Here's an uncomfortable inventory question for any European Umrah agency: right now, how many pilgrim passports exist as photos in staff WhatsApp chats, personal camera rolls and cloud backups?
For most agencies the honest answer is "all of them." And each one is a copy of the most identity-theft-relevant document a person owns, sitting on private phones, outside any control, forever — because chat backups don't expire.
This isn't just sloppy; in the EU it's a legal exposure. Passport data is personal data under GDPR, you (the agency) are the data controller, and "we kept it in WhatsApp" is not a defensible processing arrangement.
What you must collect per pilgrim
The document set for an Umrah departure is standard:
- Passport — with validity meeting the Saudi entry rule (roughly six months beyond travel; check current requirements per departure)
- Passport photo where visa processing requires it
- Vaccination records when mandated
- Visa documents as issued
- Signed contract/terms and, for EU agencies, consent/notice for the data processing itself
Collecting it is the easy half. The obligations attach to what happens next.
What GDPR actually requires of an agency
You don't need a law degree — the practical duties reduce to five:
- Lawful basis & transparency. Pilgrims should know what you collect and why (performing their contract: visas, flights, hotels).
- Data minimization. Collect what the trip requires, nothing more.
- Security. Personal data must be protected — encryption, access control. A shared folder of passport JPEGs, or a chat thread, fails this on its face.
- Access control. Not everyone helping with a group needs to see passport numbers and payment histories.
- Retention limits. After the trip and any legal retention periods, data should be deleted — not archived forever in backups you can't even locate.
One breach — a lost phone, a compromised account — can mean regulatory exposure and the community trust damage that actually kills agencies.
Collection that doesn't leak
The fix mirrors the registration workflow: don't let documents travel through chats at all.
- Pilgrims submit details and upload documents through a registration link, straight into their profile — never through a staff member's personal phone.
- Duplicates are caught at entry (same passport can't register twice).
- Staff verify the typed data against the scan once, at approval — the last time a human needs to handle the raw document.
From that point, every use of the data — manifests, visa files, rooming — is a generated export from the one stored record, not another copy floating around.
Expiry tracking: catch problems six months early
The most expensive document problem is the passport that expires four months after travel — discovered at visa submission, or at the airport. Whoever holds your pilgrim data should be checking expiry dates at registration, when the fix costs a renewal fee, not a rebooking. Make "expiry vs departure date" a standard column in your intake review, or use software that flags it for you.
How Ziyara handles it
Ziyara was built for this data model: each pilgrim has one profile holding personal details, uploaded passport scans and documents — with passport and national ID numbers encrypted at rest, hosted in the EU, with hourly backups. Registration links collect documents directly from pilgrims in six languages; duplicates are detected automatically.
Access is controlled: team members get roles (Professional plan) so a helper can manage pilgrims without seeing finances, and the activity log records who did what. Generated documents — manifests, visa exports, contracts and receipts — are produced from the profile on demand, so the passport photo never needs to leave the system in a chat again.
If your current "document management" is a camera roll, the free trial is a low-stakes way to move one group's documents somewhere defensible and feel the difference.