Qibla Gateway ("we," "us," or "our") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains what information we collect through https://qiblagateway.com, our booking process, and our communications (including phone, email and WhatsApp), how we use and share it, how long we keep it, and the rights and choices you have. By using our website or services, you agree to the practices described here.
Who we are and scope of this policy
Qibla Gateway is a travel agency based in Sacramento, CA, United States, arranging Umrah, Hajj and related travel for pilgrims. We act as the "data controller" for personal information collected through our own channels.
This policy applies to information we collect from prospective and existing customers, website visitors, and people who contact us. It does not cover third-party websites, airlines, hotels, or the Saudi government portals we may link to or work with, each of which maintains its own privacy practices.
Information we collect
Depending on how you interact with us, we may collect the following categories of information:
- Identity & contact data: your name, email address, phone number, mailing address, and preferred contact method.
- Booking & travel data: passport details, date and place of birth, nationality and residency status, travel dates, group size, relationships of travellers, room and dietary preferences, and mobility or medical needs you choose to share so we can assist you.
- Documents: copies of your passport, photographs, vaccination records, and (where required) visa and Nusuk permit information needed to process your pilgrimage.
- Payment data: billing details processed through our secure third-party payment processors. We do not store full card numbers on our own servers.
- Communications: the content of your enquiries, messages, call notes and correspondence with our team.
- Technical & usage data: IP address, device and browser type, pages viewed, referring pages, and similar analytics data collected via cookies and similar technologies (only where you have consented to non-essential cookies).
- Marketing preferences: your consent to, or opt-out from, promotional messages by email, SMS/WhatsApp or phone.
Notice at collection: what we collect, and why
California asks businesses to set this out plainly, category by category, at or before the point of collection. The table below is that notice. It uses the category names from the California Consumer Privacy Act, so you can hold us against the same yardstick as anyone else.
| Category | What that means here | Where it comes from | Why we use it | How long we keep it |
|---|---|---|---|---|
| Identifiers | Name, email address, phone number, mailing address, IP address. | From you, and automatically from your device. | To answer your enquiry, quote, book, and stay in touch about your trip. | While you are a customer, then for as long as our tax, accounting and insurance obligations require. |
| Customer records (Civ. Code 1798.80(e)) | Contact details, passport details, billing information. | From you. | To issue tickets, apply for visas and Nusuk permits, and take payment. | Same as above. |
| Protected classifications | Age, and family or marital status where it affects who shares a room. | From you. | To allocate rooms correctly and to meet airline and hotel rules. | Same as above. |
| Commercial information | Which packages you asked about, quotes we issued, bookings you made. | From you, and from how you use this site. | To answer you, and to keep a record of what was agreed. | Same as above. |
| Internet and network activity | Pages viewed, the page that referred you, browser and device type. | Cookies, and only after you accept them. | To see which pages produce enquiries, and to measure our advertising. | Held in Google Analytics for the retention window set on that account, then deleted automatically. |
| Geolocation data | Approximate city, worked out from your IP address. Not precise location. | Automatically. | To show the departure cities that are genuinely near you, and to spot fraud. | Same as the analytics row above. |
| Sensitive personal information | Passport and government ID numbers, date of birth, and any health or mobility needs you choose to tell us. Booking Umrah or Hajj also reveals religious belief, and we would rather say that plainly than pretend otherwise. | From you. | Only to deliver the trip you booked: visas, permits, tickets, and any assistance you asked for. | As for the booking rows, and sooner on request where no legal duty requires us to keep it. |
| Inferences | Your likely budget tier, and the airport you probably want to fly from. | Drawn from the categories above. | To put the right packages in front of you instead of all of them. | As for the booking rows. |
How we collect information
- Directly from you, when you request a quote, complete a form, call or message us, or make a booking.
- Automatically, through cookies and analytics tools when you use our website (subject to your consent).
- From third parties, such as payment processors (confirmation of payment), and, where you book on behalf of others, from the person making the booking.
How we use your information
We use your personal information to:
- Respond to your enquiry and prepare a personalised quote.
- Process, confirm, administer and fulfil your booking, including arranging flights, hotels, transfers, visas/Nusuk permits and guided services.
- Communicate with you about your booking, travel updates, and on-the-ground support.
- Take payment and prevent fraud and unauthorised transactions.
- Send you offers, seasonal availability and updates where you have opted in (you can opt out at any time).
- Comply with legal, tax, visa and regulatory obligations, including requirements of Saudi authorities.
- Operate, secure, analyse and improve our website and services.
Legal bases for processing
Where applicable law requires a legal basis, we rely on: the performance of our contract with you (to fulfil your booking); your consent (for marketing and non-essential cookies); our legitimate interests (to run and improve our business and prevent fraud); and compliance with legal obligations. You may withdraw consent at any time without affecting processing already carried out.
Sharing and disclosure of information
We never sell your personal information. We share it only as necessary to deliver your trip and operate lawfully, including with:
- Travel suppliers: airlines, hotels, ground transport and local operators in Saudi Arabia and elsewhere, who need your details to provide the services you booked.
- Visa and permit authorities: the Saudi Ministry of Hajj and Umrah and the Nusuk platform, and any authorised visa-processing partners.
