Privacy Policy

1. What we collect

• Account: your name, email address, city and password. The password is stored only as a one-way hash, so nobody at NuHalal can read it.
• Vendors also: business name, business ID (Y-tunnus), contact details, halal certificates and other documents, pickup address and opening hours, and which version of the vendor agreements was accepted and when.
• What you do on NuHalal: orders, saved products, questions and answers, and a log of key actions such as sign-ups, logins and product views. We use the log for security and to show vendors their statistics.
• Technical data: your IP address is used briefly to protect logins against abuse. We don't store it in our database.
• Questionnaires, feedback and reports of concerns: your answers and messages, and an email address or business name only if you choose to leave one. You don't need an account. We use them to plan and improve NuHalal and to check reported products.
• Shops that sign a letter of intent: business name, business ID, town, the contact person's name and phone number or email, and the shop's answers on the letter.
• We don't ask about your religion, and we don't use tracking cookies, advertising or analytics tools.

2. Why we use it, and on what legal basis

• To run your account, orders and questions: the contract with you (GDPR Article 6(1)(b)).
• To verify vendors and their certificates: the vendor contract, and our legitimate interest in protecting customers from false halal claims (Article 6(1)(f)).
• To keep NuHalal secure and prevent misuse: legitimate interest (Article 6(1)(f)).
• To meet legal duties such as bookkeeping: legal obligation (Article 6(1)(c)).
• To apply for a start-up grant and prepare a shop's joining: our legitimate interest in showing the employment services that shops want NuHalal, and in following up with shops that said they intend to join (Article 6(1)(f)).
• We email you only about your account and orders. We will only send marketing if you have agreed to it.

3. Who receives your data

• Vendors see your name and the details of the orders and questions you send them.
• Customers see a vendor's business name, public listings and pickup details.
• Service providers who handle data for us: Zoho (our email inbox for messages sent to @nuhalal.com addresses, hosted in the EU), Brevo (sends account emails; EU) and Cloudflare (runs our domain and carries traffic to our website). Some of these providers may access data from outside the EU, for example for technical support; this is protected by the EU's standard contractual clauses or the EU-US Data Privacy Framework. Our database runs on our own server in Finland.
• The municipal employment services receive a copy of a shop's letter of intent as an attachment to the founder's start-up grant application.
• When you choose a password, we check it against known data leaks (Have I Been Pwned). Only the first 5 characters of an anonymous code made from the password are sent, never the password or your email address.
• We never sell your personal data.

4. How long we keep it

• Account data is kept while your account exists. If you ask us to delete your account, we do so within 30 days.
• Order records are kept as long as Finnish accounting law requires, and anonymised where possible.
• Vendors' acceptance records are kept for as long as needed to show what was agreed.
• Questionnaire answers are anonymous and kept for planning. An email address or business name left with a questionnaire, feedback or a report is deleted on request, and at the latest 12 months after you gave it. Feedback and reports are deleted after 2 years.
• Letters of intent: until a request, at the latest 12 months after the start-up grant decision, unless the shop joins NuHalal.
• Emails sent to us are deleted 2 years after the last message in the conversation. Records of data protection requests (what was asked and how we answered) are kept for 3 years, to show we handled them.
• Backups are encrypted. Data deleted from NuHalal disappears from the backups within 30 days.

5. Your rights

• You can ask to see your data, correct it, delete it, restrict its use, object to its use, or receive it in a portable format. Email [email protected]. We reply within one month.
• You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

6. Data stored on your device

NuHalal stores your login session and language choice in your browser's local storage, so you stay logged in and see the right language. We don't use cookies for tracking or advertising.

7. Security

Passwords are hashed, connections are encrypted, and access to personal data is limited to what each person needs. If a data breach affects you, we will tell you and the Data Protection Ombudsman as the law requires.

8. Changes

If we change this policy in a way that affects you, we will tell you on the site or by email before the change takes effect.