1. Who we are
Hijrah Group Foundation is the controller responsible for the personal information covered by this Privacy Notice.
- Organisation name:
- Hijrah Group Foundation
- Registered Charity No:
- Seven Seeds 1202479
- Contact address:
- 5 Brayford Square, London, E1 0SG
- Website:
- www.hijrahgroupfdn.com
- Privacy and complaints email:
- Aktar@hijrahgroupfdn.com
References to “Hijrah Group Foundation”, “we”, “us” or “our” mean Hijrah Group Foundation.
Hijrah Group Ltd is a separate organisation. Where information is shared with Hijrah Group Ltd, or Hijrah Group Ltd collects information directly, the relevant responsibilities will be explained at the point of collection.
2. Personal information we collect
The information we collect depends on how you interact with us.
Website and technical information
When you visit our website, we or our technology providers may collect:
- your IP address;
- browser and device information;
- operating system;
- approximate location derived from your IP address;
- pages viewed and links followed;
- referral source;
- date and time of visits;
- cookie or device identifiers;
- website security, performance and error logs; and
Non-essential cookies and similar technologies will be managed in accordance with our Cookie Policy and cookie-preference controls.
Enquiries and Expressions of Interest
We may collect:
- your full name;
- email address;
- telephone or WhatsApp number;
- country of residence;
- journey or programme of interest;
- intended number of places;
- confirmation that intended participants are adults;
- communication preferences;
- physical-readiness acknowledgements;
- information that you voluntarily provide in your enquiry; and
Please do not submit passport details, detailed medical information or payment-card information through an Expression of Interest form unless we specifically ask you to do so.
Applications and bookings
Where you proceed towards a booking, we may collect:
- your legal name;
- date of birth;
- nationality;
- passport and visa information;
- residential address;
- contact details;
- payment and transaction information;
- flight and travel details;
- accommodation and room preferences;
- dietary, mobility or accessibility requirements;
- travel-insurance details;
- emergency-contact information;
- signed agreements and declarations;
- booking and cancellation history;
- communications concerning your participation; and
Payment-card information will normally be processed directly by our payment provider. We do not intend to store complete payment-card details ourselves.
Health, fitness and safety information
Because some Hijrah Group programmes include extended walking, uneven terrain, desert conditions, camping and remote environments, we may ask accepted participants to provide limited information about:
- health conditions;
- medication;
- allergies;
- injuries;
- mobility or accessibility needs;
- fitness and physical readiness;
- information relevant to emergency planning; and
Health information and personal information revealing religious or philosophical beliefs are special-category information under UK data-protection law. Processing such information requires both an Article 6 lawful basis and an additional Article 9 condition. (Information Commissioner's Office)
Photographs and media
During our programmes, we may capture or receive:
- photographs;
- video recordings;
- audio recordings;
- testimonials;
- written or social-media content relating to the journey; and
Where promotional use depends on consent, the relevant permission will be requested separately.
Marketing information
Where you choose to receive promotional updates, we may record:
- whether you consented to email or WhatsApp marketing;
- the channel you selected;
- the date and method of consent;
- messages sent;
- engagement with those messages;
- unsubscribe or objection requests; and
3. How we obtain information
We usually obtain personal information directly from you.
We may also receive information from:
- a family member or group leader acting with your authority;
- the relevant programme host or partner organisation;
- payment providers;
- hotels, transport providers and other travel suppliers;
- insurance providers;
- emergency contacts;
- social-media platforms;
- website, form, email and analytics providers;
- public authorities where necessary; and
Where another person gives us information about you, they should have your authority to do so. We may contact you to verify the information and provide this Privacy Notice.
4. How and why we use your information
Responding to enquiries
We use your information to:
- answer questions;
- provide relevant package information;
- assess demand and availability;
- recommend a suitable programme;
- take initial steps towards a potential booking; and
Our usual lawful basis is that the processing is necessary to take steps at your request before potentially entering into a contract.
