Privacy Policy

Al Razzaq Tour and Travel (“Razaqly”), registered in Indonesia, is the controller of your personal data. We handle data in line with Indonesia's Personal Data Protection Law (UU PDP, Law 27/2022) and, for customers in the EU/EEA, the GDPR.

Razaqly currently sells flights. Hotel booking and visa assistance are in preparation. The sections describing what those services collect are marked, and apply only once the service is available and you use it — we are not collecting that data today.

• Name — required to issue a ticket or hold a reservation.
• Email and phone, including your WhatsApp number — for sign-in, confirmations, receipts, and notifications about changes to your booking.
• Payment details — handled by our payment gateway; we never store your full card number.
• Limited technical data (IP, device) — for security, fraud prevention, and audit.

• Date of birth — where an airline requires it, and to price by passenger type; stored encrypted.
• Gender and nationality — where the airline or the route requires them.
• Passport or travel-document number, issuing country, and expiry — see the next section.
• Your itinerary, fare, seat, and baggage choices.

Applies once hotel booking is available.

• Guest names and the number of guests on the reservation.
• Stay dates, room and rate selection, and any meal plan chosen.
• Special requests you ask us to pass to the property — which may reveal health or accessibility needs, and are shared only with that property and only to fulfil the request.

Applies once visa assistance is available.

A visa application asks for considerably more than a booking does, and what is required is set by the destination authority rather than by us. Depending on the destination and visa type, that may include:

• Full passport details and scans, and previous travel or visa history including any refusals.
• Photographs meeting the authority’s specification.
• Employment or study details, and supporting letters from an employer or institution.
• Financial evidence such as bank statements, payslips, or tax documents.
• Accommodation, itinerary, invitation letters, and sponsor or host details.
• Family or marital details, where the authority requires them.
• Appointment and biometric enrolment details arranged on your behalf.

We ask only for what the relevant authority requires for your application, we use it only to prepare and support that application, and we do not use it to make decisions about you by automated means.

Where a route requires passport or travel-document details, we collect them at the moment of booking and forward them to the airline or flight provider to issue your ticket.

We also keep the document number, encrypted, so you can confirm before paying that it was entered correctly and check afterwards which document was ticketed. It is held separately from the rest of your booking, under its own encryption key, and kept for as long as we hold the booking it belongs to. We do not delete it on a timer. A ticket can be queried, reissued, refunded or disputed long after the flight, and the document number is what identifies the traveller on it.

You can ask us to erase it at any time — see Your rights. We will do so unless the booking is still live or the law requires us to keep the record, and we will tell you which applies.

When we show it back to you on a confirmation, we show only the last three characters — enough to recognise the document, not enough for anyone else to use it. Card details are different: those are never stored at all.

Visa applications work the same way: an application cannot be prepared, submitted, and followed up without holding the supporting documents for as long as it is running. Those are kept for the life of the application and then handled on the terms in How long we keep it.

We set two cookies, both strictly necessary, and neither used to track you: rzq_refresh, which keeps you signed in and is not readable by scripts, and rzq_session, which records only that a session exists so the site knows whether to try restoring it.

Your browser also stores a few preferences locally — chosen language and currency, recent searches, and references to bookings you have looked at — so the site behaves sensibly on your next visit. These stay on your device, are never sent to us as a profile, and are cleared when you clear your browser data.

We run no analytics, advertising, or third-party tracking of any kind. There is nothing here to opt out of.

• Encryption in transit (TLS) everywhere; no personal data in URLs or logs.
• Field-level encryption at rest for sensitive data such as date of birth and passport numbers.
• Passwords are stored only as strong one-way hashes, never in plain text.
• Access is restricted by role and every access to personal data is audit-logged.
• Documents supplied for a visa application are held under the same restricted access, and are shared only with the authority the application is made to.

We share data only with the parties needed to deliver what you asked for, each under a data processing agreement where one applies. We do not sell your personal data.

• Airlines and flight-content providers — to issue and service tickets.
• Accommodation providers and hotel suppliers — to hold and service a reservation, once that service is available.
• Embassies, consulates, immigration authorities, and their appointed visa application centres — to submit a visa application on your behalf, once that service is available. They then process your data under their own rules, which we do not control.
• Couriers — where documents or passports must be physically sent for an application.
• Our payment gateway — to take payment.
• Our email provider and hosting provider — to send confirmations and run the platform.

We keep your booking, and the passport number attached to it, for as long as we hold the booking record. Nothing is deleted automatically on a timer. A ticket can be queried, reissued, refunded or disputed long after the flight has gone, and a record we have thrown away is one we cannot help you with.

Documents supplied for a visa application are kept on the same basis, from the conclusion of the application rather than from a travel date — an application may have no booking attached to it at all.

This is a retention decision, not an oversight, and it is bounded by two things: the passport number is encrypted at rest under its own key and never shown to anyone in full, and you can ask us to erase it whenever you like.

Financial records (payments, invoices) are retained as required by tax law. Erasing your account anonymises your personal data while keeping the anonymised financial records the law requires us to retain.

• Access and receive a copy of your personal data.
• Correct inaccurate data.
• Request erasure — including the passport number held against a booking. We act on it unless the booking is still live or the law requires us to keep the record, and we tell you which applies.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

To exercise any of these, email info@razaqly.com. One point worth being plain about: once an application has been submitted to an embassy or consulate, we cannot withdraw your data from that authority — their retention is governed by their own rules, not ours.

Because we serve customers worldwide, your data may be processed across borders. We document where data is stored and use lawful transfer mechanisms with our processors. A visa application is by its nature a transfer to the destination country's authorities, made on your instruction so that the application can be lodged.

How we use this data day to day is set out in our Company Policy and Terms & Conditions.