Privacy Notice for Business Users

1.Who is responsible

[COMPANY LEGAL NAME], [REGISTERED ADDRESS], company number [COMPANY NUMBER] (“HalallO”, “we”) is the controller of the personal data described here. Privacy contact (data protection officer where one is required): [DPO / PRIVACY CONTACT].

This notice covers people who use HalallO for Business: owners and managers who claim or manage a restaurant at business.halallo.com or in the business features of the HalallO app, and people who contact our business team. How we handle diners’ data is in the HalallO Privacy Policy.

2.What we collect

We do not ask for government photo ID and we do not use your data to make decisions with legal effects based solely on automated processing: every claim is decided by a person.

3.Why we use it, and our legal bases

Where the GDPR or UK GDPR applies, we rely on these legal bases:

We don’t send marketing emails without your permission, and every marketing email will have an unsubscribe link. We do not sell your personal data.

4.Notice for California and other US states

In the last 12 months we have collected the categories above, which under the CCPA/CPRA correspond to identifiers (name, email, phone, IP-derived hash), customer records, commercial information (plans and purchases, when billing launches), internet activity (logs), professional information (your role at the restaurant), and sensitive personal information limited to account login credentials. We use them for the business purposes in section 3.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you. Retention is described in section 7. You can exercise your rights as described in section 8, including through an authorised agent, and we will not discriminate against you for doing so.

5.Who can see it

• The public: your restaurant content and the “Managed by owner” caption on the listing. Your name, email and phone number are not shown on the listing.
• Other members of the same restaurant: that you manage it, and your role.
• Our review team: claim details and claim files, through private links that expire after 5 minutes. Reviewers do not see whether a restaurant pays.
• Service providers who process data for us under contract, listed in section 6 and on the Subprocessors page.
• Authorities or others when the law requires it, or when needed to protect someone’s safety, prevent fraud or enforce our terms.
• A buyer or successor if HalallO is merged, acquired or sold, under this notice’s protections.

6.Service providers we use

More detail, including where each provider processes data, is on the Subprocessors page. We will update it before a planned provider starts processing your data.

7.How long we keep it

8.International transfers

Our database and files are hosted in the United States, and some providers process data in other countries. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred outside those areas. Where required, we rely on the EU–US Data Privacy Framework (and its UK extension and Swiss framework) where the provider is certified, or on the European Commission’s Standard Contractual Clauses and the UK addendum, together with the provider’s security measures.

EU representative: [EU REPRESENTATIVE, IF REQUIRED]. UK representative: [UK REPRESENTATIVE, IF REQUIRED].

9.Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. California and other US state residents can ask to know, delete and correct their personal information and to opt out of its sale or sharing (we do neither).

• Edit your restaurant content in the dashboard, and delete your account on the Account page or in the HalallO app (Settings → Delete account). Deleting your account also deletes your claim files.
• For anything else, email [DPO / PRIVACY CONTACT] from the address on your account. We confirm requests from that address and answer within the time the law sets (normally one month, or 45 days in California).
• You can complain to your data protection authority, for example in the EU the authority where you live, or the ICO in the UK.

If we can’t delete some data because the law requires us to keep it (for example invoices) or because we need it to handle a dispute, we tell you and keep it only for that purpose.

10.How we protect it

• Encryption in transit (HTTPS with HSTS) and at rest by our hosting provider.
• Row-level security in the database: you can read only your own claims and the restaurants you manage.
• Claim files sit in a private storage area. Uploads go through a server function that checks permission, size, the real file type, image dimensions and PDF content, and removes location data from restaurant photos.
• Verification codes are stored as salted hashes with attempt limits; IP addresses are stored only as salted hashes.
• Sign-in uses PKCE; you can sign out on every device from the Account page. Staff access to the review console is limited to approved accounts.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

11.Age

HalallO for Business is for adults acting for a business. Business accounts must belong to people aged 18 or over.

12.Changes to this notice

We update this notice when our practices change, for example before billing or analytics launch. If a change materially affects you, we tell you by email or in the panel before it takes effect. The date at the top shows the last update.

13.Contact

Privacy requests: [DPO / PRIVACY CONTACT]. Business questions: business@halallo.com. Account help: support@halallo.com. Post: [COMPANY LEGAL NAME], [REGISTERED ADDRESS].