- Payment processors: to take and secure payments.
- Service providers: IT, hosting, communications, analytics and customer-support vendors acting on our instructions under confidentiality obligations.
- Legal and safety disclosures: courts, regulators or law-enforcement where required by law, or to protect our rights, your safety, or the safety of others.
- Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.
International data transfers
To arrange your pilgrimage, your information (including passport and travel details) will be transferred to and processed in the Kingdom of Saudi Arabia and potentially other countries where our suppliers operate. These countries may have data-protection laws different from those in your state or country. Where required, we take steps to ensure appropriate safeguards for such transfers.
Cookies and tracking technologies
We use essential cookies necessary for the website to function. Only with your consent, we also use analytics and marketing cookies (such as Google Analytics and the Meta Pixel) to understand traffic and measure our advertising. Nothing in that second group loads until you accept it. You can accept or decline non-essential cookies via our consent banner, change your mind whenever you like on our Your Privacy Choices page, and manage cookies through your browser settings. Declining non-essential cookies will not affect your ability to request a quote or book.
We honour Global Privacy Control. If your browser or a browser extension sends the GPC signal, we treat it as an opt-out of the sale and sharing of your personal information in that browser. No analytics or advertising script loads, and we do not ask you to confirm a choice you have already made.
Data retention
We keep personal information only for as long as necessary for the purposes described here. That is typically for the duration of your relationship with us and for a period afterwards to meet legal, tax, accounting and dispute-resolution requirements. When information is no longer needed, we securely delete or anonymise it.
How we protect your information
We maintain administrative, technical and physical safeguards designed to protect your information, including encrypted transmission (HTTPS), access controls, and use of reputable processors. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please contact us immediately if you believe your information has been compromised.
Sale and sharing of your personal information
We do not sell your personal information, and we never have. Nobody pays us for it.
California draws a second line here that is easy to miss, so we would rather explain it than bury it. Passing information to an advertising platform so that it can measure or target ads counts as sharing under the CPRA, even when no money changes hands. If you accept analytics and advertising cookies on this site, details of your visit go to Google and Meta for exactly that purpose. That is sharing, which means you can switch it off. Decline the cookie banner, use our Your Privacy Choices page, or send a Global Privacy Control signal, and nothing goes anywhere.
We do not knowingly sell or share the personal information of anyone under 16.
Sensitive personal information and your right to limit its use
We use sensitive personal information only to arrange the travel you asked for, and for the related purposes California permits under Civil Code section 1798.121(a). We do not use it to build a profile of you, we do not use it to infer characteristics about you, and we never disclose it for cross-context behavioural advertising.
Because our use is already confined to what the law allows without an opt-out, a request to limit it will not change much in practice. You are still entitled to make one. We will write back and confirm exactly what we hold and what we do with it.
Your privacy rights (including California residents)
Depending on where you live, you may have the right to: know what personal information we collect and how we use it; access a copy of it; correct anything inaccurate; delete it; opt out of the sale or sharing of personal information and of targeted advertising; and limit the use of sensitive personal information. Under the California Consumer Privacy Act, as amended by the CPRA, California residents hold all of these along with the right not to be treated worse for using them. Residents of Virginia, Colorado, Connecticut, Utah, Texas and a growing list of other states hold closely similar rights. We run the same process for everybody rather than checking your address first.
The quickest route is our Your Privacy Choices page. It records the request with a reference number and starts the clock straight away.
You can also reach us at info@qiblagateway.com or +1 (916) 299-3388. We verify who you are before we act, because releasing one customer’s passport details or travel history to somebody else would be the far worse mistake. Verification usually means confirming details we already hold. We answer within 45 calendar days, and may extend once by a further 45 where a request is genuinely complex, in which case we tell you why before the first deadline passes. Opt-out requests are actioned within 15 business days.
An authorised agent may submit a request for you. We will ask for proof that you gave them permission, and we may still ask you to confirm it directly. If we cannot verify a request, we will explain why rather than let it go quiet. Making a request never costs you a worse price or a worse service.
Marketing and SMS/WhatsApp communications
If you opt in, we may contact you by phone, SMS/WhatsApp and email about your enquiry and relevant offers. Message and data rates may apply. You can opt out at any time by replying STOP to a text, using the unsubscribe link in an email, or contacting us. Opting out of marketing does not stop essential service messages about a booking you have made.
Children's privacy
Our website and services are directed to adults. We do not knowingly collect personal information from children under 13 (or under 16 where applicable) except as part of a family booking made by a parent or guardian. If you believe a child has provided us information without appropriate consent, contact us and we will delete it.
Third-party links
Our website may link to third-party sites, such as airlines, Trustpilot, or social media. We are not responsible for the privacy practices or content of those sites. We encourage you to review their policies.
Changes to this policy
We may update this Privacy Policy from time to time. The ‘last updated’ date above reflects the latest version, and material changes will be posted on this page. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.
How to contact us
If you have questions about this policy or wish to exercise your rights, contact Qibla Gateway at info@qiblagateway.com or +1 (916) 299-3388, or by mail to our office in Sacramento, CA.
Questions about this policy?
Ask us before you book. We'd far rather talk a clause through with you now than have it surprise you later.