Last updated: 6 October 2026
1. Who we are
Halla is a way to find things to do, learn something or make something, book it, and keep your week in one place, in a way that fits around you. It is built so that people who use disability services can take part in their community.
Who is responsible for your information (the controller): Ger Mealey, a sole trader, trading as Halla. When Halla becomes a company, the company takes over and we will update this notice and tell you. Contact: privacy@halla.ie Halla has not appointed a separate data protection officer. Every question about your information is answered at privacy@halla.ie.
2. Who uses Halla
- People who use Halla for themselves. Some open their own account. Others are added by their service and open Halla with a Halla card (a link or QR code) instead of a password.
- Supporters: family, friends or key workers whom a person chooses.
- Staff at services: coordinators and key workers.
- Providers, who run classes and events, and local businesses (cafés, shops, hairdressers, libraries), who are on the map.
3. What we keep, and why
| What | Why | Who sees it |
|---|---|---|
| Your account: first name, email address, the area you live in, your Eircode only if you choose to add it (only you ever see it, and it is never on a map), year of birth, and how you sign in (including passkeys or an authenticator app) | To give you your account and keep it secure | You. Halla's own staff, only to fix a problem or if someone is worried about your safety |
| Your own Halla: what you book, your week, things you like, what helps you, what you are good at, what you find hard, your skills, your friends in Halla, and how you like Halla to show things (Short or More detail, bigger writing) | So Halla can show you things that suit you | You. Supporters see only what you allow. A service sees it only if it added you, or you chose to join it |
| Places you have been, from the classes you came to; whether someone knows you there; places you hid | To show you places you know, and things near them | You. The staff who support you, only if you say yes. Never places you hide |
| Your hello card: your first name, a photo if you add one, and a few lines about how you would like to be treated | So you can show it to staff at a welcoming place, if you choose | Only staff at a welcoming place, and only while you are showing it there (section 5) |
| Bookings, attendance and why you missed something, and what you said about how a class went | To run classes and groups, and see what helps people keep coming | You, the service that supports you, and the people you chose. A provider sees your first name only |
| Your Supporters and what each one can do | So the people you chose can help in the ways you chose | You, and each Supporter sees only what you allowed |
| How you agreed: when, which wording you were shown, and who helped you. For under-18s, which parent or guardian was linked (and, under 16, agreed), and when | To show you agreed, and that you decided | You. The service, if it added you |
| Concerns: if you or someone else is worried about your safety | Safeguarding | About something on Halla: Halla's safety team. Otherwise your service's coordinators, or the Supporters you pick. If it is serious, the people whose job it is to keep children and adults safe (section 8) |
| Projects you run in Create, and when a group says "we can do this" to a business | To run people's own small businesses on Halla | The group. A business learns only that a group answered, never who |
| For staff, providers and businesses: your name, work email and phone, your organisation; for a business, its details on the map (name, kind, hours, how to get in, phone, offers) | To run your account. A business's details are meant to be public | Your colleagues. Anyone on Halla sees a business's map card |
| A record of changes: who did what, and when | So nothing changes without a name on it | People checking Halla is used properly. Nobody using Halla can edit or delete it |
Some of this is about health or disability, for example what helps you, what you find hard, or why you missed a class. The law calls this special category information. We keep it only because you said clearly that we can.
Where you are now. If you press Use where I am now on My places, your phone asks you first, then uses where you are to show what is close. It stays on your phone: Halla never sees it or keeps it. Press it again to stop.
What Halla never asks for: your date of birth, PPS number, diagnosis, medication or medical records. Halla never needs your home address; an Eircode is optional, and nobody but you sees it.
4. Why we are allowed to keep it
- Your own Halla, and anything about your health or disability: your consent (GDPR Article 6(1)(a)) and your explicit consent (Article 9(2)(a)). You can withdraw it at any time.
- If you need help to decide, someone who knows you can explain and record your answer. They do not decide for you, and Halla records who helped (Assisted Decision-Making (Capacity) Act 2015).
- Under 18: a parent or guardian is linked to your Halla before it starts. Under 16 they agree as well, before you agree yourself (Data Protection Act 2018, section 31). From 16 you agree for yourself.
- Accounts for staff, providers and businesses: to provide the service you signed up for (Article 6(1)(b)).
- Safety: where someone may be at serious risk, Halla may share what is needed to protect them, or where the law requires it (section 8).
