in transit, access controls limited to staff who need the data, and audit logging. No system is perfectly secure, but we will notify you and the relevant authority of a qualifying personal data breach as required by law.
9. Cookies
See our Cookie Policy for what we store in your browser and how to control it.
10. Changes
We may update this policy as our services or legal obligations change. The “last updated” date above always reflects the current version, and we will notify partner agencies of material changes.