Download PDF

GDPR Compliance Statement

Data protection is our duty — and our Amanah.

Effective Date: 20 October 2026•Version: 1.0•Last Updated: 20 October 2026

1. Introduction

This GDPR Compliance Statement explains how HalalSpark Ltd ("we", "us", "our") ensures that all personal data is handled in compliance with the UK General Data Protection Regulation (UK GDPR), EU GDPR (where applicable), and the Data Protection Act 2018.

HalalSpark Ltd (Company No. 16533046)
83 Ruskin Avenue, Southend-on-Sea, SS2 5HB, UK
[email protected]

HalalSpark acts as Data Controller for user data (advertisers, publishers, and general accounts).

2. Our Commitment to Data Protection

"At HalalSpark, privacy isn't just a legal obligation — it's a moral one. We treat your data with honesty (Sidq), trust (Amanah), and respect (Adab)."

HalalSpark follows all UK GDPR principles:

Lawfulness, fairness, and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality
Accountability

These principles guide all business operations, product design, and partnerships.

3. Lawful Bases for Processing

Purpose	Lawful Basis
Account registration and management	Contractual necessity
Ad delivery and performance reporting	Legitimate interest
Fraud prevention and security	Legitimate interest
Payments and payouts	Contractual necessity
Compliance with tax and financial regulations	Legal obligation
Sending service or policy updates	Legitimate interest
Optional marketing or newsletter communications	Consent

4. Data Categories We Process

Account information (name, email, password hash)
Advertiser data (campaigns, creatives, budgets)
Publisher data (website URLs, categories, earnings)
Payment data (via Stripe — never full card numbers)
Technical data (IP, device type, browser, logs)
Communication data (emails, support tickets)

"All personal data is minimised, encrypted in transit and at rest, and used solely for legitimate service delivery."

5. Data Retention Policy

Data Type	Retention Period
Financial and tax records	6 years
Ad performance data	Campaign duration + 90 days
Publisher earnings data	30 days (post-audit)
Fraud detection logs	30 days
Authentication logs	30 days
Account data	Until deletion request
Deleted accounts	Permanently erased after 60 days

All retention periods are reviewed regularly to ensure compliance and necessity.

6. Data Sharing & Processors

Processor	Purpose	Data Location
Stripe	Payment processing, fraud prevention	EU/UK servers
Supabase	Authentication, database, and file storage	London (AWS)
Vercel	Hosting and performance optimisation	EU region
Resend	Email delivery (verification and notifications)	EU/US region (compliant under SCCs)

All processors have signed data-processing agreements (DPAs) and comply with UK GDPR standards.

7. International Data Transfers

Primary data hosting: London, UK
Where third-party transfers occur outside the UK/EU, HalalSpark uses:
- Adequacy decisions (e.g., EEA countries), or
- Standard Contractual Clauses (SCCs) for lawful transfer
No personal data transferred to non-compliant jurisdictions

8. Security Measures

Encrypted database storage (Supabase + AWS)
HTTPS enforced across all connections
Role-based access control (minimum necessary access)
Regular server monitoring and error logging
Automated fraud detection (privacy-safe)
2FA support for user accounts
Daily encrypted backups

"While no system is infallible, we actively monitor for vulnerabilities and continuously improve our defences."

9. Your Rights as a Data Subject

Right of Access: Request a copy of your data
Right to Rectification: Correct inaccurate or incomplete information
Right to Erasure: Request deletion of your personal data
Right to Restrict Processing: Temporarily limit how your data is used
Right to Data Portability: Request your data in a machine-readable format (CSV/JSON)
Right to Object: Opt out of certain processing (e.g. marketing)
Right to Withdraw Consent: Withdraw consent for optional communications at any time

To exercise your rights, contact [email protected] or [email protected]. We respond to all valid requests within 30 days.

10. Data Protection Officer (DPO) / Contact

HalalSpark does not currently appoint a formal DPO (as not legally required at this stage). However, all privacy matters are overseen by the founder.

You can contact [email protected] or [email protected] for GDPR-related concerns.

Users may also contact the Information Commissioner's Office (ICO) if dissatisfied with how their data is handled:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: https://ico.org.uk

11. Privacy by Design & Default

"HalalSpark builds privacy protection into every product and feature from the start — not as an afterthought. We use minimal data, secure storage, and clear user controls to uphold the principle of Privacy by Design and Default."

12. Breach Notification

In the unlikely event of a personal data breach, HalalSpark will notify the ICO within 72 hours and affected users without undue delay, in accordance with UK GDPR Articles 33 and 34.

13. Islamic Values in Data Protection

"Data stewardship is part of our Islamic ethics — protecting user information is an act of Amanah (trust). We see privacy as both a legal responsibility and a spiritual one."

14. Updates to This Statement

Policy reviewed regularly and updated when laws or internal practices change
Latest version always displayed on this page with updated date
Major updates communicated via dashboard or email

15. Contact Us

HalalSpark Ltd
83 Ruskin Avenue, Southend-on-Sea, SS2 5HB, UK

📧 [email protected]

"Protecting your data is part of our faith and our promise. If you ever have concerns, contact us directly — we'll respond transparently and swiftly."