How Haaameem handles your data

How each type of information is used

This table summarises the main purposes, UK GDPR Article 6 lawful bases, recipient categories and retention criteria. More than one basis can apply to the same record.

Information we collect

• Account and profile details such as your name, phone number, email address, date of birth, profile photo, gender, and other profile information you choose to provide.
• Location data when you grant permission so we can show nearby events, estimate distance, improve local recommendations, and support location-based features.
• Event and booking information such as tickets, RSVPs, waitlists, organiser submissions, reviews, support messages, and your activity inside the app.
• For new event charity links, we record the charity selected from our list or the name and HTTPS website entered by the organiser, the linked event and organiser, and any event review or moderation record. We do not receive donation amounts, payment status, receipts, refunds or payout information from a charity website.
• Chat and community data when you use in-app messaging or event chat features.
• Payment and transaction information for paid bookings. Payments are processed by Stripe. We do not store full payment card details on our own servers.
• Media you choose to upload, including profile images, event images, or other content submitted through the app.
• Device, diagnostic, and usage information such as push notification tokens, app performance data, crash data, and general analytics needed to operate, secure, and improve the service.
• Waiting-list contact details: attendee email; organiser name and email plus any optional phone number, organisation, city, and plans you provide. We also record whether you separately chose to receive marketing, the consent wording version, and the time of that choice.

How we use information

• To create and manage your account and authenticate you securely.
• To let you discover, book, host, manage, and attend events.
• To personalise the app using your interests, location when permitted, event activity and settings, including nearby listings and relevant notifications. We do not infer religion for recommendations.
• To process payments, confirm bookings, send receipts, and support organiser payouts where applicable.
• To display and review optional charity links supplied by organisers.
• To send service messages, safety notices, moderation actions, account updates, and push notifications you opt in to receive.
• To send launch news, event updates, and community opportunities by email only when you separately choose to receive marketing. Joining the waiting list does not require this choice.
• To protect users, enforce our policies, investigate misuse, and maintain the safety and integrity of the platform.
• To monitor performance, fix bugs, analyse product usage, and improve Haaameem over time.

Why we are allowed to use your information

• We use account, booking and payment information to provide the services you request and perform our contract with you, including issuing tickets, administering your account and handling cancellations.
• We rely on our legitimate interests in keeping Haaameem secure, preventing fraud and misuse, handling support and complaints, and maintaining a reliable service. We consider your rights and the impact on you when relying on these interests; you may object by contacting us.
• Where we must retain records or disclose information to meet a legal obligation, we rely on that obligation. We use your separate consent for promotional emails and optional event alerts; account signup, accepting Terms and acknowledging this notice do not give marketing consent.
• Location is used with your device permission to provide nearby discovery. Account and event preferences are used to provide the service you request. We do not use information that may reveal religious beliefs for third-party advertising.

Signup email and marketing choices

• We collect an email address during account signup for your tickets, booking and refund updates, account administration, security and support. These service messages are separate from promotional emails.
• Joining the waiting list or providing your signup email does not automatically subscribe you to marketing. Where we offer a marketing subscription, it is a separate optional choice. You can use Haaameem without choosing marketing.
• If you choose marketing, we record your choice, when it was made and the version of the subscription wording. You can unsubscribe using the link in a marketing email or contact contact@haaameem.com. We stop promotional emails to the unsubscribed address; essential account, booking, refund and safety messages can continue.
• We retain the minimum information needed to record your consent or withdrawal and avoid adding an unsubscribed address back to a marketing list. Unsubscribing does not delete your account or cancel your bookings. You can separately ask us to stop waiting-list contact or request account closure.

Optional event choices and event alerts

• After signing in, you can choose a city and up to three event interests for your account. We store your choices, their source, submission and confirmation times, and the version of the collection notice. This form does not request precise location or contact details.
• Event choices belong to your signed-in account. Guest survey answers are separate and are never transferred into your account. These choices do not change your profile interests.
• Guests can answer a separate anonymous city and interests survey without signing in. Survey rows contain a random submission ID, city, interests and submission day, without an account ID, installation ID, notification token or campaign identifier. Pending answers are kept locally for retry and cleared after submission. We retain these survey rows for 90 days; counts represent submissions, not verified unique people. Anonymous answers cannot be used to target a device or edited through an account.
• Authorised staff see counts by city and interest to help recruit relevant organisers. We do not share individual responses or contact details with organisers through this report. A response does not book an event or promise attendance.
• You can edit or remove your choices in the app. We remove choices after 90 days without a deliberate confirmation.
• Our notification opt-in explains optional event recommendations and invitations alongside service notifications. We record your notification token, device verification, consent version and time, latest reported device permission, and any withdrawal. Saving choices or allowing device notifications alone does not subscribe you.
• Promotional notifications can include relevant events and occasional invitations to share interests or organise an event. You can turn promotional notifications off in notification settings, including the controls available to guests. Removing choices does not automatically turn off alerts, and turning off alerts does not cancel bookings.
• We record campaign delivery results and aggregate notification-open and preference-submission counts. We do not link an anonymous survey answer to a campaign or account. A provider accepting a notification does not prove that you viewed it. These records help us inspect failures and prevent repeated messages.

App activity measurements

• We use our existing New Relic monitoring to measure basic app activity, including app launches, successful discovery, event openings, signup starts, preference-form openings and campaign openings. Backend monitoring also counts accepted preference submissions and campaign delivery results. These are activity counts, not a linked campaign-conversion history.
• The added activity measurements do not include your city or interest answers, notification tokens, authentication credentials, or account, installation, campaign-recipient or survey-submission identifiers. Existing monitoring can still include its usual app, device, session and account context. Anonymous survey records remain separate; this does not mean all monitoring is anonymous.
• We keep store acquisition reports separate from app activity. Apple and Google reports can arrive late. We do not use store reports to identify which individual downloaded the app.

