Ministry of Hajj and Umrah
It is a governmental body concerned with facilitating the procedures for performing the rituals of Hajj and Umrah through integration with various government and private entities to provide the best and latest services, ensuring that these moments remain a lasting and distinctive memory reflecting the Kingdom of Saudi Arabia's efforts to serve the Guests of Allah.

Introduction
In order to manage its operations and provide services to users, the Ministry of Hajj and Umrah (the ministry or we) processes information that identifies a person directly or indirectly (personal data), including information related to current and past users (the user or you), in accordance with the Personal Data Protection Law in Saudi Arabia.

The ministry takes your privacy seriously, and this Privacy Policy (the policy) contains information to help you understand:

• How the ministry collects, uses, and stores your personal data, including identity details (whether national ID, residence, or passport).

• Why the ministry processes your personal data.

• The legal basis for processing your personal data.

• Your rights regarding the processing of your personal data and how to exercise them.

Additionally, this policy explains the various measures the ministry takes to protect your personal data and reduce the risks of unauthorized use or disclosure.

What types of personal data are collected and how is it processed?
We may collect different types of personal data either directly or indirectly, including, but not limited to, the following:

• Personal identification data such as name, date of birth, gender, nationality, and identity details (whether national ID, residence, or passport).

• Your contact details such as phone number, mobile number, email, fax, and address.

• Digital activity such as account activities (including the date and time of access, the file name accessed, the access tool, your device or browser tool, browser language, request domain, IP address, and your use of our site and services, including electronic transactions across various channels such as email and mobile apps).

• Communication records such as phone call logs between you and the ministry, specifically, your phone number used for contact, call time and date, call duration, message records, and emails.

• Internal identifiers assigned to you such as user ID number and other identifiers used for record-keeping purposes.

How personal data collected directly or indirectly is processed is as follows:

• Personal data is collected for specific, clear, and legitimate purposes, and the Ministry of Hajj and Umrah does not process personal data for any matters inconsistent with those purposes, except in limited circumstances.

• Personal data is used only for the purposes for which it was collected, and the Ministry of Hajj and Umrah is committed to notifying the user if it intends to use personal data for an unrelated purpose and clarifying the legal basis that permits the ministry to do so.

Personal data is used to provide the best possible customer experience in line with legitimate interests and to enable the Ministry of Hajj and Umrah to comply with all its legal obligations.


 

What is the purpose of collecting your personal data?
The purpose of collecting and processing personal data
We always collect and process your personal data for a specific purpose and process only relevant personal data to ensure the provision of services. Specifically, we process personal data within the regulatory constraints for the following purposes:

• Site effectiveness and improvement: To analyze website performance, monitor user interactions, and improve functionality to enhance the user experience. This includes collecting the Internet Protocol (IP) address used to connect the device to the internet, login information, and information about your visit.

• Data availability service: Providing access to data sets and information for those wishing to benefit from the data produced by the ministry through official channels. This enables the ministry to prepare and provide statistical reports as required.

• Communication: To manage and respond to your inquiries or requests when contacting the ministry through user service channels. This includes verifying your identity, addressing your concerns, and maintaining correspondence records for quality assurance and compliance purposes.

• Guest of Allah Researchers Award: Managing registration for the award (registration is done by collecting personal data from participants), evaluating submissions, verifying eligibility criteria, communicating with participants, and facilitating the selection and recognition process according to the award’s goals and criteria.

Potential consequences of failing to provide personal data

It is important to note that if you do not provide your personal data correctly, we may not be able to process your request successfully or provide you with all the benefits of our services (when this information is necessary for the purpose it was requested).

Legal basis for processing
We will collect and use your personal data only in accordance with the Personal Data Protection Law and its implementing regulations (together referred to as the PDPL), the National Data Management Office - Personal Data Protection (NDMO - PDP), and any other rules or regulations issued from time to time.

Therefore, the legal bases for processing your personal data are:

• Compliance with legal and regulatory requirements: To comply with any legal obligations or requirements imposed by relevant regulatory bodies, including for the purpose of conducting checks for compliance with legal and regulatory requirements and disclosures to the relevant authorities.

• Consent: In certain circumstances, we may process your data with your prior consent – for example, when required by law – or with your explicit consent, particularly for sensitive data as outlined in the Personal Data Protection Law.

• Legitimate interest: In certain cases, where it is necessary to perform a task in the legitimate interest (whether moral or material) of the data subject, and direct communication with the data subject is impossible or exceedingly difficult.