5. Who else sees what
- A service sees you only if it added you, or you chose to join it with six numbers and said yes on your own phone. You can leave a service at any time; your own Halla stays yours.
- Supporters see only what you chose: your week, and if you said so, booking for you or saying you can't go. You can change this or remove them at any time.
- A parent or guardian linked to someone under 18 is their Supporter and sees their week until they are 18. More, like booking for them, is switched on only as the young person needs it. At 18 it becomes the young person's choice.
- The person running something you booked sees your first name, so they can greet you. Nothing else.
- People in your group see your first name.
- Welcoming places and hello cards. Halla approves each welcoming place. At one, you can scan its door code and choose to show your hello card. Its staff see your card only while you are there, until you press I've left, they take it off the screen, or 90 minutes pass. The business keeps nothing and has no list of past visitors. Halla keeps a record that your card was shown there, and when, for safety. A yes for one place is never used for another.
- Businesses on the map see nothing about the people who look at them.
- Counts never name anyone and never show fewer than five people. The one exception is Halla’s own top administrator, who sees exact numbers, never names, to run Halla. If you switch on "Be part of the counts", what you picked in About me is added up with other people's so places can plan, but never your name.
Halla never sells your information and never uses it for advertising.
Data-sharing agreements. Halla may agree with the HSE, other public bodies or researchers to share numbers that do not identify anyone, only if it will really help the people who use Halla. Halla will never share anything that identifies you unless it asks you first and you say yes. Halla publishes a list of every agreement. The full rules are in Halla's data-sharing policy: ask at privacy@halla.ie.
6. Companies that hold or send information for us
| Company | What it does | Where |
|---|---|---|
| Supabase | Holds Halla's database and sign-ins | Ireland (EU). Supabase is a US company |
| Vercel | Runs the Halla app | Dublin (EU). Vercel is a US company |
| Google (Workspace) | Sends Halla's sign-in emails | Google's own data centres. Google is a US company |
| Google (Maps) | Draws the maps, and finds a business's or venue's Eircode on the map. If you add your Eircode, Halla asks Google where it is, to work out distances: Google is told the Eircode only, never who you are | When you look at a map, your device gets it from Google, so Google sees your device's internet address |
| Apple, Google or Mozilla push services | Deliver a notification to a business's phone that "someone is showing you their hello card". It never says who | The phone maker's service |
Where a company is based outside the EU, we rely on its data processing agreement and the EU's standard contractual clauses or the EU–US Data Privacy Framework.
Cookies. Halla only uses cookies it needs to work: to keep you signed in, to open your Halla with your Halla card, and to remember your reading settings. No advertising, tracking or analytics cookies.
Paying. Halla never takes or holds money for a class. If a class costs something, you pay the person running it on their own page, and their privacy notice applies. If Halla ever charges a fee, you see the price and agree before anything is paid, and Halla never sees your bank details.
7. Computers do not decide about you
Halla suggests things. A person always decides: you, or the people you chose, and Halla records who. Halla never books you into anything by itself.
8. Keeping people safe
If you or someone else is worried about your safety, you can say so on Halla. You are asked one question: is it about something on Halla? If it is, or you are not sure, a person at Halla reads it. If it is not, it goes to your service's coordinators, or to the Supporters you pick, and Halla is only told that it went to them, not who it is about. If nobody picks it up within 1 working day, a person at Halla reads it. If it is serious, Halla may have to pass it to the people whose job it is to keep children and adults safe, such as Tusla for under-18s, or the HSE or Gardaí. Halla tells you first, unless that would put someone at risk.
9. How long we keep it
- While you use Halla.
- If you stop, for 6 months, so you can come back with your history, then deleted.
- If you were added but never agreed, deleted after 60 days.
- If nothing happens for 18 months, deleted, with a month's warning.
- If you ask us to delete it, straight away.
What delete means. Your name and everything about you is removed. A record that someone came to a session is kept, with no name on it, so counts stay right. It is gone from backups within 30 days.
10. Your rights
You can see what we keep and get a copy, correct it, delete it, limit what we do with it, take it somewhere else, and withdraw your agreement at any time. It is as easy as agreeing was. Ask at privacy@halla.ie, your coordinator, or someone you trust can ask for you. You don't have to give a reason. We reply within one month.
11. Complaints
Tell us first: privacy@halla.ie. You can also complain to the Data Protection Commission: www.dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
12. Changes
If we change this notice in a way that matters, we tell you in Halla, and ask you again where the law needs it.