Privacy Policy

1. Introduction

SASU BLACKOUT (trading as HiHijaz) is committed to protecting your personal data. This policy explains how we collect, use, store, and protect your information when you use hihijaz.com or purchase our services.

SASU BLACKOUT is the data controller for personal data collected through hihijaz.com.

2. Data we collect

Data you provide directly:

• Full name
• Email address
• WhatsApp phone number, with country code
• Tour preferences: tour type, departure city, date, group size, add-ons selected
• Post-booking operational information collected via WhatsApp: hotel address, flight details, preferred pick-up time
• Payment information — processed securely by Stripe; we do not store card details

Data collected automatically:

• IP address and browser type
• Pages visited and time spent on site
• Device type and operating system
• Referring URL
• Cookie identifiers — see our Cookie Policy

3. How we use your data

• To process and confirm your booking
• To assign and brief your HiHijaz Verified guide
• To collect post-booking operational information via WhatsApp
• To deliver the HiHijaz digital accompaniment programme via WhatsApp
• To send booking confirmation and transactional emails
• To process payments and refunds via Stripe
• To respond to enquiries and provide customer support
• To improve our website and services through analytics
• To comply with legal and tax obligations

4. Legal basis for processing

• Contract performance: processing necessary to fulfil your booking and deliver the service
• Legal obligation: compliance with French and UK financial and tax regulations
• Legitimate interests: operational coordination, service improvement, and fraud prevention
• Consent: where you have explicitly opted in, for example marketing communications and non-essential cookies

5. Data retention

• Booking records and invoices: 7 years (UK and French tax obligations)
• Customer communications, email and WhatsApp: 2 years after last interaction
• Analytics data: 26 months (Google Analytics default)
• Cookie consent records: 1 year

After the applicable retention period, your data is securely deleted or anonymised.

6. Data sharing

We do not sell your personal data. We share data only with:

• Stripe, for secure payment processing — stripe.com/gb/privacy
• Google Analytics, for website analytics
• Meta (Facebook and Instagram), for advertising measurement via the Meta Pixel and Conversions API
• Our email service provider, for transactional emails only
• HiHijaz Verified guides: name, WhatsApp number, tour details, and operational information, shared solely for executing your tour

7. International data transfers

Some service providers, including Stripe and Google, may process data outside the UK. Where this occurs, appropriate safeguards are in place including Standard Contractual Clauses approved by the UK Information Commissioner’s Office.

8. Your rights under UK GDPR

• Right of access: request a copy of your data
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data
• Right to restriction: request that we limit processing
• Right to portability: receive your data in a machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: where processing is consent-based

To exercise any of these rights, email contact@hihijaz.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

9. Data security

We implement appropriate technical and organisational measures including encrypted data transmission (HTTPS/SSL) and secure payment processing via Stripe. In the event of a data breach posing a risk to your rights, we will notify the ICO within 72 hours.

10. Children’s data

HiHijaz services are not directed at persons under 18. We do not knowingly collect personal data from minors.