Halali Privacy Policy

Halali Life Pty Ltd ("Halali", "we", "us" or "our") operates the Halali customer mobile applications, websites and related customer-facing services (together, the "Platform"). This Privacy Policy explains how we collect, hold, use, disclose and protect personal information about customers and visitors.

In this Policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not the information is true or recorded in a material form.

We manage personal information in accordance with applicable privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) to the extent they apply to us. We also use the APPs as our general privacy standard. Where another applicable law provides additional protections, we will comply with those requirements.

This Policy is a notice about our information-handling practices. It is not intended to obtain blanket consent for every form of processing. Where consent is required, including for certain sensitive information, optional device permissions, non-essential technologies or direct marketing, we will request it separately or provide an appropriate choice.

You may be able to browse parts of the Platform or make a general enquiry without identifying yourself. We need certain information to create an account, process an order, take payment, deliver goods or investigate an account-specific issue. If you do not provide required information, we may not be able to provide the relevant service.

2.1 Information you provide to us

Depending on how you use the Platform, we may collect:

2.2 Information collected automatically

When you browse or use the Platform, including before or after creating an account, we or service providers acting on our behalf may automatically collect:

2.3 Information received from third parties

We may receive personal information from:

2.4 Online customer support and the Sobot SDK

When you choose Contact us or return to an existing online support chat, Halali uses the Sobot visitor customer service software development kit (the "Sobot SDK") to provide online customer support, message history, attachments, customer service tickets, queue management, service evaluation and unread-message functionality.

To connect you with the correct support session and enable Halali's support team to assist you, we may provide Sobot with the following information, to the extent available and relevant:

Halali does not intentionally provide Sobot with your Halali password, authentication token, verification code, delivery address, precise location, full payment card details, bank details or payment-provider credentials for ordinary customer support identification.

Halali does not enable Sobot SDK push notifications in the current version of the App and does not use the Sobot SDK for advertising or cross-app tracking.

Please do not send passwords, verification codes, full payment card details or unnecessary sensitive information through customer support chat.

2.5 Sensitive information

Sensitive information under Australian privacy law includes information such as religious beliefs or affiliations and health information. Allergy information may be health information. A stated religious affiliation or a dietary preference expressly linked to religious belief may also be sensitive information.

Halali does not require you to state your religion. Use of a halal-focused service may allow someone to infer a dietary or religious preference, but we do not treat use of the Platform alone as confirmation of a religious belief. Where we collect sensitive information, we do so with consent where required, only where reasonably necessary for our functions or otherwise permitted by law, and with additional care. We do not use sensitive information for direct marketing without consent.

We generally collect personal information directly from you when you create or update an account, place or manage an order, use a feature, communicate with customer support, contact a merchant or courier through the Platform, participate in a promotion, submit a review, or otherwise interact with us.

We also collect information automatically through the Platform and receive information from the third parties described above. We seek to collect personal information by lawful and fair means and only where it is reasonably necessary for our functions and activities or otherwise permitted by law.

If we receive unsolicited personal information that we could not lawfully have collected, we will take reasonable steps to destroy or de-identify it where required, unless it is contained in a Commonwealth record or must be retained by law.

We collect, hold, use and disclose personal information where reasonably necessary for our functions and activities, for the primary purpose for which it was collected, for a related purpose you would reasonably expect, with your consent, or where required or authorised by law.

4.1 Account management and Platform access

4.2 Orders, payments and delivery

4.3 Customer support, safety and service quality

4.4 Security, fraud prevention and compliance

4.5 Analytics, improvement and personalisation

4.6 Marketing and promotions

Where permitted by law, we may use your contact details and non-sensitive account, transaction, location and usage information to send or tailor Halali offers, discounts, competitions, referral programs, newsletters and similar promotions. We obtain consent where required and provide a clear way to opt out. Section 11 explains your marketing choices.

Our websites and apps may use cookies, pixels, local storage, software development kits (SDKs), application programming interfaces (APIs), device operating-system services and similar technologies. These technologies may be provided by Halali or by service providers acting on our behalf.

We use these technologies for purposes such as:

The identity of individual technology and operational suppliers may change from time to time. For this reason, this Policy generally describes the categories of service providers, the information involved and the purposes of processing. We may also identify material providers where doing so helps explain a particular data flow, including Sobot as described in sections 2.4, 8 and 9. Where a separate notice or consent is required for a particular technology or activity, we will provide it at the relevant time.

