Privacy Policy
Effective date: 1 November 2026
1. Who we are
Halas is operated by Halas Fintech For Computer Systems & Communication Equipment Software Design CO. L.L.C S.O.C, a Dubai mainland single-owner limited liability company, commercial licence number 1663741, licensed by the Dubai Department of Economy and Tourism ("Halas", "we", "us" or "our").
Registered address: Office 1503-118, AL MUSALLA TOWER, Al Hamriya, Bur Dubai, Dubai, United Arab Emirates.
Privacy contact: the contact details in the Contact section at the end of this document.
This Policy explains how we process personal data through the Halas website, merchant accounts and dashboard, QR/NFC links, order and checkout interfaces, and support channels (the "Service"). It covers only the functions you actually use. A payment feature is available only when expressly enabled; this Policy does not represent that payment processing is currently offered or that any particular provider has been appointed.
2. Our role and the roles of others
We act as a controller when we decide why and how personal data is used for our own services, such as account administration, security and support. When we process customer data solely on a merchant's documented instructions, we act as a processor under an applicable data processing agreement. Our role depends on the processing activity, rather than merely on which interface you use.
Merchants separately determine how they use information for their sales and customer relationships. Banks, acquirers, payment service providers and open-finance providers may process data as independent controllers under their own notices. Their identities and applicable terms must be made available in the relevant onboarding or payment journey. This Policy does not replace those notices.
3. Information we collect
Depending on the service you use, we may collect:
- Account and contact information: name, email address, telephone number, language, account identifiers and communications preferences.
- Merchant and representative information: business name, licence, business address, authorised representative details, and onboarding records. Identity or beneficial-owner documents are collected only where required for the relevant onboarding process; providers may collect them directly.
- Order and payment metadata: merchant, order reference, amount, currency, timestamp, payment method, status, provider transaction reference, refund or dispute status, and limited masked payment information returned by a provider.
- Technical and security information: IP address, device and browser information, application version, session and error logs, authentication events and fraud indicators.
- Support information: enquiries, correspondence, feedback and attachments you send us.
- Cookie information: as explained below.
We receive information from you, your device, participating merchants and relevant service providers. We request only information needed for the relevant function. Required fields are identified when collected; if they are not provided, we may be unable to provide that function.
Do not send banking passwords, PINs, one-time authentication codes or complete card details to Halas by email or support message. If a payment feature is enabled, enter authentication information only in its designated secure flow.
4. Purposes and legal grounds
We process personal data only where an applicable legal ground permits it. Depending on the activity, this may be your consent, necessity to perform or enter into a contract with you, compliance with a legal obligation, establishment or defence of legal claims, or another exception expressly available under applicable law.
| Purpose | Typical information | Applicable basis, depending on circumstances |
|---|---|---|
| Create accounts and provide requested services | Account, contact, merchant and order information | Contract necessity, or consent where required |
| Facilitate payment requests, status updates, receipts and refunds | Order and payment metadata | Contract necessity or another applicable statutory exception; provider authorisation remains separate |
| Protect accounts, prevent abuse and investigate incidents | Technical logs and transaction indicators | Relevant legal obligation or statutory exception; consent where required |
| Respond to support enquiries | Contact details, messages and relevant records | Contract necessity or consent |
| Comply with lawful requests and defend claims | Records relevant to the request or claim | Legal obligation or applicable legal-claims exception |
| Service usage analysis and improvement | Technical and usage information, minimised or aggregated where possible | Consent where required, or another specifically applicable statutory exception |
Acceptance of our Terms does not constitute consent to all data processing. We do not rely on a general assumption that a commercial interest automatically permits processing under UAE law. Where processing relies on consent, we seek a specific, informed and affirmative choice and provide a way to withdraw it.
5. Payments and bank connections
Halas provides technology interfaces and payment orchestration. Under the service model covered by this Policy, Halas does not hold, pool, transmit or settle customer funds. Regulated payment functions are performed by the relevant authorised providers under their own agreements.
