Data Protection & Processing

This page explains how we protect the data Hajj and Umrah companies enter into Tawafe, especially pilgrim and passport data.

Roles

• The subscribing company: is responsible for the data and decides how it is used.
• Tawafe: processes the data on the company's behalf, only to provide the Service and on the company's instructions.

Isolation of each company's data

• Each company has a separate data space, and isolation is enforced in the database itself, not only in the user interface.
• Uploaded files (contracts, visas, passport pages, certificates) are stored in a folder dedicated to each company.
• Within a company, each employee sees only what their permissions allow.

Security measures

• Encrypted connection (HTTPS) between the browser and the system.
• Individual user accounts with role-based permissions.
• Suspending a company or ending its subscription blocks access to its data immediately while keeping it.
• Administrative access by the Tawafe team is limited to what support and maintenance require.

Passport scanner app and Nusuk upload

• Passport scanner app: reads passport data from the electronic chip and from a photo of the data page. To read fields from the photo we use a smart reading service from an external provider, and the image is sent for that purpose only.
• Nusuk upload: data is filled into the Nusuk platform inside the company employee's own browser, after their review and approval. Tawafe does not send data to Nusuk from its servers.
• The app and the extension are linked to the company through dedicated access tokens, which the company can revoke at any time.

Service providers

We use providers for hosting and databases, network protection and routing, email delivery, Telegram notifications, and smart reading of passport images. We choose providers committed to data protection, and companies can request the current list.

Retention and deletion

• Data is kept for the duration of the subscription.
• When the subscription ends, the company can request an export of its data within 30 days; after that the data is deleted within 60 days, except where the law requires us to keep it.
• The company can ask for its data to be permanently deleted at any time.

Security incidents

If a breach affects a company's data, we notify it without undue delay with what we know about the incident and the measures taken.

Requests from individuals

If a pilgrim asks to access or delete their data, the request goes to the company responsible for them, and we help that company carry it out technically.

Contact

WhatsApp ⁦+90 582 570 10 25⁩ — Email ⁦[email protected]⁩