You can manage browser cookies, device permissions, advertising settings and notification preferences through the relevant browser, device or Platform settings. Where applicable law requires consent for a non-essential technology, we will request it. Blocking some technologies may reduce functionality.

We may use rules, algorithms or automated tools to assist with merchant and item ranking, recommendations, delivery allocation, service availability, security risk flags, promotion eligibility and fraud or abuse detection. These tools may use account, transaction, device, location and usage information.

Automated tools support operational decisions but do not remove our responsibility to apply appropriate safeguards. Where an automated process is subject to a specific transparency, explanation or review requirement under applicable law, we will provide the required information and means of review.

We disclose personal information only where reasonably necessary for the purposes described in this Policy, with consent, or where required or authorised by law. Recipients may include:

8.1 Sobot online customer support provider

For online customer support, Halali uses the global Sobot service operated by Sobot Technologies Pte Ltd ("Sobot") as a customer support service provider and data processor. Sobot processes the customer support information described in section 2.4 to provide, maintain, secure and support the contracted online customer service functionality on Halali's behalf.

Halali and Sobot Technologies Pte Ltd have entered into a Data Processing Agreement (DPA), which forms part of the contractual arrangements governing Sobot's processing of personal information on Halali's behalf. Under the DPA, Sobot must process personal information only on Halali's documented instructions, apply appropriate confidentiality and security safeguards, assist Halali with eligible data-subject requests, promptly notify and cooperate with Halali in relation to personal-data breaches, comply with agreed controls for international transfers, maintain relevant processing records and support appropriate audits. When the services terminate or expire, Sobot must, at Halali's option, return or securely dispose of personal information unless continued retention is required by applicable law.

Sobot's global privacy information is available at https://www.sobot.io/privacy-protection-policy.

Merchants and couriers may be independent businesses and may have their own privacy obligations and policies for information they receive. This Policy governs Halali's handling of personal information, not an independent party's separate practices outside Halali's direction or control.

Some service providers, affiliated personnel or technical systems may be located outside Australia, and personal information may be disclosed to or processed in other countries. Privacy and data-protection laws in those countries may differ from Australian law.

The countries in which overseas recipients or processing locations are currently likely to be located include Singapore and the United States. The exact locations may depend on the service, technical architecture, configured processing region and the location of authorised support or engineering personnel. We will update this Policy where it is practicable to identify additional countries in which likely overseas recipients are located.

Sobot customer support: Sobot has confirmed that the data centre assigned to Halali's AppKey is located in Singapore and that customer support conversations and the basic user information associated with those conversations are stored in Singapore. Halali will update this disclosure if Sobot notifies us that the relevant processing or storage locations have changed.

Before disclosing personal information to an overseas recipient, Halali will take reasonable steps appropriate to the circumstances to require suitable handling of the information. These steps may include due diligence, contractual privacy and security terms, access restrictions, encryption, purpose and retention limits, deletion requirements, incident notification duties and oversight of sub-processors. For Sobot, the contractual safeguards specifically provided by the DPA are described in section 8.1.

In some circumstances, an exception under applicable law may permit an overseas disclosure without Halali taking the steps otherwise required. Where consent is relied on for such a disclosure, we will provide relevant information before seeking consent.

10.1 How long we keep information

We retain personal information only for as long as reasonably needed for the purposes described in this Policy, to provide services, maintain appropriate business and transaction records, prevent fraud, resolve disputes, enforce agreements and comply with legal obligations. Retention periods vary by information type and context.

When determining a retention period, we may consider the nature and sensitivity of the information, the reason it was collected, operational and security requirements, contractual rights and obligations, applicable record-keeping requirements, limitation periods, actual or potential disputes and whether the information can be de-identified.

Closing an online customer support chat ends the active messaging session but does not, by itself, delete the support record, messages, attachments or associated information. Sobot's service retains customer support records during the term of Halali's contract unless Halali instructs Sobot to delete eligible information earlier. Halali reviews whether support information remains reasonably required and may issue deletion instructions in accordance with this Policy, applicable law and the DPA.

Sobot has confirmed that it has the ability to delete customer support information in response to an eligible request made through Halali. Halali will coordinate the request with Sobot and its appropriate technical team. Some information may still need to be retained where reasonably necessary for an unresolved dispute, security investigation, fraud prevention or legal obligation.

When Halali's services with Sobot terminate or expire, the DPA requires Sobot, at Halali's option, to return or securely dispose of all personal information it processes on Halali's behalf, unless applicable law requires continued retention.

