Privacy Policy

1. Who we are

Near Haramain (nearharamain.com) is a UK-based hotel booking platform that helps Umrah pilgrims find the best hotel rates in Makkah and Madinah. We compare prices from multiple accommodation partners so you get the best deal without searching around yourself. This privacy policy explains how we collect, use, store, and protect your personal data when you use our website and services.

Near Haramain is a trading name of RAMDEX LTD, a company registered in England and Wales (Company No. 15887357) with its registered office at Suite Ra01, 195-197 Wood Street, London E17 3NU. RAMDEX LTD is the "data controller" of your personal data — the organisation responsible for deciding how and why it is used. We are registered with the Information Commissioner's Office.

2. What we collect

We only collect personal data that is necessary to process your booking and run our service:

• Full name — required by hotels to create your reservation. Guest names must match the ID or passport used at check-in. We need the full name of the lead guest for each room; the names of other guests are optional.
• Email address — so we can send you booking confirmations, vouchers, and important updates about your stay.
• Country of residence / nationality — hotel rates and availability can vary by nationality, so we need this to show you accurate prices.
• Payment information — your card details are handled entirely by our third-party payment provider, a PCI-DSS-certified processor. We never see, receive, or store your full card number.
• Booking details — check-in and check-out dates, hotel selection, room type, number of guests (including children and their ages), and your estimated arrival time if you choose to give it.
• Device and browser information — basic technical data such as browser type, device type, and IP address, used to keep the site working properly, to diagnose issues, and for security and fraud prevention.
• Contact form enquiries — if you use our contact form, we collect your name, email address, subject and message. These are emailed straight to our support inbox — they are not stored in a database.
• Find-a-Companion details (optional) — if you choose to use this service: your first name, email address, departure country and city, travel dates or preferred month, the group you wish to travel with, your preferred group size, age group, languages, and optionally budget, Umrah experience, a short introduction and a phone number. We process this on the basis of your consent, which you can withdraw at any time — every companion email has a one-click unsubscribe link, and your private dashboard has pause and withdraw controls. Your gender is used only to match you with same-gender companions (men with men, women with women), with your consent. Your email address and phone number are shared only with the travellers in a proposed match, and only after every one of you has separately agreed to be introduced.

We do not collect any special category data (such as health information or biometric data). We do not ask for or store passport numbers — only your country of nationality.

When you contact our support team

You can contact us by email, contact form, phone or WhatsApp. If you message us on WhatsApp, WhatsApp (a Meta service) processes your messages under its own privacy policy; we receive your phone number, profile name and message content. Support conversations are used only to help with your enquiry.

We use AI-assisted tools to help answer support enquiries quickly; a human team member oversees support and you can always ask for a human. We keep support conversations for up to 6 years — the same period as the booking they relate to — so we can deal with any later query, refund or dispute (for example a card chargeback or a complaint) and defend or bring a legal claim if we need to. After that we anonymise them. You can ask us to delete your support history sooner and we will, unless we still need it to handle a live dispute or to meet a legal obligation.

Our own privacy-preserving analytics

We run our own analytics, with no third-party trackers. We record page visits and site usage events (such as searches and hotel views) along with the referrer origin, campaign tags and country. We do not store your IP address — a daily-rotating pseudonymous identifier is used instead, so your visits cannot be tracked across days. Analytics data is deleted after 13 months, and no device storage is used for analytics (no cookies).

3. How we use your data

We use your personal data for the following purposes. Next to each one is our legal basis under UK GDPR:

• Processing your booking — searching for available hotels, confirming your reservation with our accommodation partner, and generating your booking voucher. Basis: contract.
• Transactional emails — sending you booking confirmations, cancellation confirmations, and voucher downloads. Basis: contract.
• Payment processing — taking payment for your booking via our third-party payment provider; you are only charged once your booking is confirmed. Basis: contract.
• Fraud prevention and site security — keeping the site and the booking process safe from abuse. Basis: legitimate interests.
• Customer support — responding to your queries about existing bookings, refunds, or cancellations. Basis: contract (for booking-related help) and legitimate interests (for general enquiries).
• Service improvement — understanding how people use the site, via our own analytics described above, so we can fix bugs and improve the experience. Basis: legitimate interests.
• Legal and tax compliance — keeping records as required by UK law. Basis: legal obligation.
• Find-a-Companion — matching you with other travellers, only if you ask us to. Basis: consent, which you can withdraw at any time.

Providing your booking details is a contractual requirement: without your name, email address, country of residence and payment, we cannot make the reservation for you. Find-a-Companion and contacting support are entirely optional.

4. Booking for other people

If you book for other guests — family, friends, or your travel group — you confirm that you have their permission to share their details with us. We use their details only to make and manage the reservation. Everything in this policy applies equally to their data, and they have the same rights over it as you do (see section 11).

5. Who we share it with

We share your data with the minimum number of third parties needed to fulfil your booking. We never sell your data to advertisers, data brokers, or anyone else.

