Privacy Policy

Taqyid attaches great importance to the protection of your personal data. Taqyid is a brand of DIGIQUEST CONSULTING, a French SAS registered under SIREN 929 281 780, and provides a SaaS halal compliance platform to customers in the European Union and Malaysia. Our core infrastructure is hosted in the Asia-Pacific (Singapore) region to be close to our Malaysian users. This policy explains what personal data we process, why, with whom it is shared, how long it is kept and how you can exercise your rights, in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act (Loi n°78-17 du 6 janvier 1978, as amended) and the Malaysian Personal Data Protection Act 2010 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2024. This notice is available in English and in Bahasa Malaysia.

Effective date. This policy takes effect on 5 November 2026 for existing customers, their users and the people whose data they enter into the platform. It applies immediately to accounts created on or after 4 October 2026 and to everyone else, including visitors to this website, people who registered for our former early access programme and marketing contacts.

1. Who we are and our role

DIGIQUEST CONSULTING (operating under the brand Taqyid), registered in France (SIREN 929 281 780, 22 Rue du Docteur Bertrand, 70200 Lure), is contactable at contact@taqyid.com.

• As data controller, Taqyid processes the personal data of visitors to this website, of people who registered for our former early access programme, of account holders (users of the platform), of billing contacts and of people who receive our communications.
• As data processor, Taqyid processes the personal data that our customer organisations enter into the platform about other people — for example their personnel, halal committee members, supplier contacts or the customers to whom they distribute products. For this data, the customer organisation is the data controller: it decides what is recorded and is responsible for having a lawful basis to record it. Taqyid processes it only to provide the service, on the customer's instructions, as set out in our Data Processing Agreement.

Data Protection Officer: contactable at dpo@taqyid.cloud.

2. Data we collect and where it comes from

• Account data — your full name, professional email address, password (stored by our authentication provider, never in readable form), organisation name and, optionally, country. It comes from you when you sign up, or from your organisation's administrator when they invite you (they provide your email address). Your role, permissions, language and notification preferences are then set in the platform.
• Billing data — for paid subscriptions: billing email, plan and a reference to your customer record at our payment service provider, Stripe. Card details are entered on Stripe's secure payment page and held by Stripe; full card numbers are never received or stored by Taqyid.
• Activity and technical data — an audit trail of actions performed in the platform, including the IP address and browser user agent associated with them and with electronic signatures; IP addresses used transiently for rate-limiting; error diagnostics; and product usage analytics (see section 9).
• Data entered by customer organisations (Taqyid as processor) — for example personnel records (name, employee ID, email, department, position, employment type and dates, citizenship status, halal role and qualification, halal executive certificate number, photo, notes), halal committee members, supplier contact details, distribution customer contact details, and business documents that may contain personal data.
• Early access and marketing contacts — the name, email, company and role you provided when registering for our former early access programme or one of our forms, and the opens and clicks recorded on our marketing emails.

Sensitive personal data. The platform includes a field indicating whether a member of personnel or of a halal committee is Muslim, used by customer organisations to document the composition of their halal roles and committees. Information about religious beliefs is sensitive personal data under the PDPA. It is entered by the customer organisation, as data controller, which must have a lawful condition to record it — such as the explicit consent of the person concerned. We do not otherwise intentionally collect sensitive personal data and ask you not to submit it via the platform.

Obligatory or voluntary. Your name, email address and organisation name are obligatory to create an account; without them we cannot provide the service. Billing data is obligatory only to subscribe to a paid plan. Country, profile details and marketing preferences are voluntary.

3. Purposes of processing

Your data is used to:

• Create and administer your account, including free trials and invitations to your organisation
• Provide the halal compliance service to your organisation
• Bill and collect payment for paid subscriptions, issue invoices and process refunds (Stripe)
• Keep an audit trail of compliance actions and electronic signatures
• Send transactional notifications such as alerts, invitations and trial reminders (Resend)
• With your consent, send marketing communications about product updates and relevant content (Brevo). You may unsubscribe at any time using the link provided in each email.
• Generate AI-assisted compliance analysis and audit-readiness reports from your organisation's compliance data (Anthropic)
• Monitor and diagnose technical errors and service performance (Sentry)
• Understand product usage to improve features and user experience (PostHog)
• Protect the service through rate-limiting (Upstash Redis)
• Automate internal operational workflows, such as notifying our team of new registrations (n8n)
• Manage our former early access programme (registrations closed on 30 September 2026)

4. Legal basis

The processing of your data is based on:

• Performance of a contract — or steps taken at your request before entering into one — for the provision, administration and billing of the service
• Your consent for marketing communications, for analytics on this website and for product analytics in your browser when you use the application (see section 9)
• Taqyid's legitimate interest in operating, securing and improving the service, including the service events that our servers record in our product analytics tool, whatever your analytics choice (see section 9)
• Compliance with legal obligations to which Taqyid is subject

5. Who we share data with

• Your organisation: administrators and authorised members of your organisation can see your account details and the actions you perform in the platform, according to their permissions
• Taqyid internal team: authorised staff only, on a need-to-know basis. Our staff access an organisation's data only to handle a support request sent by that organisation or one of its users, through the support form in the platform (Help Center › Contact Support) or by email to support@taqyid.com, or where the security of the service or the law requires it; each access to an organisation's account through the platform is recorded in our security logs
• Service providers acting as our processors, listed below
• Authorities: where disclosure is required or authorised by law or by the order of a court

Sub-processors:

All processors are contractually required to comply with confidentiality, security and data protection obligations. Your data is not sold to third parties and is not used for behavioural advertising. We will notify customers of any changes to our sub-processor list at least 30 days in advance.

6. Transfers outside Malaysia and the European Union

Our databases and application are hosted in Singapore, and some of the providers listed above process data in the European Union, Japan or the United States. For users in Malaysia, this means personal data is transferred outside Malaysia; for users in the European Union, outside the European Economic Area.

Under the PDPA, we transfer personal data outside Malaysia in accordance with section 129, in particular where the transfer is necessary for the performance of our contract with you and where we have taken reasonable precautions and exercised due diligence to ensure that the data is protected. For transfers from the European Economic Area to countries not covered by an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep your data

• Account data: for as long as your account is active. When a user is removed from an organisation, the account is deactivated rather than erased, so that the organisation's compliance records remain complete. Deactivated accounts are anonymised no earlier than three (3) years after deactivation. You may also ask us to delete your personal data (see section 8).
• End of a free trial without subscription: the account switches to read-only mode and its data is not deleted, as described in our Terms of Service.
• Data entered by customer organisations, including halal compliance documentation (audit records, certificates, traceability logs, non-conformance reports): for as long as the customer organisation's account is open and, unless the organisation instructs us otherwise and subject to the clean-ups described below, for three (3) years after the account is closed, so that the organisation can meet the JAKIM MHMS 2020 record-keeping requirements; the data is then deleted or anonymised. After closure, the account remains in read-only mode for this retention period (see our Terms of Service, 12.3). Certificates, documents, audits and non-conformance reports that a customer organisation has archived are deleted from its account once they have been archived for three (3) years; this clean-up runs once a month. The personal data in the records of personnel who have left the organisation is anonymised no earlier than three (3) years after their departure, unless the person concerned asks for it to be erased earlier (see section 8).
• Audit trail entries: retained to preserve the chain of evidence required by halal certification bodies, for the same period as the organisation's halal compliance documentation; they are not currently deleted automatically.
• Billing and accounting records: invoices and other accounting records are kept for ten (10) years (French Commercial Code, Article L123-22). Other contractual records: contract duration + 5 years.
• Early access registrations and marketing contacts: 3 years after the last interaction, or until you unsubscribe from marketing emails.
• Website analytics cookies: 13 months at most after they are set or last renewed; the Google Analytics identifier cookie (_ga) is not renewed by later visits. Cookies placed under our previous settings may keep a longer expiry date (see section 9).

8. Your rights

Under the PDPA, you have the right to:

• Access your personal data and obtain a copy of it (sections 30 and 31). We respond within 21 days of receiving your request. While your account is active, you can also download a copy of your personal data from your profile settings in the platform.
• Correct personal data that is inaccurate, incomplete, misleading or not up to date (sections 34 and 35), within 21 days of your request. While your organisation's account is not in read-only mode, you can also update your name and profile directly in the platform settings.
• Withdraw your consent to the processing of your personal data (section 38). Where that data is necessary to provide the service, we may no longer be able to provide it.
• Stop direct marketing at any time (section 43), using the unsubscribe link in each marketing email.
• Data portability — request that we transmit your personal data to another data controller of your choice (section 43A), subject to technical feasibility and compatibility of the data format.