Closing a support chat or deleting an account does not necessarily delete all associated records immediately. Order, payment, refund, support, security and dispute records may be retained where reasonably necessary or required or permitted by law. Information contained in secured backups may not be deleted immediately and will remain subject to applicable access restrictions and legal and contractual requirements while retained.

When personal information is no longer required for a permitted purpose, we take reasonable steps to delete it or de-identify it, unless the information must or may be retained by law or a court or tribunal order. We may retain aggregated or de-identified information where individuals are not reasonably identifiable.

10.2 Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved. These may include encryption in transit, access controls, authentication, logging and monitoring, secure development practices, staff confidentiality and training, vendor controls, backups and incident-response procedures.

Payment information is generally transmitted to payment providers through secure methods, and Halali generally receives transaction references, payment tokens or limited card information rather than full card details. You are responsible for keeping your password, verification codes and device access secure.

No system is completely secure, and we cannot guarantee that unauthorised access, loss or misuse will never occur. Please contact us promptly if you believe your account or personal information has been compromised.

10.3 Data breaches

If a suspected data breach occurs, we will assess, contain and respond to it promptly. Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable and provide information about recommended protective steps.

Where permitted by law and consistent with your settings, marketing communications may be sent by email, SMS, messaging service, telephone or push notification. We may also use permitted cookies, pixels, SDKs or advertising identifiers to measure campaigns or tailor marketing.

You can opt out by using the unsubscribe link or instructions in a message, replying STOP where supported, changing Platform notification or marketing settings, adjusting browser or device advertising settings, or contacting us. We will action valid opt-out requests within the timeframe required by law and without charge.

Opting out of marketing does not stop essential service communications, such as order confirmations, delivery updates, refund notices, security alerts, account messages, service interruptions or material changes to our terms and policies.

We do not use sensitive information for direct marketing unless you have consented and the use is otherwise permitted by law.

You may access and update some information directly in your account settings. Subject to applicable law and any lawful exceptions, you may also ask us to:

You may request account deletion through the in-app account settings where that function is available, or by emailing support@halali.co with the subject "Privacy Request". Account deletion does not require us to delete records that must or may be retained for tax, accounting, fraud prevention, security, dispute resolution, legal claims or other lawful purposes.

A request concerning an online customer support record should include enough information for Halali to identify the relevant account or conversation. Where eligible customer support information is held by Sobot on Halali's behalf, Halali will coordinate the access, correction or deletion request with Sobot under the DPA. You do not need to contact Sobot's engineering team directly.

We may take reasonable steps to verify your identity before granting access, correction or deletion, and will request only the verification information reasonably needed. We will respond within the period required by applicable law. If we refuse a request, we will explain the reason and available complaint options where required.

The Platform is not intended to be used independently by children under 16. A person under 16 should use the Platform only with the involvement and permission of a parent or legal guardian. We do not knowingly seek personal information from a child under 16 without appropriate permission.

If you believe a child has provided personal information without appropriate permission, please contact us so we can investigate and take reasonable steps, including deletion where appropriate. A parent or guardian may contact us about access, correction or deletion of a child's information, subject to appropriate verification and applicable law.

To request access or correction, request account deletion, raise a privacy concern, or ask a question about this Policy, contact:

Please describe your concern or request and include enough information for us to identify the relevant account or records. Do not send identity documents, passwords, verification codes or unnecessary sensitive information unless we ask for them through an appropriate channel.

We will acknowledge and investigate privacy complaints fairly and aim to provide a substantive response within 30 days. If you are not satisfied with our response, or we have not responded within a reasonable time, you may contact the OAIC.

OAIC privacy complaint information: www.oaic.gov.au/privacy/privacy-complaints

The Platform may contain links to merchant sites, payment services, social media, maps or other third-party services. Information you provide directly to an independent third party is handled under that third party's own privacy notice and terms. We encourage you to review those notices before providing personal information directly to a third party.

Where a third party acts as a service provider processing information on Halali's behalf, our contractual and operational arrangements are intended to limit processing to the relevant service purposes and require appropriate security and confidentiality measures. This includes Sobot's processing under the DPA described in section 8.1.

We may update this Policy to reflect changes to our services, technology, service-provider categories, processing locations, legal obligations or privacy practices. We will post the updated version on the Platform and change the "Last Updated" date.

If a change is material, we will provide additional notice where appropriate or required, such as through an in-app message, website notice or email. If a new use requires consent, we will seek that consent rather than relying only on an updated Policy.

This Policy does not limit any rights or remedies available to you under applicable law.

Questions about privacy? Email support@halali.co with the subject "Privacy Request".