Purpose
Certification requires operators to disclose formulations, supplier relationships, and process detail that are often highly confidential. This policy explains how HCC safeguards that information and the personal data it processes, and what it deliberately keeps public.
Scope
This policy covers all information that HCC receives, generates, or holds in the course of assessment and certification — client business information, audit records, and personal data of individuals such as client contacts and HCC personnel.
Confidential client information
Information disclosed for the purpose of certification is treated as confidential and used only to assess, issue, and maintain the relevant certificate. It is not sold, shared for marketing, or disclosed to third parties except as set out below.
Access is limited to the auditors, technical reviewers, and Shariah Board members who need it for a specific determination. Confidentiality obligations extend to contractors and remain in force after an engagement ends.
What is public, and why
By design, the existence, scope, status, and validity of a certificate are public through HCC's verification service. This is the basis of the assurance HCC offers buyers and regulators, and operators accept this publication as a condition of certification.
The public record does not expose confidential formulations or commercially sensitive process detail; it confirms what was certified and that it remains valid, not how the product is made.
Personal data and privacy
HCC collects personal data only where there is a legitimate purpose — administering certification, communicating with clients, and meeting legal obligations — and limits collection to what that purpose requires.
Personal data is retained only as long as necessary and is protected by appropriate organisational and technical safeguards. Individuals may request access to, or correction of, their personal data through the contact channel below, subject to applicable law.
Permitted disclosure
HCC may share information with partner Halal authorities and coordination bodies where this is necessary to support recognition of a certificate in a destination market, and with regulators or authorities where required by law.
Such disclosures are limited to what is necessary, and partners are expected to maintain equivalent confidentiality. Disclosure required by law is made only to the extent the law requires.
Implementation, review & contact
This policy is reviewed at least annually and whenever data-protection obligations or partner-network arrangements change. Personnel are trained on their confidentiality duties.
Privacy requests and questions about this policy may be sent to HCC at info@halalcc.org.
Questions about this policy?
Our team can clarify any point or direct your question to the right people at HCC.