Privacy Policy

This Privacy Policy explains how Alnajoum Travel ("we", "us", "our") collects, uses, stores, and protects the personal data of visitors to this website and users of our booking platform, in line with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).

It applies to customers, family members added to a customer account, and anyone who submits the contact form, even without creating an account.

Account information: full name, email address, phone number, and password (stored as a salted hash, never in plain text).

Profile information: date of birth, nationality, gender, address, and passport or national ID number, where you choose to provide it for booking purposes.

Identity documents: passport, national ID, visa, photo, vaccination certificate, or birth certificate files you upload for yourself or a family member you manage.

Booking and payment records: flights searched and booked, invoices issued, and payments recorded against your account (payment method and amount; we do not store full card numbers).

Contact form submissions: the name, email, subject, and message you provide when writing to us, even if you never register an account.

Technical information: standard web server logs (IP address, browser type, pages visited) collected automatically for security and reliability.

To create and manage your account, and your family members’ records, on the platform.

To search for and book flights on your behalf, and to generate and track invoices and payments for those bookings.

To send you transactional notifications: booking confirmations, payment receipts, and — for staff accounts — temporary login credentials.

To respond to messages sent through the contact form.

To detect and prevent fraud, abuse, and unauthorized access to accounts.

We do not sell personal data, and we do not use it for third-party advertising.

Flight providers, to search for and confirm bookings on your behalf.

Payment processors, once online payment is enabled, to process transactions you initiate.

Email/SMS delivery providers, to send booking confirmations, receipts, and account notifications.

We do not share your data with third parties for their own marketing purposes.

Account and booking records are retained for as long as your account is active, and for a reasonable period afterward to meet accounting, tax, and legal obligations.

Identity documents you upload are retained only for as long as needed to support the booking or verification they were provided for, or until you request deletion, subject to any legal retention requirement.

Under the NDPA, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion where there is no overriding legal reason to keep it, and object to certain processing.

You can view and update most of your own profile and family member information directly from your account. For anything else — including a full data export or deletion request — contact us using the details below.

Passwords are hashed, not stored in plain text. Access to customer and staff data is controlled by a role-based permission system, so staff only see what their role requires. Uploaded documents are validated for file type and size before storage.

For any question about this policy, or to exercise your data protection rights, contact us at alnajoumtravelagency@gmail.com or through the contact form on this site.