Halaal
Data Processing Agreement
This DPA governs how personal data is processed when you use the Workspace Suite to collect information from your audience or display content to your community. It forms a binding part of our Terms of Service.
The Parties
This Data Processing Agreement ("DPA") forms part of the agreement between the following parties:
Halaal Inc LTD
A private limited company registered in England & Wales, company no. 16055333.
Registered office: 167–169 Great Portland Street, London, W1W 5PF, United Kingdom.
("Processor", "we", "us")
The Customer
The entity or individual using the Workspace Suite to build forms, profiles, route traffic, display signage, run a shop, and collect data.
("Controller", "you")
Definitions
Controller
The entity determining the purposes and means of processing personal data.
Processor
Halaal Inc LTD, which processes personal data on behalf of the Controller.
Personal Data
Any information relating to an identified or identifiable individual.
Special Category Data
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and data concerning health, sex life, or sexual orientation, plus genetic and biometric data (UK GDPR Art. 9).
Processing
Any operation performed on personal data, including collection, storage, and deletion.
Data Subject
An individual whose personal data is processed.
Personal Data Breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (UK GDPR Art. 4(12)).
Supervisory Authority
An independent public authority responsible for monitoring the application of data protection law; in the UK, the Information Commissioner’s Office (ICO).
Subprocessor
A third party engaged by the Processor to process personal data.
Scope & Nature of Processing
Scope of Services
This DPA applies when the Controller uses the Workspace Suite, including:
The Processor processes personal data solely on behalf of the Controller. The Controller determines what data is collected or displayed, why it is collected, and how it is used. Duration: processing continues for the term of the Controller's subscription, plus the retention and deletion periods described in Section 05.
Nature & Purpose
To provide secure hosting and delivery of online services requested by the Controller. Activities include:
- Collecting personal data through forms
- Routing traffic via short links
- Publishing and delivering content to display screens (signage)
- Storing submitted responses
- Taking and managing orders in the Controller's shop, and emailing buyers about them
- Creating payment pages and refunds on the Controller's own payment account, on its instructions
- Displaying analytics to the Controller
- Maintaining secure backups
- Enabling exports and deletion
Types of Data & Subjects
Data Subjects: Customers, visitors, followers, congregants, form respondents, and buyers in the Controller's shop.
Data Types:Names, emails, phone numbers, form responses, uploaded files, IPs, and device/region analytics; for shops, delivery addresses, what was ordered and its totals, answers to the shop's questions, and the order's status and payment state (never card numbers).
For signage, processing is mostly limited to the content the Controller chooses to display plus operational request logs; personal data is involved only if the Controller includes it in displayed content.
Note: The Processor does not intentionally collect special category data unless submitted or displayed by the Controller.
Special Category Data (Art. 9)
Because the Controller may be a mosque, charity, or faith community, congregant records, membership lists, and some form responses can reveal religious belief, which is special category data under UK GDPR Art. 9. Where such processing occurs, the Controller must identify and document a valid Art. 9 condition and provide any additional notices required. The Processor applies enhanced technical and organisational measures to such data and will assist the Controller with any related data protection impact assessment.
Children's Data (Art. 8)
The services are not directed at children under 13, the age of consent for information society services in the UK. Where a Controller knowingly collects personal data from children, the Controller is responsible for obtaining and, where required, verifying consent under UK GDPR Art. 8 and for age- appropriate handling. The Processor supports this with age-gating, access controls, and prompt deletion tooling.
Shops and Card Payments
Where the Controller runs a shop, its documented instructions include: taking and keeping orders; emailing buyers about their orders (confirmation, status changes, a lapsed or refunded order); and, where the Controller has connected its own Stripe account, creating the payment page for each order with the buyer's email and the order's items and total, closing it when the order is cancelled or lapses, reading the status of payments, refunds and disputes, issuing the refunds the Controller asks for, and refunding in full, automatically, a payment that reaches an order that has already lapsed or been cancelled.
Stripe is not a subprocessor. Card payments are direct charges on the Controller's own Stripe account. Stripe is the Controller's own payment provider, under the Controller's agreement with Stripe (which includes Stripe's own data processing terms), and a controller in its own right for its legal and anti-fraud duties. The Processor passes data to it on the Controller's instruction and is not responsible for Stripe's processing.
Outside this DPA: the Processor's own purposes. The Processor also uses limited shop data as an independent controller, under its Privacy Policy: platform security and the prevention of fraud and abuse, its own legal duties, handling reports about a shop, and account emails to people with a Halaal account. That processing is not done on the Controller's behalf, and the Processor is responsible for it.
Obligations
Processor Obligations
Halaal Inc LTD agrees to:
- → Process personal data only on the Controller's documented instructions, including with regard to international transfers, unless required to process by UK or EU law, in which case the Processor will inform the Controller of that legal requirement before processing, unless the law prohibits such notice.
- → Maintain strict confidentiality of processed data.
- → Implement appropriate technical and organisational security measures.
- → Assist the Controller in responding to data subject requests.
- → Notify the Controller of data breaches without undue delay.
- → Delete or return data upon request.
- → Ensure personnel authorised to process the data are bound by confidentiality.
- → Assist with data protection impact assessments and prior consultation with supervisory authorities where required.