We share the information necessary to route a request, retrieve a status or support a transaction. A bank or open-finance provider may request separate consent for bank access or payment initiation. That consent specifies its scope and duration. Connecting a bank account or making a payment does not authorise advertising use of bank or payment data.
We do not request online-banking passwords or authentication codes for storage in Halas accounts. Any payment token, account identifier or masked card information received from a provider is used only for the relevant authorised service.
6. Cookies and similar technologies
We use essential cookies and similar storage to operate requested functions, maintain sessions, protect security and remember necessary choices. Functional storage may remember your selected language. Session storage normally ends with the session; persistent storage remains until it expires or is deleted.
Any non-essential analytics or tracking requiring consent will be used only after that consent is obtained. You can manage stored cookies through browser settings and any consent controls shown in the Service. Blocking essential cookies may prevent some functions from working. You may contact us for information about the technologies used. We do not use payment or order information for advertising targeting or sell personal data.
7. Who receives information
We disclose information only as necessary and legally permitted to:
- the merchant involved in your transaction;
- the bank, acquirer, payment or open-finance provider involved in the requested service;
- contracted hosting, security, communications, support or analytics suppliers, subject to appropriate restrictions;
- professional advisers, competent authorities or courts where legally required or necessary for a permitted legal purpose; and
- a successor in a genuine corporate transaction, subject to lawful safeguards, confidentiality and any required notice.
A merchant cannot use this Policy as permission to access another merchant's customers or transaction records. Consumer purchase and payment information must not be repurposed for promotional use where prohibited by law.
8. International processing
Suppliers may process data outside the UAE. Before a transfer, we assess applicable restrictions and implement a transfer mechanism permitted by UAE law, such as an applicable adequacy route or legally recognised contractual and organisational safeguards. We do not assume that an ordinary supplier contract alone satisfies every transfer requirement. Information about relevant destinations and safeguards can be requested from our privacy contact.
9. Retention and deletion
We keep personal data only for as long as needed for the stated purpose or an applicable legal requirement. Account data is retained while an account is active and for a justified closure period. Transaction and business records may be retained for mandatory accounting, tax, dispute or provider requirements. Security logs and support records follow purpose-specific schedules. Consent records are retained as necessary to demonstrate and honour your choices.
Closing an account does not automatically erase records that must lawfully be retained. We restrict retained records to their permitted purpose. Deleted data is removed from active systems and expires from backups under a documented rotation schedule unless preservation is legally required. You may request the applicable retention criteria or an explanation of a specific refusal to erase data.
10. Security and incident response
We use reasonable technical and organisational controls appropriate to the data and risks, including access restrictions, protected transmission, supplier oversight and incident procedures. No system is completely secure. If a personal-data breach triggers notification obligations, we notify the competent authority and affected individuals as required by applicable law.
11. Your rights
Subject to applicable law and exceptions, you may request information about processing, access and a copy of your data, correction, erasure, restriction or cessation of processing, portability where applicable, and withdrawal of consent. You may also raise objections to direct marketing or qualifying automated processing and request applicable human review.
Contact the contact details in the Contact section at the end of this document. We may request proportionate identity verification and will respond within the applicable legal timeframe. We will explain any lawful limitation. Withdrawal does not affect processing lawfully carried out beforehand. You may complain to the UAE Data Office or other competent supervisory authority where applicable; contacting us first is optional.
For data a merchant or payment provider controls, contact that organisation. We will help route requests where appropriate.
12. Children
Halas accounts are intended for adults aged 18 or over who have legal capacity. We do not knowingly collect children's data for accounts. Contact us if you believe a child has provided information so that we can investigate and take appropriate action.
13. Changes and contact
We publish revisions with a new effective date and provide additional notice for material changes where appropriate. New purposes requiring consent are not introduced merely by updating this Policy.
Privacy contact: the contact details in the Contact section at the end of this document.
Postal address: Office 1503-118, AL MUSALLA TOWER, Al Hamriya, Bur Dubai, Dubai, UAE.
Contact
For privacy enquiries, support, account closure or other requests, email kenwang@halasfintech.com.