Managing applications and bookings
We use your information to:
- assess and accept applications;
- prepare agreements;
- process and record payments;
- allocate accommodation;
- organise transport and logistics;
- arrange hiking, camping, Umrah and ziyārah activities;
- communicate itinerary information;
- manage cancellations, refunds and credits;
- deliver the services you booked; and
Our usual lawful basis is taking steps before entering into a contract or performing our contract with you.
Where required information is not supplied, we may be unable to accept or continue a booking.
Safety and participant welfare
We may use relevant personal information to:
- assess physical readiness;
- consider reasonable adjustments;
- plan appropriate participant support;
- manage programme risks;
- respond to incidents and emergencies;
- protect participants, staff, guides and suppliers; and
Our Article 6 lawful basis may be contractual necessity, our legitimate interests in delivering a safe programme or protection of vital interests in an emergency.
Where special-category information is processed, we will also identify an appropriate Article 9 condition. This may include your explicit consent. In a genuine emergency, another lawful condition may apply.
Legal, financial and administrative purposes
We may use information to:
- issue invoices and receipts;
- maintain accounting and tax records;
- prevent and investigate fraud;
- manage complaints;
- establish, exercise or defend legal claims;
- cooperate with insurers and professional advisers;
- comply with legal and regulatory requirements; and
Our lawful basis may be legal obligation or our legitimate interests in administering and protecting our organisation.
Programme communications
We may contact you by email, telephone or WhatsApp about:
- the journey you enquired about;
- your application or booking;
- payment deadlines;
- preparation and equipment;
- accommodation and transport;
- flight or transfer information;
- itinerary changes;
- weather and safety;
- urgent operational information;
- post-journey administration; and
These are enquiry or service communications rather than general promotional marketing.
Where you join a WhatsApp group, other members may be able to see your telephone number, profile name and profile photograph. We will explain this before adding you.
Marketing
Where you have chosen to receive marketing, we may send information about:
- future Hijrah Hikers departures;
- Hijrah Group challenges;
- new packages and retreats;
- events;
- partnerships;
- offers;
- related Hijrah Group projects; and
You can unsubscribe at any time by:
- using an unsubscribe option;
- replying “STOP” to an appropriate WhatsApp message;
- contacting Aktar@hijrahgroupfdn.com; and
Withdrawing from marketing will not stop communications necessary to answer an existing enquiry or manage an active booking.
Electronic marketing to individuals by email, WhatsApp, text or similar stored messages will generally require consent unless a specific legal exception applies. (Information Commissioner's Office)
Photographs, video and testimonials
Where promotional use relies on consent, you may withdraw permission for future use by contacting Aktar@hijrahgroupfdn.com.
Withdrawal will not necessarily require us to recall materials that were lawfully printed, published or distributed before we received your request. We will consider reasonable steps to prevent future use.
5. Our lawful bases
Depending on the purpose, we rely on one or more of the following:
- Contract: processing is necessary to take steps at your request or fulfil an agreement with you.;
- Legal obligation: processing is necessary to comply with a legal requirement.;
- Legitimate interests: processing is necessary for the reasonable operation, security or protection of Hijrah Group Foundation, provided your rights do not override those interests.;
- Consent: you have made a clear and optional choice.;
- Vital interests: processing is necessary to protect someone’s life in an emergency.; and
Where special-category information is involved, we will also identify an appropriate Article 9 condition.
7. International transfers
Hijrah Group programmes are delivered partly in Saudi Arabia. It may therefore be necessary to transfer relevant participant information to Saudi-based hotels, transport providers, guides, desert teams or other delivery partners.
Some technology providers may also process information outside the United Kingdom.
Where UK international-transfer rules apply, we will use an available lawful mechanism, which may include:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved contractual clauses;
- another appropriate safeguard;
- a permitted exception in limited circumstances; and
Where required, we will also undertake the relevant data-protection assessment. UK transfer rules can apply even to small or infrequent restricted transfers. (Information Commissioner's Office)
You may contact us for further information about relevant international-transfer safeguards.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for its purpose, including contractual, legal, accounting and safety requirements.
Our usual retention periods are:
| Information | Normal retention period |
|---|---|
| EOI linked to a specific journey | Six months after the journey |
| Flexible or undated EOI | Twelve months after submission |
| Unsuccessful application | Six months after the relevant journey |
| Booking, contract and payment records | Up to six years after the relevant financial year, or longer if legally required |
| Passport and routine travel information | Normally deleted or minimised within six months after the journey |
| Emergency-contact information | Normally deleted within 30 days after the journey |
| Routine health and fitness information | Normally deleted within 12 months after the journey |
| Accident, incident or claim information | Retained for as long as reasonably necessary to handle the matter |
| Marketing contact details | Until consent is withdrawn or after 24 months without meaningful engagement |
| Consent, objection and suppression records | As long as necessary to demonstrate and respect the person’s preference |
| Website security logs | Normally up to 12 months |
| Complaints and legal claims | Normally up to six years after closure, depending on the circumstances |
We may retain information for longer where:
- an incident, complaint or legal claim is ongoing;
- an insurer or regulator requires it;
- a legal obligation applies;
- legal proceedings are reasonably anticipated; and
10. Security
We take reasonable technical and organisational measures designed to protect personal information. These may include:
- restricted access;
- strong passwords and multifactor authentication;
- access permissions based on staff responsibilities;
- secure cloud storage;
- encrypted website connections;
- confidentiality requirements;
- controlled sharing with hosts;
- access reviews;
- secure deletion or anonymisation; and
No online or communications system can be guaranteed completely secure. Please avoid sending unnecessary passport, health or payment information through social-media messages or general group chats.
11. Your data-protection rights
Depending on the circumstances, you may have the right to:
- be informed about how your information is used;
- request access to your information;
- correct inaccurate or incomplete information;
- request deletion;
- request restriction of processing;
- object to certain processing;
- object to direct marketing;
- receive certain information in a portable format;
- withdraw consent;
- challenge certain decisions made solely through automated processing; and
To exercise a right, contact:
We may ask for information reasonably necessary to verify your identity.
Not every right applies in every circumstance. Where we cannot fulfil a request, we will explain why.
12. Automated decision-making
We do not currently make decisions about applications or participants based solely on automated processing where the decision would have a legal or similarly significant effect. Applications and suitability matters involve human review.
13. Children
Our general Expression of Interest and booking processes are intended primarily for adults.
Where we agree to accept a participant under 18:
- a parent or legal guardian must be involved;
- we may require additional consent and safeguarding information;
- information will be handled with particular regard to the child’s interests; and
Please do not submit information concerning a child unless you have parental responsibility or lawful authority to do so.
14. Data-protection complaints
You may make a data-protection complaint by contacting:
- Email:
- Aktar@hijrahgroupfdn.com
- Contact address:
- Hijrah Group Foundation, 5 Brayford Square, London, E1 0SG
We will:
- provide a clear way to raise a complaint;
- acknowledge receipt within 30 days;
- take appropriate steps to investigate;
- keep you informed where appropriate;
- communicate the outcome without undue delay; and
These complaint-handling requirements came into force for organisations in June 2026. (Information Commissioner's Office)
You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator.
15. Third-party websites and services
Our website and communications may contain links to:
- payment pages;
- Google Forms;
- WhatsApp;
- Instagram and other social-media platforms;
- partner websites;
- external booking or information services; and
Those organisations may process personal information under their own privacy notices. We are not responsible for the independent privacy practices of another organisation merely because our website links to it.
16. Changes to this notice
We may update this Privacy Notice to reflect:
- changes to our programmes or services;
- changes to the organisations we work with;
- new technology;
- operational changes;
- legal and regulatory developments; and
The latest version will be published at:
www.hijrahgroupfdn.com/privacy-notice
Where a material change affects existing participants or information, we will take reasonable steps to bring it to the attention of those affected.