Halali User Privacy Agreement

This Privacy Agreement ("Agreement") describes how Halali Life Pty Ltd ("Halali", "we", "us", or "our") collects, uses, stores, discloses, and protects the personal information of users ("you", "your", or "User") of the Halali platform, including via our mobile apps, websites, APIs, or other interfaces (collectively, the "Platform"). By using or registering for our services, you agree to the practices described in this Agreement.

1.1 This Agreement applies to all personal information collected in connection with your use of our Platform services, including but not limited to placing orders, delivery, payment, account registration, customer support, marketing, and related interactions.

1.2 This Agreement is to be read together with our Terms of Service / User Agreement. In the event of conflict, the provisions in this Privacy Agreement shall govern with respect to data protection matters.

1.3 By using the Platform or registering an account, you acknowledge you have read, understood, and consent to this Agreement.

2.1 Information You Provide

We may collect the following categories of personal information you actively provide:

2.2 Automatically Collected / Derived Information

When you access or use the Platform, we or our service providers may automatically collect:

2.3 Information from Third Parties

We may also obtain or verify certain information about you from third-party sources and public records (e.g. verification services, identity verification, credit / anti-fraud providers) to supplement, validate, or cross-reference our collected data.

We may use your information for the following purposes:

3.1 Service Provision

3.2 Communications & Marketing

3.3 Security, Risk Management & Compliance

3.4 Other Purposes

We may disclose or share your information under the following circumstances:

4.1 To Merchants / Delivery Partners

To enable order fulfillment, we may share your delivery address, contact name/phone, and relevant order details with the merchant and delivery partner (in minimal necessary scope).

4.2 To Service Providers

We may engage third-party vendors and service providers (e.g. cloud hosting, payment processors, analytics providers, messaging / notification services, fraud detection, customer service) who assist us in providing the Platform. These providers are contractually obligated to maintain confidentiality and use your data only to the extent necessary.

4.3 Legal & Regulatory Disclosures

We may disclose your personal data when required by law, regulation, court order, governmental or regulatory authority, or other legal processes.

4.4 Business Transfer

In connection with merger, acquisition, asset sale, or reorganization, your personal information may be transferred as part of the business assets. We will notify you and/or obtain your consent where required by law.

4.5 Aggregated / De-identified Data

We may publish or share aggregated, anonymized, or de-identified data (which cannot reasonably be used to re-identify you) for research, public insight, or business analytics.

5.1 Retention Period

We will retain personal information only as long as needed to fulfill the purposes described herein, or as required by applicable law. Once no longer needed, we will delete or anonymize the data.

5.2 Security Measures

We implement reasonable technical and organizational safeguards to protect data from unauthorized access, disclosure, alteration, or destruction, including encryption (HTTPS / TLS), access controls, authentication, logging and monitoring, data segmentation, employee training, and minimal privilege policies.

5.3 Data Breach Response

In the event of a data breach or security incident, we will promptly notify affected Users and regulatory authorities as required under applicable law and take remedial measures.

Subject to applicable law, you may have the following rights:

We will respond to your requests in accordance with applicable legal timeframes.

We do not knowingly collect or solicit sensitive personal information from persons under 16 years of age. If we become aware that we have collected such data without verifiable parental consent, we will remove it promptly. If minors (under 16) are using the service (e.g. through a guardian account), then consent must be given by the legal guardian, and such guardian should supervise the use.

If your personal data is transferred or stored outside Australia, we will ensure such transfers comply with applicable laws, including implementing safeguards such as standard contractual clauses, encryption, or verifying that recipient jurisdictions provide adequate protection.

9.1 Definition & Principles

"Sensitive Data" (or "Special Data") refers to a subset of personal information whose misuse or exposure carries higher risk, including but not limited to: racial or ethnic origin, religious beliefs, health information, biometric data, sexual orientation, criminal records, political views, or other legally protected categories.

If you voluntarily provide religious / dietary preference data (e.g. halal preference or religious affiliation), such data will be treated as Sensitive Data.

9.2 Consent & Transparency

We will collect, store, or process Sensitive Data only after obtaining your explicit, informed, and freely given consent (i.e. express consent). When collecting such data, we shall clearly inform you of purposes, retention period, access rights, sharing scope, and your right to withdraw consent.

9.3 Usage Restrictions

9.4 Retention & Deletion

Sensitive Data shall not be retained beyond what is necessary for the processing purpose. Once the purpose ends, data shall be deleted or anonymized without undue delay.

9.5 Withdrawal of Consent

You may withdraw consent for processing Sensitive Data at any time. Upon withdrawal, we will cease further processing and remove related data within a reasonable timeframe. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

9.6 Monitoring & Breach Notification

We will conduct periodic reviews of our Sensitive Data handling processes to ensure compliance, security, and lawfulness. In the event of a breach involving Sensitive Data, we will notify affected users and regulatory bodies in accordance with applicable laws.

10.1 Types & Purposes of Cookies / Tracking

We may employ Cookies and similar technologies (e.g. tracking pixels, local storage, software development kits) for the following categories:

10.2 Consent, Control & Management

11.1 We may revise this Privacy Agreement from time to time to reflect changes in regulation, business models, or technical advancements. Updated versions will be posted on Platform, with the effective date clearly indicated.

11.2 If changes are material, we may notify you via email, in-app message, or other appropriate means. Continued use of the Platform after changes become effective constitutes your acceptance of the revised terms.

This Agreement is governed by and construed in accordance with the laws of New South Wales, Australia. Any dispute arising from or related to this Agreement shall be resolved via negotiation, and if unresolved, submitted to the competent courts of Sydney, NSW (or a mutually agreed alternative).