• The hotel you book — your hotel in Saudi Arabia receives the guest name(s), children's ages where applicable, and your stay dates, so they can hold and honour your reservation. The hotel is always identified to you before you pay. Because the hotel is outside the UK, this involves an international transfer — see section 6.
• Accommodation partners — established accommodation-booking partners through whom we contract your room. They receive your guest name(s), children's ages where applicable, check-in/check-out dates, and country of residence, solely to confirm the reservation with your hotel, plus limited technical data such as your IP address — a fraud-prevention requirement of the booking process. These partners may be located in the UK, the EU, or elsewhere; where a partner is outside the UK, your data is protected by the safeguards described in section 6.
• Our payment provider — a PCI-DSS Level 1 certified third-party processor that handles your card details and payment securely on our behalf. We share only the payment amount and a booking reference; we never pass on your full card number.
• Other travellers — only if you use Find a Companion, and only with your explicit consent — if every traveller in a proposed match (a pair or a small group) separately confirms they are interested, we share your first name, email address and, if you provided one, your phone number with those travellers (and theirs with you) so you can get in touch. Before everyone confirms, none of you sees anyone's contact details: suggestions show only a first name, departure city, travel preferences and any short introduction written. Anyone can decline, in which case nothing of theirs is shared. This is the only circumstance in which we pass your details to another customer, and it never happens automatically.
• A transactional email delivery provider — sends our booking confirmations, cancellation notices, and vouchers on our behalf, processing your email address and name for this purpose only.

6. International transfers

Because you are booking a hotel in Saudi Arabia, your guest details (names, children's ages, stay dates) necessarily go to the hotel there. Saudi Arabia has not been assessed as "adequate" under UK data protection law, but this transfer is permitted because it is required to perform the contract you have asked us to perform — we simply cannot make a hotel reservation without telling the hotel who is staying. Once your details reach the hotel, their handling of them is governed by local law.

Some of our service providers may also process data outside the UK (for example, in the EU or the US). Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO-approved International Data Transfer Agreement or Addendum. You can request a copy of the relevant safeguards by emailing privacy@nearharamain.com.

7. Cookies

We use essential cookies only. These are strictly necessary for the site to function and cannot be switched off. They include:

• Session cookies — keep you identified during your browsing session so your search results and booking flow work correctly.
• Payment-provider cookies — set by our payment provider only once you start checkout, to prevent fraud and process your payment securely. Our payment provider sets __stripe_sid (expires after about 30 minutes) and __stripe_mid (expires after 1 year) to recognise a device across payment attempts as part of its fraud detection. These are not used for advertising, and they are not set while you browse or search — only when you begin a booking.

We do not use advertising cookies, analytics tracking cookies, or any third-party marketing cookies. Because we only use strictly necessary cookies, no cookie consent banner is required under UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

8. Children

Bookings may include children's details (their age, and their name where the hotel requires it), provided by the adult making the booking and used solely for the reservation. Our service is not directed at children, and bookings may only be made by adults (18 or over).

9. Automated decision-making

We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

One thing worth knowing: our payment provider performs automated fraud screening on payments as part of processing them. If you believe a payment was wrongly declined, contact us at info@nearharamain.com and a human will review it with you.

10. Data retention

We keep your data only as long as we need it:

• Booking records — retained for 6 years after the booking date. This is required by UK tax regulations (HMRC) and for potential dispute resolution.
• Email and contact details — retained until you ask us to delete them, or 6 years after your last booking, whichever comes first.
• Find-a-Companion preferences — your first name, contact email, optional phone number and travel preferences (dates, departure country and city, group, age group, languages, budget preferences, optional intro) are retained for 400 days from submission, then anonymised. If you withdraw your listing (from your dashboard or by asking us), they are removed sooner.
• Support conversations — kept for up to 6 years (the same period as the related booking) so we can handle later queries, refunds or disputes and defend legal claims, then anonymised. You can ask us to delete your support history sooner, unless we still need it for a live dispute or a legal obligation.
• Contact-form enquiries — kept only in our support mailbox, not in a database.
• Analytics events — deleted after 13 months.
• Payment records — our payment provider retains payment data according to its own retention policy. We store only a payment reference — never your card details.
• Technical logs — server and error logs are kept only as long as needed to keep the service running securely and to investigate problems, and are rotated regularly so they are not retained long-term.

11. Your rights (UK GDPR)

Under UK GDPR and the Data Protection Act 2018, you have the following rights over your personal data:

• Right of access — request a copy of all personal data we hold about you.
• Right to rectification — ask us to correct any inaccurate or incomplete information.
• Right to erasure — ask us to delete your personal data, where we have no legal obligation to keep it (e.g. we cannot delete booking records within the 6-year tax retention period).
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format (e.g. JSON or CSV).
• Right to object — object to our processing of your data where the legal basis is legitimate interests.
• Right to restrict processing — ask us to limit how we use your data while a complaint or dispute is being resolved.
• Right to withdraw consent — where we process your data based on consent (such as Find-a-Companion), you can withdraw it at any time, and we will stop that processing.
• Rights related to automated decision-making — the right not to be subject to a decision with legal or similarly significant effects based solely on automated processing (see section 9 — we do not make such decisions).

To exercise any of these rights, email us at privacy@nearharamain.com. We will respond within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab) or by calling the ICO helpline on 0303 123 1113.

12. Security

We take reasonable technical and organisational measures to protect your personal data:

• All connections to our website use HTTPS (TLS) encryption.
• Payments are processed by our payment provider, which is PCI-DSS Level 1 compliant — the highest level of payment security certification. We never see or store your card number.
• Access to personal data is restricted to authorised personnel only.
• Access to your booking details is protected by unique, private links sent only to you.
• We follow industry-standard secure development practices and regularly review our security.

No system is 100% secure. If you become aware of any security issue affecting our platform, please contact us immediately at privacy@nearharamain.com.

13. Changes to this policy

We may update this privacy policy from time to time. If we make significant changes that affect how your data is used, we will notify you by email (if we have your email address). Otherwise, the updated policy will be posted on this page with a new "last updated" date. We recommend checking this page periodically.