Your trust is sacred.

1. Who we are

RUH 360 ("we", "us", "our") is a Hajj and Umrah services company headquartered at Lawan Dambazau Street, Kano State, Nigeria. We provide package bookings, escrow-protected payments, agent verification tools, and journey safety services through our website, mobile app, and administrative systems.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), RUH 360 is the data controller of the personal data described in this policy. You can reach our data protection contact at salam@ruh360.com.

2. Data we collect

We collect only what we need to deliver your pilgrimage safely and lawfully. Depending on how you use RUH 360, this may include:

3. Why we process your data (lawful bases)

• Contract — to create your account, process bookings, deliver escrow-protected payments, and provide the journey services you purchased.
• Vital interests — to process location and emergency-contact data during a pilgrimage, where this is necessary to protect someone's life or physical safety (for example, routing an SOS to your emergency contacts).
• Legal obligation — to satisfy Nigerian and Saudi regulatory requirements, including NAHCON documentation, immigration records, tax, and anti-money-laundering rules.
• Legitimate interests — to verify agents, prevent fraud, secure our systems, and respond to support requests, in ways you would reasonably expect.
• Consent — for optional features such as marketing messages. Where we rely on consent, you can withdraw it at any time.

4. Who we share data with

We share personal data only with the parties who need it to serve your journey, and only the minimum each requires:

• Our NAHCON-licensed travel partner (AIA KURAWA Travels) and airlines, for visa processing and ticketing.
• Paystack Payments Limited, our payment processor, to collect and settle escrow payments securely.
• Hotels and ground transport providers in Saudi Arabia, for the bookings included in your package.
• The family members or emergency contacts you explicitly designate, for location sharing and SOS alerts during your journey.
• Professional advisers, auditors, and public authorities, where required by law or to establish or defend legal claims.

5. Location sharing and emergency alerts

Location tracking exists for one purpose: so that you and your family can find each other, and so that help can reach you quickly if something goes wrong.

• Location is shared only while it is enabled for an active journey, and you can stop sharing at any time in the app.
• Only the family members and emergency contacts you designate can see your location; our staff can access it only to respond to a safety event.
• Emergency alerts are delivered to your chosen contacts by SMS and email through our messaging providers.
• Location history is retained only for the period needed for safety records and dispute resolution, then removed.

6. How long we keep your data

• Booking, payment, and escrow records: at least 6 years after the transaction, as required for financial record-keeping and tax.
• Account data: for as long as your account is active, and for a short period afterwards if you ask us to delete it, to complete any open bookings.
• Journey safety and location records: only for the safety and dispute-resolution period after your journey ends.
• Verification codes and security logs: only for short operational windows.

When data is no longer needed, we delete it or de-identify it so it can no longer be linked to you.

7. Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of data we no longer have a legal reason to keep.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Request your data in a portable, machine-readable format where technically feasible.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email salam@ruh360.com. We will verify your identity and respond within a reasonable period, and in any event within the timeframe required by the NDPA.

8. How we protect your data

• Data in transit is encrypted, and access to production systems is restricted to authorised personnel.
• Payment card data never touches our servers; it is handled end-to-end by our PCI-DSS-compliant payment partner.
• Escrow funds are held in a regulated account and are never commingled with our operating funds.
• We review access rights regularly and log access to sensitive records.

No system is perfectly secure. If a breach ever affects your rights, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

9. Children

RUH 360 is intended for adults. Where a minor travels as part of a family package, a parent or guardian provides the required data on the minor's behalf and consents to its processing.

10. Changes to this policy

We may update this policy as our services evolve. The "last updated" date at the top of this page always shows the current version, and material changes will be communicated through the website or app before they take effect.

11. Contact

For any privacy request, question, or complaint: email salam@ruh360.com, call +234 706 666 5586, or write to us at Lawan Dambazau Street, Kano State, Nigeria. If you are not satisfied with our response, you may escalate to the Nigeria Data Protection Commission.