Privacy Policy

1. Introduction

Welcome to Halzio. Halzio Ltd (“Halzio”, “we”, “us”, or “our”) operates an online grocery ordering and home delivery platform, connecting customers with grocery chains and supermarket partners across Scotland and the wider UK. Our platform is accessible via our website and mobile application.

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our services as a customer or grocery partner. By using the Halzio platform, you agree to the practices described in this Policy. If you do not agree, please discontinue use of our services.

Halzio is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who We Are

Halzio Ltd is the data controller for personal data collected through our platform.

If you have any questions about how we handle your personal data, please contact us using the details above.

3. Data We Collect

3.1 Information You Provide

• Account registration data: name, email address, phone number, and password
• Delivery addresses saved to your account
• Payment information — processed securely by our third-party payment provider; we do not store full card details
• Grocery preferences, dietary requirements, and substitution preferences
• Communications with our customer support team
• Reviews, ratings, and feedback you submit about grocery partners or the platform

3.2 Information Collected Automatically

• Device information: device type, operating system, browser type, and IP address
• Location data: GPS location when you enable location services, used to identify available grocery partners and facilitate delivery
• Usage data: pages visited, products browsed, search queries, basket contents, time spent, and click behaviour
• Order history, purchase patterns, and product preferences
• Cookies and similar tracking technologies (see Section 11)

3.3 Information from Third Parties

• Social login providers (e.g. Google, Apple) if you sign in via these services
• Payment processors and fraud detection providers
• Marketing and analytics partners
• Grocery partners who may share fulfilment-related information such as stock availability or substitution decisions

4. How We Use Your Data

4.1 To Provide Our Services

• Creating and managing your Halzio account
• Processing grocery orders, payments, and refunds
• Sharing your order details and delivery address with the relevant grocery partner and delivery personnel
• Communicating order status, ETAs, substitution notifications, and out-of-stock alerts via app, SMS, and email
• Enabling customer support, refunds, and dispute resolution

4.2 To Improve Our Platform

• Analysing purchasing patterns and usage data to enhance product recommendations and search results
• Improving delivery routing and slot availability
• Conducting research, testing, and product development

4.3 For Safety and Security

• Detecting and preventing fraud, abuse, and unauthorised account access
• Monitoring for suspicious purchasing behaviour or payment anomalies
• Complying with legal and regulatory obligations

4.4 For Marketing

• Sending personalised offers, promotions, and product recommendations based on your order history (with your consent where required)
• Notifying you of new grocery partners, seasonal deals, or platform features
• Retargeting via third-party advertising platforms

5. Legal Bases for Processing (UK GDPR)

We rely on the following legal bases to process your personal data:

• Contract performance — processing necessary to fulfil your grocery order and deliver our services
• Legitimate interests — fraud prevention, platform improvement, delivery optimisation, and direct marketing where a balancing test has been carried out
• Legal obligation — compliance with tax, financial, food safety, and regulatory requirements
• Consent — marketing communications, non-essential cookies, and any profiling based on dietary or health-related preferences, where you have opted in

6. How We Share Your Data

We do not sell your personal data. We share it only in the following circumstances:

6.1 With Service Providers

• Payment processors to handle transactions securely
• Cloud hosting and infrastructure providers
• Customer support and communication platforms
• Analytics, performance monitoring, and crash reporting tools
• SMS and push notification providers

6.2 With Grocery Partners and Delivery Personnel

We share your name, delivery address, order details, and contact number with the relevant grocery partner and delivery personnel solely for the purpose of fulfilling your order. Grocery partners act as independent controllers in respect of any data they separately hold about you.

6.3 For Legal Reasons

We may disclose your data if required by law, court order, or regulatory authority, or to protect the rights, safety, and property of Halzio, our users, or the public.

6.4 Business Transfers

If Halzio is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you via email or prominent in-app notice before any such transfer takes effect.

7. International Data Transfers

Halzio is based in Scotland and primarily processes your data within the UK. Where any of our service providers operate outside the UK, we ensure appropriate safeguards are in place, including UK adequacy regulations, International Data Transfer Agreements (IDTAs), or Standard Contractual Clauses approved by the ICO.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy, or as required by law:

• Account data: retained for the duration of your account, and up to 6 years after closure for legal and tax compliance
• Order and transaction history: retained for 7 years in line with HMRC financial record-keeping obligations
• Location data: retained for up to 90 days after order completion
• Marketing preferences and consent records: retained until you withdraw consent, plus 1 year thereafter
• Customer support communications: retained for up to 3 years
• Fraud and security logs: retained for up to 6 years

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data in certain circumstances
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making — we do not make solely automated decisions with a legal or significant effect on you without human review

To exercise any of these rights, contact us at support@halzio.com or through Settings → Privacy in the Halzio app. We will respond within one calendar month. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

10. Children's Privacy

The Halzio platform is not directed at children under the age of 13 and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact support@halzio.com and we will take prompt steps to delete the information.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Halzio platform. Cookies fall into the following categories:

• Strictly necessary cookies — essential for the platform to function, including session management, login authentication, and basket retention
• Performance and analytics cookies — help us understand how users interact with the platform
• Functional cookies — remember your preferences such as saved addresses, preferred delivery slots, and language settings
• Marketing and targeting cookies — used to deliver relevant adverts and personalised promotions on third-party platforms

You can manage your cookie preferences at any time via Cookie Settings in the app or website footer. Disabling certain cookies may affect platform functionality.

12. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and staff data handling training
• Regular security assessments and vulnerability testing
• Pseudonymisation and data minimisation practices
• Secure payment processing via PCI-DSS compliant providers

No method of data transmission over the internet is completely secure. If you suspect your account has been compromised, please contact us immediately at support@halzio.com or call 01506538550.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or via an in-app notification at least 14 days before the changes take effect. The current version will always be available on our website and app.

Your continued use of the Halzio platform after the effective date constitutes acknowledgment of the updated Policy.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us: