Privacy Policy

HalBites Ltd ("HalBites", "we", "us") operates the HalBites food marketplace at halbites.co.uk. We are the data controller for personal data collected through our platform.

Contact: help@halbites.co.uk

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Account data: name, email address, username, password (hashed), city, country, IP address, account creation date.

Dietary and halal preference data: your use of the platform implies a preference for halal food. We process this to personalise your experience, including filtering search results and home page listings. This is special category data under Article 9 UK GDPR. We process it on the basis of explicit consent given at registration and necessity for the performance of our service, which is inherently halal-focused.

Order data: delivery address, contact number, receiver name (all encrypted at rest), order contents, quantities, payment status, order timestamps.

Seller data: business name, halal certificate details (certifying body, certificate number, expiry date, certificate document), bank account details (processed by Stripe — not stored by HalBites).

Usage data: pages visited, products viewed, search queries, recently viewed items, device type, browser, operating system (collected via Google Analytics 4 with your consent).

Communications: any messages sent to us via email or WhatsApp, feedback reports submitted through the platform.

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing necessary to fulfil your orders, manage your account, and provide the HalBites service.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, platform security, improving our service, and sending transactional emails.
• Legal obligation (Art. 6(1)(c)) — retaining financial records for tax and accounting purposes.
• Consent (Art. 6(1)(a) and Art. 9(2)(a)) — analytics cookies (GA4) and processing of dietary/halal preference data. You may withdraw consent at any time.

• To create and manage your account
• To process and fulfil orders
• To show you relevant local halal food listings
• To verify seller halal certifications
• To send transactional emails (order confirmations, cert expiry alerts, account notifications)
• To send marketing emails if you have opted in (you may unsubscribe at any time)
• To analyse platform usage and improve our service (GA4, with consent)
• To prevent fraud and ensure platform security
• To comply with UK legal obligations

We share your data with the following trusted third parties who process it on our behalf:

• Stripe — payment processing. Stripe processes payment card data and bank account details. HalBites does not store card numbers. Stripe's privacy policy: stripe.com/gb/privacy
• Google Analytics 4 (Google LLC) — usage analytics, with your consent. Data may be transferred to the USA under Google's Standard Contractual Clauses. Google's privacy policy: policies.google.com/privacy
• SMTP email provider — transactional email delivery (order confirmations, notifications).
• Web hosting provider — server infrastructure for the HalBites platform.

We do not sell your personal data to any third party.

• Account data — retained for the duration of your account plus 2 years after deletion for fraud prevention.
• Order data — retained for 7 years to comply with HMRC financial record-keeping requirements.
• Seller cert documents — retained for the duration of the seller relationship plus 3 years.
• Analytics data — retained for 14 months in GA4 (Google's default).
• Consent records — retained indefinitely as proof of consent.

You have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — correct inaccurate data (most fields can be updated directly in Settings).
• Right to erasure — request deletion of your account and personal data, subject to legal retention requirements.
• Right to restrict processing — ask us to pause processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — you can withdraw analytics cookie consent at any time by clearing your cookies (which re-shows the consent banner) or adjusting your browser settings. Because dietary preference data is inherent to using a halal-focused marketplace, the current way to withdraw this consent is to delete your account in Settings, which permanently removes this data along with your profile. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at help@halbites.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.

We take data security seriously. Key measures include:

• Passwords are hashed using bcrypt — never stored in plain text
• Delivery addresses and contact details are encrypted at rest using AES encryption
• All data is transmitted over HTTPS (TLS)
• Halal certificate documents are stored outside the public web root
• Admin panel access is restricted to authorised staff only

Despite these measures, no system is 100% secure. In the event of a data breach affecting your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

We use cookies to operate the platform and, with your consent, to analyse usage. For full details see our Cookie Policy.

HalBites is not intended for users under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect. The current version is always available at halbites.co.uk/legal/privacy.

HalBites Ltd
Email: help@halbites.co.uk

For data protection queries specifically, use the subject line "Data Protection" so we can prioritise your request.