Who we are
“Omrati” is a Saudi online platform that gathers licensed Umrah offices in one place: the offices list their trips, and pilgrims compare, book, pay and receive their ticket. We are not an Umrah office and we do not run the trips ourselves; our role is to connect the office with the pilgrim and protect both.
In this policy, “we” or “the platform” means Omrati, and “you” means anyone who uses the website or the app: the pilgrim, the person booking for them, and the Umrah office.
Under the Personal Data Protection Law we are the “controller” of your data: we are responsible for protecting it and for answering your requests.
What we collect
We collect the data you give us yourself, and a little data created while you use the platform:
- Account: your name, e-mail, mobile number and password (stored encrypted — nobody can read it, not even us).
- Identity: gender, date of birth, nationality and ID, iqama or passport number — the bus manifest requires them.
- Address: your region, city and district if you add them.
- Booking: the trip, the package and the seats, and your companions' names, gender, nationality and ID numbers.
- Payment: the method, the amount, the transfer number, the receipt's picture, and your IBAN if you ask for a refund to your bank account.
- Technical: IP address, device and browser, sign-in times, and a log of the changes you make to your account and bookings.
- Boarding: when and where your ticket was scanned at the bus or the hotel.
- For Umrah offices: the office's details, licence, commercial registration, VAT number, national address, documents, and its manager's details.
If you book for others, make sure they agree to share their data with us. You are responsible for the data of any child you add as their guardian.
Why we collect it
- To open your account and confirm it is yours, with a code sent to your e-mail, mobile or WhatsApp.
- To carry out your booking: hold your seats and issue a QR ticket for every passenger.
- To prepare the trip's passenger manifest that the office hands to the authorities before departure.
- To review your payment, confirm your booking, and refund you when you cancel in time.
- To send your booking notices: confirmation, reminders, cancellation and refund.
- To review Umrah offices and check their licences before they publish any trip.
- To protect the platform from fraud and abuse, and to comply with the law.
We rely on your consent, on carrying out what we agreed with you (your booking and your account), and on our legal obligations. We never use your data for another purpose without telling you and asking for your consent first.
Where your data goes
A short table of every kind of data: why we need it, who can see it and how long we keep it.
| Data | Why we need it | Who can see it | How long we keep it |
|---|---|---|---|
| Account: name, e-mail, mobile | Signing in and reaching you | You and the platform's team | While your account is open |
| Identity: gender, nationality, ID number | The passenger manifest and seat assignment | You, the office of the trip you booked, and the platform's team | While your account is open, and as the law requires after |
| Bookings and companions | Running the trip and issuing tickets | You, the trip's office, and the platform's team | With the booking records |
| Payment, receipt and IBAN | Reviewing payments and refunds | The platform's finance team | As long as the law requires for financial records |
| Technical data and activity log | Security and fraud prevention | The platform's responsible team | A limited time, then deleted |
| Boarding log | Confirming you boarded | The trip's office and the platform's team | With the trip records |
Who sees your data
We never sell your data or hand it to anyone to market to you. We share it only with:
- The Umrah office of the trip you booked: it sees the passengers' names, gender, nationality, ID numbers and seats and the booker's mobile, for the manifest and to reach you on the day. No office sees the bookings of another office's trips.
- The service providers we work with: hosting, e-mail delivery, WhatsApp Business (Meta), text messages, Google Maps to show the gathering point, and the online payment gateway once available. Each receives only what it needs and must protect it.
- The competent government authorities: when a law or an official order requires it, such as passenger manifests or requests of the security and judicial authorities.
We do not transfer your data outside the Kingdom except within the limits the Personal Data Protection Law and its regulations allow.
How we handle your payment
- You pay the platform, not the office directly; the platform pays the office its share once the trip has come back.
- Online payment (Mada, Apple Pay, cards) goes through a licensed payment gateway; we never store your card number or its security code.
- A bank-transfer receipt is kept in private storage that only the finance team can open, through a protected, short-lived link.
- The IBAN you give for a refund is used only to transfer your money, and is shown masked except its last four characters.
How we protect your data
- The whole website is encrypted (HTTPS).
- Passwords are stored with one-way encryption.
- ID numbers are masked on every page except for those who need them.
- Your QR ticket is sealed and encrypted: nobody can forge it or read what is inside.
- Each team sees only what its work needs, and every change to the data is logged: who made it and when.
- Private files (receipts and documents) open only through signed links that expire.
If a data breach ever happens, we notify the competent authority within the legal time, and tell you if it affects you and what to do.
How long we keep your data
We keep your data while your account is open. When you close it we delete your data or separate it from your identity, except what the law requires us to keep longer, such as financial and accounting records and the records of paid bookings.
Your rights
The Personal Data Protection Law gives you clear rights, which you can use at any time:
- To know
- what we collect about you and why — the purpose of this page.
- To access
- ask for a copy of your data in a clear format.
- To correct
- edit your data yourself under “My account”, or ask us to correct it.
- To delete
- ask us to delete data no longer needed, except what the law requires us to keep.
- To withdraw consent
- at any time; this does not undo what was done before.
We answer your request within 30 days. If you are not satisfied with our answer, you may complain to the Saudi Data and AI Authority (SDAIA).
Cookies
We use essential cookies only: to keep you signed in, to protect forms from tampering, and to remember the language you chose. We use no advertising cookies and no trackers of advertising companies.
A trip's page shows the gathering point on Google Maps, and Google may use its own cookies under its own policy.
Children and companions
Accounts are for people aged 18 or over. Children are added as companions in their guardian's booking, and the guardian is responsible for their data being correct and for agreeing to share it.
Umrah offices' data
We use an office's details and documents to check its licence and to show its page to pilgrims. The public details — the office's name, city, licence number and contacts — appear on the website; the documents stay private. We may use an AI tool that reads a document to fill in its details, which our team then reviews.
An office must protect the passengers' data it receives and use it only to run the trip.
If we change this policy
When we change the policy we update the “last updated” date at the top of the page. If the change is significant, we tell you by a notice or an e-mail before it takes effect.
Contact us
For any question or request about your data, write to us and we will answer within 30 days:
- Company
- Omrati · Riyadh, Kingdom of Saudi Arabia
- Coming soon