Last updated: [Insert Date]
HALFNOOR LTD (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect information when you use our website, mobile application, or services (collectively, the “Platform”). We are the data controller for the personal data processed through the Platform, as described below.
We are registered with the Information Commissioner’s Office (ICO) under registration number [Insert ICO Registration Number].
Who we are
Company Name: HALFNOOR LTD
Registered Address: [Insert Registered Address]
Company Number: [Insert Company Number]
ICO Registration Number: [Insert ICO Registration Number]
Contact Email: info@halfnoor.com
Contact Phone: [Insert Phone Number]
Personal Data We Collect
We collect and process the following categories of personal data:
Identity Data: Name, username, date of birth (for age verification where required).
Contact Data: Email address, postal address, telephone number.
Account Data: Login credentials, account preferences, order history, saved addresses.
Transaction Data: Details of orders, payments, and delivery information.
Technical Data: IP address, browser type, device information, cookies, and usage data.
Vendor Data: Business name, contact details, halal certification details (including certifying organisation, certificate number, issue and expiry dates), food hygiene rating, bank account details (for payouts), menu information, and Stripe connected account ID.
Driver Data: Name, contact details, vehicle information, delivery records, and payment details (if applicable).
Marketing Data: Preferences for receiving marketing communications.
Rating and Review Data: Star ratings and written reviews submitted by customers about vendors.
How We Use Your Personal Data
| Purpose | Lawful Basis |
|---|---|
| To register and manage your account | Performance of a contract |
| To process and deliver orders | Performance of a contract |
| To facilitate payments and vendor payouts | Performance of a contract |
| To manage vendor relationships and commission calculations | Performance of a contract |
| To provide customer support | Legitimate interests (to respond to enquiries) |
| To send transactional emails (order confirmations, updates) | Performance of a contract |
| To send marketing communications (with consent) | Consent |
| To improve our Platform and services | Legitimate interests (to enhance user experience) |
| To comply with legal obligations (e.g., tax, fraud prevention, food safety) | Legal obligation |
| To ensure security and prevent fraud | Legitimate interests (to protect our business and users) |
| To display vendor ratings and reviews | Legitimate interests (to inform consumer choice) |
| To verify halal certification claims | Legitimate interests (to maintain platform integrity) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You may object to processing based on legitimate interests at any time.
Sharing Your Personal DataWe may share your personal data with:
- Restaurants/Vendors: To fulfil your order, we share your name, delivery address, and order details with the vendor you order from.
- Delivery Drivers and Partners: We share your name, delivery address, and contact number with the driver or delivery platform (Deliveroo, Just Eat, Uber Eats) assigned to deliver your order.
- Payment Processors: Stripe, PayPal, or other providers to process payments and vendor payouts.
- IT Service Providers: Hosting, email, and analytics services.
- Professional Advisers: Lawyers, accountants, insurers where necessary.
- Regulatory Authorities: Where required by law, including the Food Standards Agency and local environmental health departments.
We do not sell your personal data to third parties.
International Transfers
Your personal data may be transferred to and processed in countries outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the ICO. Contact us for more information.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law. Our standard retention periods are:
| Data Category | Retention Period |
|---|---|
| Customer account data | Duration of account + 6 years after last activity |
| Order history and transaction records | 6 years from order date (HMRC requirement) |
| Vendor business data | Duration of vendor relationship + 6 years |
| Delivery driver records | Duration of engagement + 6 years |
| Marketing consent records | Until consent withdrawn, plus 6 years |
| Cookie consent logs | 1 year |
| Rating and review data | Duration of vendor listing + 3 years |
| Server logs | 30 days |
When the retention period expires, data is securely deleted or anonymised.
Your Rights
Under UK GDPR, you have the right to:
- Access your personal data (subject access request).
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”).
- Restrict processing.
- Data portability.
- Object to processing.
- Withdraw consent (where processing is based on consent).
- Lodge a complaint with the ICO (www.ico.org.uk).
To exercise any of these rights, please contact us at info@halfnoor.com. We will respond within one month. You will not usually need to pay a fee, but we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
Security
We implement appropriate technical and organisational measures to protect personal data, including:
- TLS 1.2+ encryption for all data in transit.
- AES-256 encryption for data at rest.
- Multi-factor authentication for administrative access.
- Role-based access controls.
- Regular security assessments and penetration testing.
- Encrypted backups stored off-site.
We will notify the ICO within 72 hours of a qualifying data breach, and affected individuals without undue delay where there is a high risk to their rights and freedoms.
Children’s Privacy
Our Platform is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Where changes are material, we will notify you by email or through the Platform.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact:
Data Protection Lead
HALFNOOR LTD
[Insert Registered Address]
Email: info@halfnoor.com