• Legitimate interest: If the processing is necessary for the legitimate interest of the ministry without infringing on your rights or interests, and to the extent that the personal data is essential for the purpose for which it is processed, without including sensitive data.

Examples of legitimate interest include, but are not limited to, provided they do not conflict with any of your rights under the Personal Data Protection Law:

• Enhancing our products, services, and your experience on our site and understanding your needs as a user and your eligibility for services.

• Receiving and processing complaints or requests or reports from you or third parties.

• To protect the security of information and our network, we may process your personal data to monitor and identify security risks, prevent unauthorized access to our systems, and ensure the integrity and confidentiality of your information and our services.

• Cooperating with any requests made in any actual or potential procedures or inquiries from public or judicial authorities and providing evidence and support concerning litigation procedures.

Who has access to your personal data and with whom is it shared?
Service Providers
We may share your personal data in certain cases with service providers who are bound by contractual obligations that require them to comply with a set of technical and organizational security measures regardless of their location, including measures related to assessing information security risks.

Regulatory and Judicial Authorities
We may disclose your personal data when required by applicable laws and regulations to regulatory bodies and security authorities, or upon the request of a regulatory body, court, or judicial committee, or to protect our legitimate interests when necessary.

Data Transfers Outside Saudi Arabia
In some cases, personal data may be transferred and processed outside the Kingdom. This will be based on the availability of an adequate level of protection for personal data in those countries, or the transfer will be subject to contractual clauses ensuring an adequate level of protection for personal data according to a standard model issued by Sdaia or any other competent authority under the Personal Data Protection Law.

How do we protect your personal data?
All ministry employees must comply with our internal policies and procedures regarding the processing of your personal data to ensure its protection and confidentiality.

The ministry has implemented technical and organizational measures to protect your personal data from damage, loss, misuse, disclosure, unauthorized or accidental access, or unlawful processing of any kind.


 

How long do we retain your personal data?

We will retain personal data for:

• For the duration of our relationship with you.

• As long as necessary to fulfill the purpose for which it was collected. However, the ministry may retain such data after the purpose for which it was collected has been fulfilled, if all identifiable information is removed according to the regulations specified by the laws.

If you wish to remove your personal data from our database, you may submit a request as described in section 11 'For more information,' where we will review it and respond within a maximum of (30) days. This period may be extended if fulfilling the request requires additional work or if the ministry receives multiple requests from you. The extension will not exceed (30) days, and we will notify you in advance if the request is extended, along with the reasons for the extension.


 

Your rights regarding the processing of your personal data
Your Rights
You have the right to:

• Clear information regarding the processing activities of your data, including the collection of your personal data, the purpose of its collection, the entity or entities to whom your data will be disclosed, and whether your data will be transferred or disclosed, and the potential consequences and risks of failing to complete the data collection process.

• Request access to the personal data we process.

• Request a copy of the personal data we process.

• The right to request correction of your personal data from time to time. If you believe any personal data we hold about you is incorrect or incomplete, you may request correction of your personal data.

• Request the deletion of your personal data unless this conflicts with legal retention requirements or judicial requirements.

• Withdraw your consent to the processing of personal data if the ministry previously obtained your consent (without affecting any processing carried out before the withdrawal of consent legally), unless it conflicts with legal retention requirements or judicial requirements.

The ministry will strive to meet your requests as required by the Personal Data Protection Law. However, it should be noted that these rights are not absolute and are subject to certain exceptions. Upon receiving any request, we will typically ask for some data to verify your identity and eligibility. We may also ask for additional information to clarify your request and understand it better. If we are unable to respond to your request, we will explain the reason.


 

Social Media Platforms
The ministry manages pages and accounts on social media platforms to inform, assist, and engage with you to improve the services provided. We hope you do not share any personal data on our social media platforms. If you wish to contact us, we encourage you to use official communication channels. The ministry will not be responsible for any information posted on these sites except for information published by ministry employees on its official website.



 

Changes to your personal data
We are committed to maintaining the accuracy of your personal data and ensuring it is updated. Therefore, we kindly ask that you notify us of any changes to your personal data without delay.



 

For more information
We would like to inform you that we are committed to protecting your personal data and ensuring its confidentiality. If you have any questions regarding the processing of your data, your rights mentioned above, or if you wish to provide feedback or file a complaint, please contact the Data Protection Officer (DPO) via the designated email address: dpo@hajj.gov.sa.