Because Taqyid is operated by a company established in France, the GDPR also gives you the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on our legitimate interest, and the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

Deletion. You may ask us to delete your personal data by writing to dpo@taqyid.cloud; there is no self-service deletion in the platform. If you are still an active member of an organisation, your user account is first deactivated. We then anonymise it rather than deleting it, so that your organisation's compliance records remain complete. If you appear in records of your organisation that are less than three (3) years old — for example as the author of an action or of an electronic signature — the anonymisation is scheduled for three (3) years after the most recent of those records: these records belong to your organisation, which may need them to meet its halal record-keeping obligations and to establish or defend legal claims. We reply in writing within one month of your request and tell you when your data has been or will be anonymised. Your organisation's own records are kept as described in section 7.

To exercise these rights, write to dpo@taqyid.cloud from the email address associated with your account. If your data was entered by an organisation that uses Taqyid (for example your employer), please also contact that organisation: it is the data controller, and we will assist it in answering your request.

You also have the right to lodge a complaint with the competent supervisory authority:

• For users in Malaysia: Jabatan Perlindungan Data Peribadi (JPDP / Department of Personal Data Protection), Ministry of Digital Malaysia. Website: www.pdp.gov.my
• For users in the European Union: Commission Nationale de l'Informatique et des Libertes (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. Website: www.cnil.fr

9. Cookies and analytics

• On this website: analytics (Google Analytics 4, PostHog, Vercel Web Analytics and Speed Insights) are loaded only after you accept them in the cookie banner. Your choice is stored in your browser. To withdraw your consent, delete the cookies and site data stored by taqyid.com in your browser settings: the banner is shown again on your next visit, and you can then reject analytics.
• In the application (app.taqyid.cloud): essential cookies keep you signed in. We also use PostHog product analytics, hosted in the European Union, to understand how features are used. In your browser, it is activated only if you accept it (opt-in), and you can change your choice at any time in your settings. It is linked to your user account, is configured not to store your IP address, masks the content of form fields in session recordings, and is never used for advertising. Session recordings, which may also include technical messages from your browser console, are kept for 30 days.
• Service events recorded by our servers: separately from your choice above, our servers send PostHog a limited set of service events when certain actions are completed in the platform. They cover the trial (trial started, trial ending, trial expired, the reminders sent after it has ended, trial extended), billing (card checkout started, invoice requested, subscription activated, payment failed, subscription cancelled) and product use (certificate created, saved as a draft or activated; non-conformance report created; supplier blocked automatically; Halal Executive designated; product created; raw material created; raw material added to a product's bill of materials; raw-material import analysed, confirmed or cancelled; recall simulation run; audit-readiness report generated). Each event carries the identifier of your organisation and, when it results from an action by a user, the internal identifier of that user's account (for a Halal Executive designation, also that of the designated user), together with details of the action, for example a status, a count, a plan, a certificate category or SPHM certificate number, and the identifier of the record concerned. These events contain no name or email address, are sent by our servers rather than by your browser, and use no cookie. We process them on the basis of our legitimate interest in understanding how the service is used and improving it (see section 4).
• Error diagnostics: Sentry may record a replay of a sample of application sessions and of sessions in which an error occurs. All text and media are masked in these replays, and personal data is scrubbed from error reports before they are sent.
• Email tracking: our marketing emails sent via Brevo may contain tracking pixels that record whether an email has been opened and which links have been clicked. You can disable image loading in your email client, or unsubscribe at any time using the link provided in each email.

Cookies and browser storage used:

Google Analytics cookies placed on your device under our previous settings keep the expiry date they were given then, which can be up to two years. You can delete them at any time in your browser settings.

10. Data security

We implement technical and organisational measures to protect your data against loss, misuse, unauthorised access, disclosure, alteration or destruction, including:

• TLS/SSL encryption for data in transit
• Hosting on cloud infrastructure in the Asia-Pacific (Singapore) region
• Strict isolation of each organisation's data from that of other organisations
• A role-based access control (RBAC) system with five roles plus the Halal Executive designation, and creator/validator segregation, ensuring that no single user can both create and approve compliance records
• Rate-limiting of requests and an audit trail of actions
• Masking of personal data in error diagnostics and session recordings
• Periodic security reviews

11. Data breach notification

If a personal data breach occurs, Taqyid will notify the competent data protection authority as soon as practicable and, where required, within a maximum of 72 hours. Where the breach causes or is likely to cause significant harm, affected individuals will also be informed without unnecessary delay — and in any event within seven (7) days of the initial notification to the authority — in accordance with section 12B of the PDPA and the Personal Data Protection Commissioner's guideline on data breach notification.

12. Changes to this policy

This policy may be updated from time to time. The date of the last update is shown at the top of this page. We will inform you in advance of any material changes that impact the way your data is processed.