Privacy Policy

This Privacy Policy explains how CrescentRating Pte Ltd ("CrescentRating," "CR," "we," "us," or "our"), a company incorporated in Singapore, collects, uses, discloses, and protects personal data in connection with our websites, platforms, research, and events.

This Policy applies to personal data collected through CrescentRating.com and its subdomains; the HalalTrip platform, where operated under the CrescentRating corporate umbrella; CrescentRating mobile applications; B2B dashboards, rating calculators, and audit portals; GMTI and other research surveys; and CrescentRating and Halal In Travel Global Summit events (collectively, the "Services"). It should be read together with our Terms & Conditions and Cookie Policy.

For the purposes of applicable data protection law, CrescentRating Pte Ltd is the data controller responsible for personal data processed through the Services, unless we are processing data on behalf of a corporate or government partner as their data processor under a separate agreement.

We collect data you provide when you:

• Create a corporate or B2B account, or register for a rating calculator, dashboard, or training module — name, business email, job title, company, and phone number;
• Submit an application for a CrescentRating audit or accreditation — business details, facility information, and compliance documentation;
• Register for the Halal In Travel Global Summit or another Event — name, contact details, dietary or accessibility requirements, and payment details (processed by our payment provider, not stored by us);
• Contact us, subscribe to communications, or respond to a GMTI or other research survey; or
• Create a HalalTrip consumer account — name, email, travel preferences, and booking-related details.

When you use the Services, we automatically collect device and usage data — IP address, browser type, pages viewed, referring URLs, and approximate location — through cookies and similar technologies. See our Cookie Policy for details and how to manage your preferences.

We may receive personal data about you from corporate partners, government tourism boards, event co-organizers, or publicly available sources, where necessary to deliver an accreditation program, destination assessment, or joint Event.

The Global Muslim Travel Index and our other research rely on surveys and interviews with travelers, operators, and destination stakeholders. Survey and respondent data is collected and used solely for internal research and analysis.

We use personal data to:

• Provide, maintain, and improve the Services, including B2B Tools, audits, and accreditation;
• Process Event registrations, payments, and attendee communications;
• Conduct and analyze research, including the GMTI, on an aggregated basis;
• Send service updates, marketing communications (where you have consented or as permitted by law), and respond to inquiries;
• Detect, prevent, and investigate fraud, misuse, or security incidents; and
• Comply with legal, regulatory, and contractual obligations.

Where required by applicable law, we process personal data on the basis of your consent, the necessity of processing to perform a contract with you, our legitimate interests in operating and improving the Services, or compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time as described in Section 8.

We and our service providers use cookies and similar technologies for essential site functionality, analytics, and — where you consent — marketing. Full details of the cookies we use, their purposes, and how to manage your preferences are set out in our Cookie Policy.

• Read our Cookie PolicyThe cookies we use and how to manage your preferences.→

We share personal data with vendors who host our infrastructure, process payments, send communications, or support our analytics and B2B Tools, under contracts that limit their use of the data to providing services to us.

Where you apply for accreditation or participate in a government-commissioned destination assessment, relevant data is shared with the commissioning tourism board or institutional partner only to the extent necessary for that engagement.

We may disclose personal data where required by law, regulation, court order, or governmental request, or where necessary to protect the rights, property, or safety of CrescentRating, our users, or the public.

If CrescentRating is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a policy providing equivalent protection.

CrescentRating does not sell personal data to third parties.

As a Singapore-based organization serving a global audience, we may transfer personal data outside your home jurisdiction, including to Singapore and to countries where our service providers operate. Where required by the Singapore Personal Data Protection Act, the EU/UK GDPR, or other applicable law, we implement appropriate safeguards — such as standard contractual clauses or equivalent mechanisms — before transferring personal data internationally.

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including any legal, accounting, or reporting requirements. Account data is generally retained for the life of the account plus a reasonable period thereafter; financial and audit records are generally retained for seven (7) years to meet Singapore statutory requirements; and Event registration data is retained for a reasonable period following the Event for administrative and legal purposes.

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. No system is completely secure, and we cannot guarantee the absolute security of information transmitted to or from the Services.

Subject to applicable law, you may have the right to access, correct, or delete your personal data; withdraw consent; object to or restrict certain processing; request data portability; and lodge a complaint with your local data protection authority, including the Personal Data Protection Commission of Singapore.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law and may need to verify your identity before acting on your request.

You may opt out of marketing communications at any time using the unsubscribe link in any email or by contacting us directly. You will continue to receive transactional and service-related communications necessary to operate your account or registration.

Our Services are not directed at children under the age of 16, and we do not knowingly collect personal data from them. If we become aware that we have collected personal data from a child without the consent required by applicable law, we will take steps to delete it.

We may update this Policy from time to time. Material changes will be notified via the Services or by email to registered account holders before they take effect. Continued use of the Services after changes take effect constitutes acceptance.

For questions about this Policy or to exercise your privacy rights, contact us at [email protected] or write to CrescentRating Pte Ltd, 80 Changi Road, Centropod, #05-12, Singapore 419715.