1. Introduction & data controller

Hujozat ('we', 'us', or 'our') is a travel-booking platform operated by Hujozat S.P.A., registered in Algiers, Algeria. This Privacy Policy applies to all users of our website, mobile applications, and related services (collectively, the 'Platform').

For the purposes of applicable data-protection legislation, Hujozat S.P.A. is the data controller responsible for your personal data. Our registered address is 123 Rue Didouche Mourad, Algiers 16000, Algeria.

By using the Platform you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.

2. Information we collect

We collect the following categories of personal data: (a) Identity data — full name, date of birth, nationality, gender, passport or national-ID number, and a photograph where required for visa processing; (b) Contact data — email address, phone number, and postal address; (c) Booking data — travel dates, destinations, seat or room preferences, frequent-flyer numbers, and special requests such as dietary or accessibility requirements; (d) Payment data — credit- or debit-card number (processed and tokenised by our payment processor, Stripe), billing address, and transaction history.

We also collect technical and usage data automatically: IP address, device type and operating system, browser version, pages viewed, referring URL, timestamps, and interaction events (clicks, scrolls, searches). We use cookies and similar technologies to gather this data — see our Cookie Policy for details.

Where you contact our support team, we may record the correspondence and any information you provide during the interaction.

3. Legal basis for processing

We process your personal data only when we have a lawful basis to do so. The applicable bases are: (a) Performance of a contract — processing is necessary to fulfil a booking you have made or to take pre-contractual steps at your request; (b) Consent — where you have opted in to receive marketing communications or non-essential cookies; (c) Legitimate interests — fraud prevention, platform security, analytics, and service improvement, provided these interests are not overridden by your rights; (d) Legal obligation — retention of financial records, response to lawful requests from public authorities, and compliance with Algerian travel and tax regulations.

4. How we use your information

We use personal data to: create and manage your account; search, book, and administer travel services on your behalf; process payments and issue refunds; communicate booking confirmations, itinerary changes, and service updates; provide customer support; send promotional offers and newsletters (only with your consent); detect and prevent fraud, abuse, and security incidents; and comply with legal obligations.

We do not use your data for automated individual decision-making, including profiling, that produces legal effects or similarly significant effects on you.

5. Data sharing & recipients

We share your data with the following categories of recipients: (a) Travel providers — airlines, hotels, car-rental companies, bus operators, visa processing agencies, and omra/tour operators, solely to fulfil your bookings; (b) Payment processor — Stripe, Inc., which processes card payments on our behalf under PCI-DSS Level 1 certification; (c) Cloud infrastructure — our Platform is hosted on Amazon Web Services (AWS) in the EU (Frankfurt); (d) Analytics — Google Analytics, which receives anonymised usage data; (e) Customer support — our helpdesk provider, which receives name, email, and correspondence.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. All third-party processors are bound by data-processing agreements that impose confidentiality and security obligations at least equivalent to those in this policy.

6. International data transfers

Your data may be transferred to and processed in countries outside Algeria, including EU/EEA member states and the United States, where some of our service providers are based. Where such transfers occur, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) and compliance with Stripe's data-transfer framework.

You may request a copy of the applicable transfer safeguards by contacting us at the address below.

7. Data security

We implement technical and organisational measures appropriate to the risk, including: TLS 1.3 encryption for all data in transit; AES-256 encryption for data at rest; role-based access controls with multi-factor authentication for internal systems; regular penetration testing and vulnerability assessments; and a documented incident-response plan.

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, notify you without undue delay.

8. Data retention

We retain personal data only as long as necessary for the purposes described in this policy or as required by law. Specific retention periods: booking and transaction records — 5 years from the date of travel, as required by Algerian commercial and tax law; payment-card data — tokenised and stored by Stripe in accordance with PCI-DSS; we never store raw card numbers; marketing consent records — 3 years from the date consent was given; server and access logs — 12 months; customer-support records — 24 months from case closure.

When data is no longer needed, it is securely deleted or irreversibly anonymised.

9. Your rights

You have the right to: (a) access — request a copy of the personal data we hold about you; (b) rectification — request correction of inaccurate or incomplete data; (c) erasure — request deletion of your data where there is no compelling reason for continued processing; (d) restriction — request that we limit the processing of your data in certain circumstances; (e) portability — receive your data in a structured, commonly used, machine-readable format; (f) objection — object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please email support@hujozat.online with sufficient information to verify your identity. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant data-protection authority.

10. Children's privacy

The Platform is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If a parent or guardian becomes aware that their child has provided us with personal data without their consent, they should contact us immediately and we will take steps to delete such information.

11. Cookies & tracking technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, and analyse usage patterns. For a detailed description of the cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy.

You can manage your cookie preferences at any time through the cookie banner displayed on your first visit or via your browser settings.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice on the Platform before the changes take effect. The 'Last updated' date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer at: Hujozat S.P.A., 123 Rue Didouche Mourad, Algiers 16000, Algeria. Email: support@hujozat.online. We aim to respond to all enquiries within 30 days.

14. Supervisory authority

You have the right to lodge a complaint with the relevant data-protection supervisory authority in your jurisdiction if you believe that the processing of your personal data infringes applicable law.