- → Make available information reasonably necessary to demonstrate compliance, and allow for and contribute to audits.
Controller Obligations
The Customer agrees to:
- → Provide lawful processing instructions.
- → Obtain all necessary consents from Data Subjects.
- → Provide required privacy notices to respondents.
- → Ensure data is collected legally.
- → Avoid collecting or displaying unlawful or highly sensitive content.
- → For a shop, tell buyers about any use of their data beyond the standard notice the Processor shows on its behalf, and export and keep the records the law requires it to keep.
Ultimate Responsibility:
The Controller remains solely responsible for the legal compliance of collected data, the lawful basis for processing, and the content submitted via their forms or shown on their displays.
Infrastructure & Security
Subprocessors
The Processor may use subprocessors to deliver services. The Processor ensures all subprocessors provide adequate data protection safeguards and are bound by written agreements that impose data protection obligations equivalent to those in this DPA. The Processor remains fully liable to the Controller for the performance of each subprocessor's data-protection obligations. The current subprocessors are:
| Entity | Role | Hosting region | Transfer mechanism |
|---|---|---|---|
| Supabase | Database, authentication & storage | European Union | Within UK/EEA (no transfer) |
| Hetzner Online GmbH | Self-hosted SMTP email | Helsinki, Finland (EU) | Within UK/EEA (no transfer) |
| Cloudflare | CDN, edge security, signage cache & bot/abuse prevention | Global | UK IDTA / UK Addendum to the EU SCCs |
| Lemon Squeezy | Payments, billing & tax (Merchant of Record) | United States | UK IDTA + UK Extension to the EU–US Data Privacy Framework |
An up-to-date list of subprocessors is also available on request. Where the Processor intends to add or replace a subprocessor, it will give the Controller at least 30 days' prior notice and a reasonable opportunity to object on legitimate data protection grounds. If a reasonable objection cannot be resolved, the Controller may terminate the affected service.
Not a subprocessor:Stripe, for card payments in the Controller's shop. It is the Controller's own provider (see Section 02, Shops and Card Payments). Lemon Squeezy, above, handles only the Controller's own subscription to Halaal.
International Transfers
Most processing takes place within the UK/EEA: the database, authentication, and storage layer (Supabase) is EU-hosted, and the Processor's own email infrastructure runs on servers in Helsinki, Finland (EU). Transfers outside the UK/EEA are limited to:
- Cloudflare (global edge network) — covered by the UK IDTA / UK Addendum to the EU SCCs.
- Lemon Squeezy (Merchant of Record, United States) — covered by the UK IDTA / EU SCCs in Lemon Squeezy's Data Processing Agreement, and by the EU–US Data Privacy Framework (with UK Extension) certification held by Stripe, which operates its payments.
The Processor does not rely on a US adequacy decision, as none exists for the United States generally.
Security Measures
Taking account of the state of the art and the risk, the Processor implements measures including:
- Encryption in transit (TLS) and at rest
- Access controls, including row-level security and MFA for administrative access
- Logging, monitoring & regular security updates
- Regular backups with tested restoration, plus resilience and availability measures
- Documented incident response procedures
- A process for regularly testing and evaluating the effectiveness of these measures (Art. 32(1)(d))
Data Lifecycle & Compliance
Data Retention and Deletion
The Processor retains personal data while the Controller maintains an active workspace, or until deletion is requested. The Controller may elect either deletion or return of its personal data. The Processor deletes all copies except where UK law requires retention, in which case the data remains isolated and protected until it can be deleted. Deletion timelines:
- Active personal data is erased immediately on account or workspace deletion.
- Encrypted backups are overwritten within 30 days.
- Published signage content is removed from the edge display cache when a display is unpublished or deleted.
- Shop orders are kept while the workspace exists, as the Controller's sales record. A guest buyer's name, email, phone and delivery address are removed from a completed or cancelled order 12 months after it last changed; a buyer who deletes their Halaal account is removed from their orders at once. The Controller can export its orders at any time before deletion.
Data Subject Rights Assistance
The Processor will assist the Controller in responding to requests for access, deletion, correction, portability, and restriction.
Note: The Controller remains responsible for directly responding to the legal requests of their subjects.
Data Breach Notification
If a personal data breach occurs, the Processor will notify the Controller without undue delay and in any event within 48 hours of becoming aware. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it (UK GDPR Art. 33(3)), and the Processor will assist with mitigation.
Legal Terms
Termination
Upon termination of services, the Processor will delete or return personal data at the Controller's choice, and delete all copies except where UK law requires retention. The 30-day backup-overwrite schedule described in Section 05 remains applicable.
Liability
Each party remains responsible for compliance with applicable data protection laws and actions under their control. Nothing in this DPA removes statutory rights or obligations. In the event of conflict, this DPA prevails over the Terms of Service in respect of the processing of personal data.
Governing Law
This DPA is governed by the laws of England and Wales. Disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.
Acceptance of Agreement
This Data Processing Agreement (Version 1.3) is incorporated into and forms part of the Terms of Service accepted by the Controller at sign-up. By creating an account or using the Workspace Suite, the Controller agrees to this DPA. A countersignable copy is available to enterprise Controllers on request.