Who we are
Halah Social Ltd ("we", "us", "our"), company number 17432277, registered office 8 Duncannon Street, London, WC2N 4JF, trading as Halah Social from the same address.
We are the data controller for the personal data collected through our website and in the course of providing our services. Our ICO registration number is [TO CONFIRM]. If you have any questions about this policy or how we handle your personal data, contact us at hello@halahsocial.com.
This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights you have over it. It applies to visitors to our website, people who enquire about our services, creators who apply to work with us, and clients who engage us.
Information we collect and why we collect it
- Enquiry data. When you contact us through our website or by email: your name, email address, phone number, company name and the content of your message. We use this to respond to your enquiry and to scope potential campaigns. Lawful basis: legitimate interests, and, where your enquiry is about entering into a contract with us, steps taken at your request prior to entering into a contract.
- Creator application data. When you apply to work with us as a creator: your contact details, social media platform handles and performance statistics, business details, and payment details. We use this to assess your application and, where we go on to work together, to provide talent management and campaign services. Lawful basis: performance of a contract, or steps taken at your request prior to entering into one.
- Client and campaign data. Information provided by clients and creators in the course of a campaign, including brief materials, content, performance data and communications. We use this to deliver the services set out in our contract with you. Lawful basis: performance of a contract.
- Newsletter and drop-list emails. Your email address, and any preferences you tell us, if you sign up to receive updates, opportunities or campaign "drops" from us. We use this to send you the updates you've asked for. Lawful basis: consent. You can unsubscribe at any time using the link in any email or by contacting hello@halahsocial.com.
- Website analytics and cookies. We use Google Analytics and the cookies described in our Cookie Policy to understand how visitors use our website and to improve it. Lawful basis: consent, given through our cookie banner. You can withdraw consent at any time by changing your cookie settings.
We do not use your personal data for any purpose incompatible with the purposes above without telling you and, where required, obtaining your consent.
Automated decision-making
We do not use your personal data for any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
Who we share it with
We share personal data with:
- Service providers who help us run our business, such as our hosting providers (currently IONOS and Microsoft), Microsoft 365 and Google for day-to-day email, Mailchimp for our newsletter and marketing sends, HubSpot, Notion and Airtable as our CRM and internal record-keeping tools, our own built-in website forms and Hotforms for enquiry and creator-application forms, and Stripe and GoCardless for payments. Payroll and finance functions, including invoicing, are handled through MyTaxDoc, as described above. These providers only process personal data on our instructions and under contract.
- Other companies in the DOC Group. Halah Social is part of the DOC Group, which also includes MyTaxDoc Limited (trading as MyTaxDoc Accountants & Tax Advisors). We may share your data with other group companies, including so that they can tell you about their own services (for example, accountancy services from MyTaxDoc) where you've agreed to hear from us about this. You can opt out of group marketing at any time by contacting hello@halahsocial.com or using the unsubscribe link in any marketing email; this won't affect any other service we provide you. Lawful basis: consent, for marketing communications from other DOC Group companies. We'll ask you to opt in to this separately from our general enquiry or campaign communications, rather than bundling it into a general "I agree to the terms" checkbox.
- Prospective and confirmed clients, creators and partners. If you're a creator working with us, we may share your profile, platform statistics and portfolio with brands and other businesses to pitch you for campaign opportunities, even before a specific campaign is agreed, as well as with a client once you've been shortlisted or booked for their campaign. Lawful basis: legitimate interests, as this is a core part of representing and securing work for you as a creator. If you're a client, we may share your brief and campaign requirements with creators and other partners to try to fulfil it, as well as with the creators booked on your campaign. Lawful basis: performance of a contract, or steps taken at your request prior to entering into one.
- Professional advisers and authorities, such as our accountants, auditors, insurers or legal advisers, or regulators and law enforcement, where the law requires or permits it.
- A buyer, if we sell or reorganise all or part of our business, in which case personal data may be transferred as part of that transaction, subject to the same protections set out in this policy.
We do not sell personal data to third parties.
International transfers
We work with creators, clients and partners across multiple countries, so personal data may be sent, stored or accessed outside the UK, including by our own team members, creators, clients or service providers based overseas. Where this happens, we put a safeguard recognised under UK GDPR in place before the transfer, which will typically be one of:
- A UK adequacy regulation, where the UK government has confirmed the destination country's data protection laws are adequate;
- The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, put in place directly with the recipient, together with a transfer risk assessment; or
- Another safeguard recognised under UK GDPR, such as the recipient's own certification under an approved scheme.
You can ask us for details of the safeguard used for a specific transfer by contacting hello@halahsocial.com.
How long we keep it
We keep personal data only for as long as we need it for the purposes it was collected for, and to meet our legal and accounting obligations. As a guide:
- Enquiries that do not lead to a client or creator relationship: 12 months from the date of the enquiry.
- Client and creator records: for as long as you're an active client or on our roster (our creator relationships are typically non-exclusive, so you may remain on our roster for some time between campaigns while we look for the right opportunity, and we treat that as an ongoing relationship, not a lapsed one), plus 6 years after the relationship or roster membership ends, to meet UK tax and legal record-keeping requirements.
- Marketing lists: until you unsubscribe or ask us to stop contacting you.
- Website analytics data: in line with the retention settings of the tool named above.
Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, and we require our service providers to do the same.
Children's data
Our services are directed at businesses, creators and adults, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete personal data.
- Delete your personal data, in certain circumstances.
- Restrict or object to our processing of your personal data.
- Withdraw consent at any time, where we rely on consent (this won't affect processing carried out before you withdraw it).
- Receive a portable copy of the personal data you've given us, in a commonly used format.
To exercise any of these rights, contact us at hello@halahsocial.com. We will respond within one month, as required by law.
If you're unhappy with how we've handled your personal data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time, for example to reflect changes in our services or the law. We'll post the updated version on this page with a new "last updated" date.
Last updated: February 2026