Privacy Policy
Effective date: 2026-05-03
Halal Passport (operated by HARA) is a complementary trust + interoperability layer for national halal certification systems. This policy explains what personal data we collect, why, and your rights under GDPR (EU), UU PDP No. 27/2022 (Indonesia), and Komdigi PSE registration obligations.
What we collect
- Account data — email, name, title, organisation (only for operator accounts: BPJPH staff, producers, importers, HARA staff)
- Session cookies — httpOnly identifier; locale preference (hp_locale)
- Audit log — every state-changing action (approve, revoke, sign in) is hash-chained to detect tampering. Required by Indonesian halal regulation.
- Api usage — last-used timestamp on API keys
- Consumer scans — anonymous; we do not link QR scans to individual identity. IP-based rate limiting only, no profile.
Legal basis (GDPR Art. 6 / UU PDP Pasal 20)
- Operator accounts — contractual necessity (you sign in to do your job)
- Audit logs — legal obligation (UU 33/2014 + Komdigi PSE record-keeping)
- Consumer verification — legitimate interest (delivering tamper-proof halal verification on demand)
Your rights
- Access — download all your data via /api/v1/me/data
- Erasure — POST /api/v1/me/delete with email confirmation. We anonymise rather than hard-delete because hash-chained audit references must persist (UU PDP Pasal 30 mandates 5-year retention of transaction logs).
- Rectification — update via /portal/settings, /console/settings, etc.
- Portability — the data export is machine-readable JSON
- Withdraw consent — sign out and delete account; future scans remain anonymous
Retention
- Active operator accounts — kept until deletion request
- Sessions — cleared on sign-out; auto-expire after 7 days
- Audit log — 5 years per UU PDP Pasal 30; hash-chain prevents deletion of individual entries
- Halal certificates + passport records — indefinitely (legal source-of-truth artifacts)
- API key usage logs — 90 days
- Producer KYC dossier — kept while the producer is active; removed with the producer account
- Importer records — retained while linked to active import orders
- Field-officer personal data — anonymized 3 years after a record is revoked and dormant
Data residency (Komdigi PSE)
Personal data of Indonesian users is stored in Indonesia (Postgres in Jakarta data centre when deployed to production). The blockchain anchor (Polygon) is public infrastructure and contains only cryptographic hashes, not personal data — it is an optional mirror, off by default. Map tile composition uses OpenStreetMap with caching to limit cross-border data transfer. Sub-processors: Numira (optional single sign-on identity provider — stores a stable subject identifier when you link an account); Mapbox (only if map rendering is enabled, receives map coordinates to render tiles, otherwise OpenStreetMap is used). No advertising or analytics trackers are used.
Contact
Data Protection Officer: dpo@hara.ag · For Komdigi PSE inquiries (24-hour response per Pasal 27): pse-contact@hara.ag · For breach notifications (72-hour window per UU PDP Pasal 46): security@hara.ag