A Hajj and Umrah agency collects the most sensitive categories of personal data there are: identity numbers, passports, dates of birth, addresses, sometimes health notes. Putting that data into a software system does not transfer the responsibility — the agency still answers for it.
Two roles, one obligation
In most data protection regimes the agency is the controller and the software provider is the processor. In practice that means the duty towards the passenger is yours, and the tools to discharge it have to be ours.
When a passenger asks for their data to be removed, you are obliged to do it. If the software offers no deletion tool you end up cleaning records by hand — and manual cleaning is never complete.
Notice and consent are records, not gestures
Showing a privacy notice when you collect data, and taking explicit consent where it is required, is only half the duty. Keeping a record of it is the other half: "we showed it" is not enough, when it was shown has to be recorded.
Health information counts as a special category almost everywhere and carries stricter rules. Wheelchair requirements and dietary notes fall into it.
Retention
Keeping everything forever "just in case" is not defensible. Every kind of data needs a retention period, and when it expires the data should go.
Passport scans are the critical item. A passport image sitting on a server years after the departure creates a situation the agency cannot explain if it ever leaks.
Do permissions restrict the data or just the screen
In many systems a permission is a menu-hiding mechanism: if the user cannot see it in the menu, they are considered to have no access. That is not an adequate safeguard.
Typing a record number straight into the address bar, running a report that exports rows, or using the search box all walk around a hidden menu.
The boundary has to restrict the data itself. If a dealer account cannot reach a passenger they did not register by any route, that is a real boundary.
Questions worth asking a vendor
Security claims should be checkable. "Your data is safe" is a sentence; what matters is what holds it up.
- Where does the separation between agencies happen — inside the program, or where the data is stored?
- Where are the servers, and does moving data abroad need separate consent?
- How is data handed over when the contract ends, and when is it deleted?
- Are passport images served from a fixed address, or through links that expire?
- Is there a record of who changed what and when?