Privacy Policy

1.Who is responsible for your data

Malang (“we”, “us”) is responsible for the personal information collected through malang.pk and through orders placed with our team on WhatsApp. For anything in this policy, write to hello@malang.pk.

2.What we collect

• Identity & contact — your name, email address, phone number, and billing and delivery addresses. Couriers need an active phone number and a complete address to deliver your order.
• Order information — the bags you buy, order value, currency, delivery details and order history.
• Payment information — handled by our payment processors. We receive confirmation of payment and limited card metadata (such as the last four digits); we never see or store your full card number.
• Communications — messages you send us by email, WhatsApp, our contact forms, or social channels, and our replies.
• Device & usage data — IP address, device and browser type, pages viewed and how you arrived, collected through cookies and similar technologies (see our Cookie Policy).

3.How we use it

• To accept, make, deliver and support your order — including sharing delivery details with carriers and sending you order and tracking updates.
• To process payments and prevent fraud — including verification checks on high-value or unusual orders.
• To provide customer care, exchanges and returns.
• To send you news, new bags and offers where you have chosen to receive them — you can opt out at any time.
• To understand how the site is used and make it better, through analytics.
• To meet our legal obligations — tax, accounting, consumer and customs law.

4.The legal grounds we rely on

Where the law requires a legal basis (for example under the EU or UK GDPR), we rely on: performance of a contract (fulfilling your order), legitimate interests (running and protecting our business, improving the site, preventing fraud), consent (marketing, and non-essential cookies), and legal obligation (records we must keep).

5.Who we share it with

We do not sell your personal information, and we never will. We share it only with the partners needed to serve you:

• Payment processors — the providers that process online payments shown at checkout.
• Delivery partners — the courier companies that deliver your order; the courier is confirmed with your tracking details at dispatch.
• Technology providers — hosting, e-commerce infrastructure, email and customer-service tools that operate the site on our behalf.
• Analytics & advertising partners — such as Google (analytics) and Meta (advertising measurement), as described in our Cookie Policy.
• Professional advisers and authorities — where the law requires it, or to protect our rights, always limited to what is necessary.

When you place an order or create an account, we may share your email address and phone number with our advertising partners, Google and Meta, in hashed form (a one-way encrypted code that cannot be read back into the original details). This lets us show you relevant ads and measure how they perform. To opt out, write to hello@malang.pk.

Every partner processing data on our behalf is bound by contract to protect it and to use it only on our instructions.

6.International transfers

Your information may be processed in Pakistan and in the countries where our technology and payment partners operate. Wherever it travels, it is protected by this policy and by appropriate safeguards — including recognised contractual clauses where required by law.

7.How long we keep it

We keep personal information only as long as it serves the purpose it was collected for: order and transaction records for as long as tax and accounting obligations require; correspondence for as long as needed to serve you; marketing preferences until you opt out. When information is no longer needed, it is deleted or anonymised.

8.Your rights

Wherever you are, you may ask us to access, correct or delete your personal information, or to stop sending you marketing, by writing to hello@malang.pk. Certain regions grant specific rights:

European Economic Area & United Kingdom

Under the EU and UK GDPR you have the rights of access, rectification, erasure, restriction, data portability and objection (including to direct marketing), and the right to withdraw consent at any time. You may also lodge a complaint with your supervisory authority — in the UK, the Information Commissioner’s Office.

California, United States

Under the CCPA/CPRA you have the right to know what personal information we collect and how it is used, to access and correct it, to request deletion, and to opt out of the “sale” or “sharing” of personal information. We do not sell personal information. To the extent that advertising cookies constitute “sharing”, you can opt out through our cookie banner or the controls in our Cookie Policy. We will never discriminate against you for exercising these rights.

United Arab Emirates

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) you have rights of access, correction, deletion, restriction and objection, which you may exercise through the contact above.

Pakistan

We handle personal information in accordance with applicable law in Pakistan, and we extend the same standards of access, correction and deletion to our Pakistani clients as we do worldwide.

9.Marketing choices

We send marketing only to those who have chosen it. Every email includes an unsubscribe link that works immediately, and you may also opt out by writing to us. Opting out of marketing never affects the service messages your order requires — confirmations, tracking, and delivery updates.

10.Cookies

We use cookies and similar technologies for essential site functions, analytics and advertising measurement. What they are, what we use, and how to control them — including how to refuse everything non-essential — is set out in our Cookie Policy.

11.How we protect it

All traffic to the site is encrypted (HTTPS/TLS). Payment details are handled exclusively by PCI-DSS-certified processors. