Privacy Policy

This policy explains how An-Nusuk Tours processes personal information through the Pilgrim Companion in accordance with South Africa’s Protection of Personal Information Act, 2013 (POPIA).

Updated: 19 September 2026

Purpose limitedInformation is used to arrange and support confirmed pilgrimage journeys.

Encrypted storagePrivate documents are encrypted before storage and recovery replication.

Controlled deletionOperational retention and a separate recovery window limit unnecessary storage.

1. Responsible party

An-Nusuk Tours is the responsible party for personal information processed through the Pilgrim Companion. Privacy requests may be sent to annusuktours@gmail.com.

2. Information we process

Traveller names, contact details, nationality, gender and dates of birth.
Passport, visa, residence-permit and traveller-photo information.
Flight, hotel, transfer, booking and special-assistance details.
Journey documents uploaded by An-Nusuk Tours.
Security records such as access activation, successful access and failed PIN attempts.

3. Why we process it

Information is processed to confirm and administer bookings, prepare visa and travel arrangements, communicate itinerary details, provide traveller support, meet legal obligations, protect the Companion, and respond to disputes or emergencies. We do not use Pilgrim Companion documents for unrelated advertising.

4. How access works

The operator workspace is restricted to the authorised An-Nusuk Tours owner account. A pilgrim journey requires a random private link, an active journey and a separately supplied six-digit PIN. Access is rate-limited and security events are recorded. Travellers must not forward their link or PIN to unauthorised persons.

5. Storage and encryption

Documents are encrypted using authenticated AES-256-GCM encryption before being written to private object storage. A separate recovery copy may be stored in Google Drive’s hidden App Data area. The Companion’s Google permission cannot browse normal Drive files, Gmail, contacts or the wider Google profile.

6. Sharing and operators

Information may be shared only where necessary with airlines, accommodation providers, transport operators, visa or pilgrimage-service providers, government or border authorities, technology operators supporting the Companion, and professional advisers or authorities where legally required. Providers receive only information reasonably required for their function.

7. Cross-border processing

Pilgrimage arrangements inherently require selected information to be processed outside South Africa, including in Saudi Arabia and by international travel providers. An-Nusuk Tours takes reasonable steps to limit transfers to the journey purpose and to use providers subject to appropriate confidentiality or data-protection safeguards.

8. Retention and recovery

Passport, visa, accommodation, ticket and journey-support documents are retained while required to administer the confirmed journey and ordinarily for no more than 30 days after return. When removed from active storage, an encrypted recovery copy may remain for a further 30 days before permanent deletion.

Information may be retained longer when required by law, a regulator, an active dispute, fraud prevention, insurance, accounting or contractual obligations. Financial and booking records may have different statutory retention periods and are not treated as passport-document backups.

9. Your rights

Subject to POPIA and applicable exceptions, a traveller may ask whether information is held, request access or correction, object to certain processing, request deletion where retention is no longer justified, or lodge a complaint with South Africa’s Information Regulator. Identity may be verified before a request is completed.

10. Security incidents

An-Nusuk Tours investigates suspected unauthorised access, loss or disclosure. Where POPIA requires notification, affected persons and the Information Regulator will be notified as soon as reasonably possible, subject to lawful investigative restrictions.

11. Google API data

Google user data obtained through the Companion is limited to the application’s own hidden Drive App Data area. The Companion uses this access only to create, verify, update and delete encrypted recovery data for this service. Google data is not sold, used for advertising or transferred for unrelated purposes.

Public website statistics

We count public page views and directory contact-button clicks to understand which resources are useful. Daily visitor estimates use a daily-changing coded value derived from connection information. We do not store raw IP addresses or browser details in these statistics, set analytics cookies, or track private journey pages. Records are kept for up to 90 days and are visible only to the owner. Browsers sending Do Not Track are excluded. Contact clicks do not tell us whether a service was booked.

12. Changes and contact

This policy may be updated when the Companion, providers or legal requirements change. Material changes will be reflected by a revised effective date. Questions and privacy requests should be sent to annusuktours@gmail.com.