How we share information

• With service providers that help us run the platform, including hosting and database providers, Expo and Apple or Google services for notifications and mobile features, Stream for chat, Cloudflare R2 for uploaded media, Resend and Twilio for communications, New Relic and Vercel for diagnostics or website analytics, and map providers for location features.
• With Stripe and related payment partners to process transactions, verify organisers, and support billing or payout operations.
• When you choose to open a charity’s external website, you leave Haaameem. The charity website collects and uses information under its own privacy policy; Haaameem does not receive the donation payment or receipt data from that site.
• With organisers and attendees as needed for event participation, ticketing, community features, and support.
• When required by law, regulation, legal process, or to protect the rights, safety, and security of Haaameem, our users, or the public.
• As part of a business transfer such as a merger, acquisition, financing, or asset sale, subject to applicable law.

Where information is processed

• Haaameem uses providers that may process information outside the United Kingdom, including backend hosting in the United States. Provider locations can differ between hosting, payments, communications and diagnostics.
• The safeguard depends on the provider and transfer. Where applicable, Haaameem relies on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework. Where contractual safeguards are required, provider terms may incorporate the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement.
• Contact contact@haaameem.com for information about the countries and safeguard relevant to your data, and how to obtain a copy. This notice does not ask you to give blanket consent to international transfers.

Permissions and sensitive data

• Location permission is used to show nearby events, improve discovery, and support location-based features.
• Notification permission allows booking updates, organiser alerts, reminders, and other service-related notifications. Our notification opt-in also explains optional event recommendations and invitations; you can disable promotional notifications in the app.
• Camera or photo access may be requested when you scan tickets, upload profile photos, or add event media.
• We ask for access only when a feature requires it, and you can manage many permissions from your device settings.
• Event interests, attendance and information you share in profiles, reviews or chats may reveal sensitive information, including religious beliefs. Consider what you choose to share with other users. Haaameem does not infer a user’s religion from this information or use an inferred religion to profile or treat users differently. Using Haaameem does not establish any person’s religion.

Data retention

• Account, profile, event, booking and community information is kept while the account or related service is active and then deleted or anonymised when it is no longer needed, subject to the exceptions below.
• When an account is deleted, the main account and linked profile, event and booking records are removed from Haaameem’s database. Payment and refund records may be retained without the deleted account link where needed for accounting, disputes, fraud prevention or legal obligations.
• Payment, refund and payout records are normally retained for six years from the end of the relevant company financial year. They may be kept longer for an active enquiry, dispute or legal obligation.
• Charity link records are kept while the event is listed and as needed for moderation or disputes.
• Uploaded media and chat information handled by service providers may require separate removal and may take additional time to delete. If an automated provider deletion fails, Haaameem must complete or verify the removal through its support process.
• Support requests are normally retained for two years after closure. Safety reports, moderation cases, complaints and appeals are normally retained for three years after closure. Security and production-access logs are normally retained for twelve months. A record may be kept longer for an active dispute, investigation, safeguarding need or legal hold.
• Marketing consent and withdrawal records are kept as long as needed to honour the choice and prevent an unsubscribed address from being added back to marketing.
• We respond to verified data-rights requests without undue delay and normally within one calendar month. This is a response deadline, not a period for which we automatically keep a deleted account.

How we protect information

• Haaameem uses account authentication and role-based access controls. Production access is limited to authorised developers and business owners who need it to operate, support or secure the service.
• We use encrypted HTTPS connections for data sent between supported apps, browsers and our production services, and keep service credentials in restricted configuration rather than public website or app content.
• No online service can guarantee absolute security. If you believe your account or personal information is at risk, contact contact@haaameem.com promptly and do not send passwords or verification codes.

Your choices

• You can review and update parts of your profile within the app.
• You can disable location or notification permissions through your device settings, though some features may stop working properly.
• You can submit an account-deletion request at any time in the app or through the deletion link below. We may need to verify ownership and may delay final closure while there is an active event, unfinished refund, open dispute or legal retention duty. Past bookings alone do not prevent deletion. Required payment and refund records are retained separately from the deleted account. We remove or anonymise information that is no longer needed and retain only records justified by the purposes described in this notice.
• You have the right to object to direct marketing at any time. You can withdraw marketing consent at any time by using the unsubscribe link in a marketing email or contacting us. Withdrawing marketing consent does not remove you from the waiting list unless you also ask us to stop waiting-list contact.
• Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability of your information, and object to its use. You can object to direct marketing at any time.
• Contact us using the details below to exercise your rights. We may need information to verify your identity before releasing personal information or acting on a request; never send us your password or verification code.
• Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. Device permissions and acknowledging this notice are not blanket consent to all processing.

Age requirement

• Haaameem is intended only for people aged 18 or over. You must be at least 18 years old to create or use an account, and you are responsible for providing an accurate date of birth and complying with this requirement. Individual events may have additional age or attendance restrictions set by their organiser. If you have concerns about a user’s age or information, contact us using the details below.

Changes to this policy

• We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and may provide additional notice where required.

Contact us

If you have privacy questions, data requests, or concerns about this policy, contact us at contact@haaameem.com.

You can request account deletion online or use our privacy request and complaint form or complain to the Information Commissioner’s Office (ICO).

YAZ360DIGITAL LTD, trading as Haaameem · Company number 13414883 · Registered office: 18 Laburnum Avenue, Bedford, England, MK40 4HQ