Hala Lebanese Privacy Policy

Last updated: August 2026

Hala Lebanese (“Hala Lebanese”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, place an order, make a booking, create an account, communicate with us or otherwise use our services.

Hala Lebanese is the data controller responsible for the personal data covered by this Privacy Policy.

Our online ordering platform and related customer management services are provided by OrderSense Ltd (“OrderSense”). OrderSense processes certain personal data on our behalf and in accordance with our documented instructions, and acts as our data processor for those activities.

OrderSense may provide technology and operational services to us, including online ordering, customer account management, order management and, where instructed by us, customer communications and marketing campaign management.

Hala Lebanese remains responsible for determining the purposes for which your personal data is processed and how it is used for our customer and marketing activities.

1. Information we collect

Depending on how you interact with us, we may collect the following information:

Order and booking information

This may include your name, telephone number, email address, delivery address, order details, booking details, items ordered, special instructions and other information you provide when placing an order or making a booking.

Customer account information

If you create an account, we may collect your name, contact details, login credentials, order history, saved preferences and other information associated with your account.

Passwords are stored using appropriate security measures and are not stored by us in plain text.

Marketing preferences

We may record whether you have agreed to receive marketing communications from us, the communication method you have selected, and information about when and how your preference was obtained.

We may also maintain records of withdrawals of consent and marketing opt-outs so that we can respect your preferences.

Payment information

Payments are processed through our payment service providers.

Hala Lebanese does not normally receive or store your full payment card number. Payment information may be processed directly by the relevant payment service provider in accordance with its own privacy notice and security arrangements.

Technical and usage information

When you use our website, we may collect certain technical information such as IP address, browser type, device information, operating system, website activity and information about how you use our services.

Some of this information may be collected through cookies and similar technologies. Further information is provided in the Cookies section below.

2. How we use your personal data

We use personal data only where we have a lawful basis to do so.

Processing and fulfilling orders

We use your personal data to receive, process, prepare and deliver your orders and to provide related customer support.

Lawful basis: Performance of a contract, or taking steps at your request before entering into a contract.

Managing bookings

Where you make a booking or reservation, we use your personal data to manage and fulfil that booking and communicate with you about it.

Lawful basis: Performance of a contract.

Managing customer accounts

Where you create an account, we use your personal data to establish and manage the account, provide access to your order history and preferences, and provide related services.

Lawful basis: Performance of a contract.

Customer service and communications

We may use your information to respond to enquiries, resolve problems, provide customer support and communicate with you about services you have requested.

Lawful basis: Performance of a contract and, where appropriate, our legitimate interests in providing and administering our services.

Legal and regulatory requirements

We may use and retain information where necessary to comply with legal, tax, accounting, regulatory or other legal obligations.

Lawful basis: Legal obligation.

Fraud, security and service protection

We may process information to detect and prevent fraud, misuse, unauthorised access and other activity that could harm our customers, systems or business. We may also use information to maintain the security, reliability and performance of our website and services.

Lawful basis: Our legitimate interests, where those interests are not overridden by your rights and freedoms.

Marketing

We may use your personal data to send you information about Hala Lebanese, including offers, promotions, new products, events and other news that may be relevant to you.

Where required by law, we will only send marketing communications by email or text message where you have provided the appropriate consent or where a legally permitted exception applies.

Lawful basis: Consent where consent is required. In limited circumstances, we may rely on the lawful basis of legitimate interests where this is permitted by law.

Where electronic marketing is subject to the Privacy and Electronic Communications Regulations (PECR), we will comply with the applicable PECR requirements. This includes obtaining appropriate consent where required or, where applicable, relying on the limited existing-customer “soft opt-in” rules for similar products or services.

3. Marketing communications

Where we ask you to consent to marketing by email or text message, you will be given a clear choice to opt in.

Marketing preferences are requested separately for each communication channel. When you create an account or check out, you are shown two separate, unticked options:

• “Email me offers & news”
• “Text me offers & news”

You may choose one, both or neither. Marketing consent is optional and is not required in order to create an account, place an order or use our services.

You can withdraw your consent or opt out of marketing at any time, and each channel can be turned off on its own from the Marketing preferences section of your account. Every marketing email will include an unsubscribe mechanism, and marketing text messages will include an appropriate opt-out mechanism.

Where you opt out of a particular marketing channel, we will stop sending marketing communications through that channel, subject to any limited lawful processing required to maintain suppression or compliance records.

Withdrawal of marketing consent will not affect communications that are necessary to provide services you have requested, such as order confirmations, booking information, account notifications, security messages or other service-related communications.

OrderSense may operate marketing technology and send communications on our behalf. Where it does so, it acts on our instructions and processes your personal data as our service provider and data processor. Hala Lebanese determines the purpose and content of our marketing campaigns and the customers to whom those campaigns are sent.

4. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some cookies are strictly necessary for the website and ordering service to operate. These are the cookies we use today:

• a session cookie, which keeps your basket, your chosen outlet and your sign-in working as you move between pages;
• a “stay signed in” cookie, set only if you ask us to remember you, so you do not have to sign in on every visit;
• a short-lived cookie recording that you had an order in progress, so that if your session expires we can explain what happened to your basket rather than showing you an empty screen; and
• a short-lived security cookie used only during sign-in with Google, to protect that sign-in against tampering.

We do not use advertising cookies, and we do not run third-party advertising or analytics trackers on this website. We measure how our own site is used through our own systems, using the session described above.

Where we introduce analytics, advertising or other non-essential cookies that require consent, we will ask for your consent before placing those cookies or using the relevant technology.

Web fonts on this site are served by Google, which means your browser contacts Google to download them and Google receives your IP address as part of that request.

You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies will stop the ordering service from working.

5. Who we share your personal data with

We do not sell your personal data.

We may share personal data with organisations where necessary to provide our services, operate our business, comply with legal obligations or protect our rights. These may include:

OrderSense Ltd

OrderSense provides our online ordering platform and related technology and customer management services. OrderSense processes personal data on our behalf and in accordance with our instructions for the services it provides to us.

Payment service providers

Payment service providers process payment transactions and related information where you make a payment through our website or other payment channels.

Delivery providers

Where you request delivery, we may provide relevant information, such as your name, address, telephone number and delivery details, to the delivery provider necessary to complete your order.

Technology and service providers

We may use third-party service providers for hosting, communications, security, analytics, customer support and other technology services where necessary to operate our business. Where these providers process personal data on our behalf, we require appropriate contractual and security arrangements.

Professional advisers and authorities

We may disclose personal data to professional advisers, regulators, law enforcement agencies, courts, government bodies or other authorities where required by law or where necessary to establish, exercise or defend our legal rights.

6. OrderSense and data processing

OrderSense is an important technology and service provider to Hala Lebanese.

For the personal data that OrderSense processes on our behalf, Hala Lebanese remains the data controller and OrderSense acts as our data processor. OrderSense is required to process personal data in accordance with our instructions and applicable data protection requirements.

OrderSense may provide services including:

• online ordering and order management;
• customer account functionality;
• customer data management;
• marketing campaign management where instructed by Hala Lebanese;
• customer communications;
• technical hosting and support; and
• reporting and operational services.

OrderSense does not have unrestricted rights to use Hala Lebanese customer data for its own purposes merely because it provides these services.

Where OrderSense processes data for its own independent purposes, it may act as a separate data controller and its own privacy notice may apply to that processing.

7. International transfers

Some of our technology or service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place as required by applicable data protection law. These safeguards may include an adequacy decision, appropriate contractual safeguards or another legally permitted transfer mechanism.

8. How long we keep your personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, including where necessary to comply with legal, accounting, tax or regulatory requirements.

In determining how long information is retained, we consider factors including:

• the purpose for which the information was collected;
• whether the information is required to provide an ongoing service;
• legal and regulatory requirements;
• potential disputes or legal claims; and
• our legitimate business and security requirements.

Order and transaction records may need to be retained for several years where required for tax, accounting or legal purposes.

Customer account information is generally retained while your account remains active and for an appropriate period afterwards where necessary for legitimate business, legal or security purposes.

Marketing preferences and opt-out information may be retained for as long as necessary to demonstrate compliance and ensure that we respect your marketing choices.

9. Your data protection rights

Depending on the circumstances and the applicable legal requirements, you may have rights including:

• the right to request access to your personal data;
• the right to request correction of inaccurate or incomplete personal data;
• the right to request erasure of your personal data in certain circumstances;
• the right to request restriction of processing in certain circumstances;
• the right to object to certain processing, including certain direct marketing;
• the right to data portability where applicable; and
• the right to withdraw consent where we rely on consent as our lawful basis.

These rights are subject to certain legal conditions and exceptions. For example, we may need to retain particular information where required by law or where necessary to establish, exercise or defend legal claims.

Where we rely on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

10. Exercising your rights

To exercise your rights or ask us a privacy question, please contact:

We may need to verify your identity before responding to certain requests. We will normally respond to valid data protection requests within the time period required by applicable law.

11. Complaints

If you have concerns about how we have handled your personal data, we encourage you to contact us first so that we can investigate and try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office (ICO), which is the UK’s data protection supervisory authority. Information about the ICO and how to make a complaint is available at ico.org.uk.

12. Data security

We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures may include appropriate access controls, authentication, encryption where appropriate, secure systems, monitoring, backups, staff controls and other security measures appropriate to the nature of the information and the risks involved.

No online service can be guaranteed to be completely secure. However, we continually review and improve our security measures where appropriate.

13. Children’s privacy

Our services are intended for general use and are not specifically directed at children. We do not knowingly collect personal data from children where doing so would be unlawful.

If you believe that a child has provided us with personal data unlawfully, please contact us so that we can investigate and take appropriate action.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or the way we process personal data.

The “Last updated” date at the top of this policy indicates when it was most recently updated. Where changes are significant, we may provide additional notice where appropriate.

15. Contact us

For any privacy question, request or concern, please contact: