Customer App Privacy Policy | Halal Rewards

1. WHO WE ARE

Halal Rewards Ltd ("Halal Rewards", "we", "us") is the data controller for the Halal Rewards customer app. We are registered in England and Wales; our registered office is shown in the footer of this website and on our legal page. We are registered with the Information Commissioner's Office (ICO).

This policy covers the Halal Rewards customer app for iPhone and Android. Business users should read the Business App Privacy Policy. The website has its own privacy policy.

2. WHAT WE COLLECT, WHY, AND FOR HOW LONG

Each row gives the lawful basis under UK GDPR Article 6.

What	Why and lawful basis	How long
Account details: first and last name, email address, mobile number, password (stored hashed), and your confirmation that you are 13 or over	To create and run your account. Contract (the app terms); the age confirmation is a legal obligation.	Until you delete your account.
Terms acceptance: which version of the terms you accepted and when	To evidence your agreement. Legal obligation.	Until you delete your account.
Loyalty activity: stamps, points, rewards, offers you unlock, bookings and orders you place, and which business each relates to	To run the loyalty programme with each business you use. Contract.	Until you delete your account. Transaction records are then kept without your identity (see section 6).
Location while the app is open: your device position when you open the app or search for nearby businesses	To show businesses near you. Consent, given through the operating-system permission prompt, which you can withdraw in your phone settings.	The last position only, replaced each time and deleted after 24 hours.
Background location and geofencing: if you turn on nearby alerts, your phone watches a small set of business locations near you and tells the app when you arrive close to one	To send you an alert when you are near a participating business. Consent: this only happens if you enable Nearby alerts in the app and grant "Always" location permission. Geofence checks run on your phone; positions are not streamed to our servers.	Not stored by us beyond the 24-hour last position above.
Notification preferences and consents: which alert categories you turned on, when and where you made each choice, and the OS permission state you reported	To send only what you asked for and to evidence consent. Legal obligation and consent.	Until you delete your account.
Push token and device details: the token your phone gives us for notifications, platform and app version	To deliver notifications. Contract.	Until you sign out on that device or delete your account.
Support and requests: emails you send us	To answer you. Legitimate interests.	Up to 12 months after the matter closes.

3. NOTIFICATIONS AND MARKETING

Service notifications about your own account (booking confirmations, points received, a stamp card completing) are on by default because they are part of the service. Marketing notifications (nearby business alerts, new and exclusive deals, limited-time boosts) are off until you turn them on. You can change every category, set quiet hours and mute individual businesses in Settings > Notifications, and you can withdraw consent at any time in the same place. We do not send marketing email or SMS.

4. WHO WE SHARE DATA WITH

4.1 Participating businesses

A business you collect stamps or points with can see your name, your tier, points balance and visit count with that business, and a masked version of your email and phone (for example j***@example.com). Businesses cannot see your date of birth, your full contact details, or your activity with other businesses. Businesses cannot add or edit customers.

4.2 Service providers

These companies process data for us under contract and only on our instructions:

Cloud hosting and database (DigitalOcean, EU/UK region) and file storage (Amazon Web Services S3 and Cloudflare R2)
Push notification delivery (Expo Application Services, plus Apple and Google push services)
Transactional email (Mailjet SAS, EU)
Error monitoring (Sentry), configured not to receive personal data
Payment processing for businesses only (Stripe). We never take card details from customers.

4.3 Halal Rewards staff

Our support staff can look up your account, including your devices and last stored position, to help you or to investigate fraud. Every such lookup is logged.

4.4 Legal

We disclose data when the law requires it or to protect our rights, our users or the public.

4.5 International transfers

Data is stored in the UK or EU. Where a provider processes data outside the UK, we rely on the UK International Data Transfer Agreement or an adequacy decision.

5. YOUR RIGHTS

Under UK GDPR you can ask us to:

Access the personal data we hold about you (we send you a complete export)
Correct anything inaccurate (most details can be edited in the app)
Delete your account and data (Settings > Account > Delete account, or email us)
Restrict or object to processing based on legitimate interests
Withdraw consent for location and notifications at any time in the app or your phone settings
Port your data in a machine-readable format

Email support@halalrewards.co.uk from the address on your account. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

6. DELETION AND RETENTION

When you delete your account we permanently erase your profile, contact details, devices, location, preferences, notifications, stamps, points, streaks, bookings and orders. Transaction records that businesses need for their accounts are kept, with your identity removed, so they can no longer be linked to you. Security logs that reference an account are kept for up to 12 months and then deleted.

7. SECURITY

All traffic uses HTTPS
Passwords are stored hashed; password reset and email verification links are signed and expire
Sign-in tokens are stored in your phone's secure keychain
Access to production systems is limited to named staff

8. CHILDREN

Halal Rewards is for people aged 13 and over. We ask you to confirm you are 13 or over at signup and do not collect a date of birth. If you believe a child under 13 has an account, email us and we will delete it.

9. CHANGES

When this policy changes we update the date at the top and, for material changes, tell you in the app before they take effect.

10. CONTACT

support@halalrewards.co.uk, or write to Halal Rewards Ltd at the registered office shown on our legal page.

Halal Rewards Customer App - Privacy Policy