Privacy Policy

1. Who we are

Near Haramain (nearharamain.com) is a UK-based hotel booking platform that helps Umrah pilgrims find the best hotel rates in Makkah and Madinah. We compare prices from multiple trusted wholesale hotel suppliers so you get the best deal without searching around yourself. This privacy policy explains how we collect, use, store, and protect your personal data when you use our website and services.

2. What we collect

We only collect personal data that is necessary to process your booking and run our service:

• Full name — required by hotels to create your reservation. Guest names must match the ID or passport used at check-in.
• Email address — so we can send you booking confirmations, vouchers, and important updates about your stay.
• Country of residence / nationality — hotel rates and availability can vary by nationality, so we need this to show you accurate prices.
• Payment information — your card details are handled entirely by Stripe, our payment processor. We never see, receive, or store your full card number.
• Booking details — check-in and check-out dates, hotel selection, room type, number of guests (including children and their ages).
• Device and browser information — basic technical data such as browser type, device type, and IP address, used to keep the site working properly and to diagnose issues.
• Find-a-Companion details (optional) — if you choose to use this service: your first name, email address, departure city, travel dates or preferred month, the group you wish to travel with, and optionally group size, budget, language, experience and a short introduction. We process this on the basis of your consent, which you can withdraw at any time by asking us to remove your request.

We do not collect any special category data (such as health information or biometric data). We do not ask for or store passport numbers — only your country of nationality.

3. How we use your data

We use your personal data for the following purposes:

• Processing your booking — searching for available hotels, confirming your reservation with the hotel supplier, and generating your booking voucher.
• Transactional emails — sending you booking confirmations, cancellation confirmations, and voucher downloads.
• Payment processing — authorising and capturing payment for your booking via Stripe.
• Customer support — responding to your queries about existing bookings, refunds, or cancellations.
• Service improvement — understanding how people use the site so we can fix bugs and improve the experience.
• Legal and tax compliance — keeping records as required by UK law.

Under UK GDPR, our legal bases for processing your data are: contract performance (we need your data to process your booking), legitimate interests (improving our service and preventing fraud), and legal obligation (UK tax and accounting regulations require us to keep certain records).

4. Who we share it with

We share your data with the minimum number of third parties needed to fulfil your booking. We never sell your data to advertisers, data brokers, or anyone else.

• The hotel you book — your hotel receives the guest name(s), children's ages where applicable, and your stay dates, so they can hold and honour your reservation. The hotel is always identified to you before you pay.
• Wholesale travel suppliers ("bed banks") — established hotel-booking suppliers headquartered in the UK/EU through whom we contract your room. They receive your guest name(s), check-in/check-out dates, and country of residence, solely to confirm the reservation with your hotel, and process this data under UK/EU data-protection law.
• Stripe — our payment processor. Stripe handles your card details and payment securely. They are PCI-DSS Level 1 certified (the highest level of payment security). See Stripe's privacy policy.
• Another traveller — only if you use Find a Companion, and only with your explicit consent — if you and another traveller each separately confirm you are interested in each other's request, we share your first name and email address with them (and theirs with you) so you can get in touch. Before that mutual confirmation, neither of you sees the other's contact details: suggestions show only a first name, departure city, travel dates and any short introduction written. Either of you can decline, in which case nothing is shared. This is the only circumstance in which we pass your details to another customer, and it never happens automatically.
• A transactional email delivery provider — sends our booking confirmations, cancellation notices, and vouchers on our behalf, processing your email address and name for this purpose only.

5. Cookies

We use essential cookies only. These are strictly necessary for the site to function and cannot be switched off. They include:

• Session cookies — keep you identified during your browsing session so your search results and booking flow work correctly.
• Stripe cookies — set by Stripe during the payment process to prevent fraud and process your payment securely.

We do not use advertising cookies, analytics tracking cookies, or any third-party marketing cookies. Because we only use strictly necessary cookies, no cookie consent banner is required under UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

6. Data retention

We keep your data only as long as we need it:

• Booking records — retained for 6 years after the booking date. This is required by UK tax regulations (HMRC) and for potential dispute resolution.
• Email and contact details — retained until you ask us to delete them, or 6 years after your last booking, whichever comes first.
• Find-a-Companion preferences — your first name, contact email and travel preferences (dates, departure city, group and budget preferences, optional intro) are retained for 400 days from submission, then anonymised. If you withdraw your request, they are removed sooner.
• Payment records — Stripe retains payment data according to their own retention policy. We store only the Stripe payment reference ID, amount, and status — never your card details.
• Technical logs — server access logs and error logs are retained for 90 days, then automatically deleted.

7. Your rights (UK GDPR)

Under UK GDPR and the Data Protection Act 2018, you have the following rights over your personal data:

• Right of access — request a copy of all personal data we hold about you.
• Right to rectification — ask us to correct any inaccurate or incomplete information.
• Right to erasure — ask us to delete your personal data, where we have no legal obligation to keep it (e.g. we cannot delete booking records within the 6-year tax retention period).
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format (e.g. JSON or CSV).
• Right to object — object to our processing of your data where the legal basis is legitimate interests.
• Right to restrict processing — ask us to limit how we use your data while a complaint or dispute is being resolved.

To exercise any of these rights, email us at privacy@nearharamain.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We take reasonable technical and organisational measures to protect your personal data:

• All connections to our website use HTTPS (TLS) encryption.
• Payments are processed by Stripe, which is PCI-DSS Level 1 compliant — the highest level of payment security certification. We never see or store your card number.
• Access to personal data is restricted to authorised personnel only.
• Booking access tokens are compared using timing-safe cryptographic methods to prevent enumeration attacks.
• All API inputs are validated and sanitised to prevent injection attacks.

No system is 100% secure. If you become aware of any security issue affecting our platform, please contact us immediately at privacy@nearharamain.com.

9. Changes to this policy

We may update this privacy policy from time to time. If we make significant changes that affect how your data is used, we will notify you by email (if we have your email address). Otherwise, the updated policy will be posted on this page with a new "last updated" date. We recommend checking this page periodically.