Your pilgrims' data stays protected
Passports, contact details, payments: an Umrah agency handles sensitive personal data. Here is what OmraDesk does to protect it — every point below is in place today and verifiable in the application.
What protects your data, concretely
Seven measures, all in place today.
Data hosted in Europe and encrypted
The platform's core data is hosted and backed up in Europe, and encrypted both in transit and at rest; your agency's sensitive credentials receive an additional layer of encryption. Some specialised services (messaging, email, documents, AI assistant) involve providers located outside Europe, under the conditions described in the privacy policy.
Each agency isolated in its own space
Your files, documents and conversations are partitioned: an agency never sees another agency's data.
Roles and permissions per job
Adviser, accounting, operations, management: each user accesses what they need. Access is granted and revoked by your agency's administrator.
Audit log of sensitive operations
Viewing and downloading passports, payment changes, exports: sensitive operations are logged with the user, the date and the file concerned.
Expiring download links
A document (passport, visa, rooming list) is served through a signed, time-limited link. A link pasted into a conversation stops working when it expires: it does not give indefinite access to the file.
Identity documents: controlled deletion
Passports, visas and photos stay attached to the pilgrim's file, where your team needs them. They are deleted at your agency's request, and with all of your data at the end of the contract.
GDPR-compliant processing, DPA for signature
OmraDesk acts as a processor under the GDPR: a data processing agreement (Article 28) is available for signature, and the privacy policy details each processing activity.
Frequently asked questions
Another question? The team answers you directly on WhatsApp.
Message us on WhatsAppWhere is my agency's data hosted?
The platform's core data is hosted in Europe, backups included. Some specialised services (messaging, email, documents, AI assistant) involve providers located outside Europe, under the conditions described in the privacy policy. Data sent to a visa route (eVisa, Nusuk or OmraDesk as visa partner) is sent file by file, to obtain the pilgrim's visa.
Who can access my pilgrims' files?
The users of your agency to whom you have assigned a role, within the limits of that role. Access is created and revoked by the agency administrator, each agency is isolated from the others, and sensitive operations (viewing a passport, exporting, changing a payment) are logged with the user and the date.
Can I sign a data processing agreement (DPA)?
Yes. A processing agreement compliant with Article 28 of the GDPR is available for signature for every client agency. It sets out the processing carried out, the security measures and the conditions for returning or deleting data at the end of the contract. Request it at contact@omradesk.com.
A question about security or GDPR?
Write to us or request the DPA: we reply within one business day.