Privacy

Your information should stay useful, controlled, and appropriately protected.

HalalProcurement.com is designed for business procurement workflows. We collect the information needed to operate the service, respond to demo requests, and support customer accounts.

This page is intended to explain, in plain language, the kinds of information that may pass through the platform and the operational reasons that information is used. Because customer deployments, hosting arrangements, and contractual terms may differ, this summary should be read together with any commercial agreement, implementation scope, or internal governance requirements that apply to your organization.

What we collect

We may collect business contact details, organization names, supplier records, procurement notes, uploaded compliance documents, and system activity needed to provide the service.

This can include names, work email addresses, phone numbers, organizational roles, sourcing request details, supplier profiles, quote comparisons, approval notes, document metadata, expiry dates, issuer verification references, workflow history, and limited technical information generated through normal product use.

Depending on how the platform is configured, information may also include user-entered comments, evidence summaries, approval rationales, escalation notes, uploaded attachments, communication history related to sourcing or compliance review, and structured or unstructured records created through daily operational use.

How we use it

We use submitted information to run the product, review requests, support users, improve reliability, and maintain auditability for procurement and compliance workflows.

Information may also be used to authenticate users, deliver system notifications, troubleshoot issues, respond to support requests, detect misuse, maintain data integrity, and improve the usability of procurement, compliance, and decision-review features over time.

In practical terms, this means information is used to power workflow routing, maintain historical traceability, show the current state of sourcing and compliance tasks, support follow-up review, and preserve the operational context needed for teams to understand why a particular decision or status exists inside the system.

How we handle it

Information is handled as confidential business data and should only be uploaded when your organization is authorized to share it. Access should remain limited to approved users within your workspace.

We aim to limit access to information to the people and systems required to operate the service, support authorized users, and maintain the product environment. Administrative, technical, and workflow controls should be used to reduce the risk of unauthorized disclosure, unintended sharing, or accidental modification.

Account and access controls

Workspace administrators are expected to manage user access carefully, assign roles appropriately, and remove access when it is no longer required. Each organization should review who can see sourcing records, uploaded documents, review history, and supplier-sensitive materials.

Role assignment should reflect actual job responsibility. Organizations should review access periodically, especially when teams change, external reviewers are added, or procurement and compliance duties are redistributed. The effectiveness of any privacy or confidentiality practice depends in part on disciplined account administration by the customer.

Documents and business records

Documents uploaded to the platform may contain commercially sensitive or compliance-sensitive information. Customers should avoid uploading materials they are not permitted to store, review, or distribute through the service, and should apply their own internal review standards before relying on stored records for commercial or regulatory decisions.

Customers should also consider whether supplier submissions, certificates, declarations, product specifications, contracts, or supporting evidence contain restrictions on handling or onward sharing. Where information is especially sensitive, organizations should use appropriate approval controls, review discipline, and internal training to reduce avoidable exposure.

Operational monitoring

To preserve system reliability and accountability, the platform may retain workflow events, login activity, document actions, and other operational records needed for troubleshooting, abuse prevention, audit support, and service administration.

Operational records may also help explain system behavior, investigate suspected misuse, confirm whether an action occurred, or reconstruct the history of an important workflow event. Such monitoring is intended to support secure and accountable system operation rather than to expand customer-facing use of information beyond legitimate service needs.

Third-party services

Some workflows may involve supporting infrastructure or integrated services used for hosting, email delivery, document handling, or communications. Where such services are used, information may be processed to the extent reasonably necessary to provide the requested functionality.

Customers should understand that certain operational functions, such as sending notifications, processing uploads, or supporting service delivery, may depend on third-party infrastructure. The use of such providers does not change the expectation that information should be handled with appropriate care, but it may affect where and how supporting operations occur.

Cookies and session technologies

The service may use session identifiers, security tokens, and similar technical mechanisms needed to maintain authenticated use, preserve form state, protect against unauthorized actions, and support normal operation of browser-based workflows. These mechanisms are used primarily for service functionality and account security.

Accuracy and customer review

Because much of the information in the platform is provided by users, suppliers, or internal reviewers, customers are responsible for reviewing important records for completeness and accuracy. The presence of information in the system does not, by itself, guarantee that the information is current, verified, or appropriate for a final business decision.

Retention and removal

Information may be retained for as long as needed to provide the service, maintain operational continuity, support legitimate business records, satisfy contractual expectations, or address security and audit needs. Retention periods may vary depending on deployment model, customer workflow, and administrative settings.

In some cases, historical workflow records may need to remain available even after a specific business process is no longer active, particularly where procurement decisions, document reviews, or approval histories must be preserved for internal accountability or later reference.

International and organizational considerations

Procurement and halal compliance workflows may involve multiple countries, suppliers, issuers, and review teams. Customers are responsible for understanding any cross-border, confidentiality, procurement, or sector-specific obligations that apply to the information they choose to place in the platform.

Organizations operating across jurisdictions should assess whether local requirements affect document handling, user access, retention expectations, or review workflows. This is particularly important where imported goods, certification evidence, supplier identity records, or sensitive commercial comparisons are managed across more than one region.

Updates to this notice

This privacy content may be revised from time to time as the service matures, operational practices change, or additional clarity becomes useful. Updated language may reflect changes to product features, workflow structure, or supporting operational processes.

Questions and formal requirements

If your organization requires detailed privacy schedules, bespoke security commitments, or formal data-processing language, those matters should be addressed through the relevant commercial, legal, or implementation documentation rather than relying solely on this summary page.

Your responsibility

Your organization remains responsible for internal approval, retention, and disclosure requirements for any data entered into the platform.

If you need legally binding privacy commitments, security schedules, or data-processing terms, those should be addressed through the appropriate commercial and legal documentation for your deployment.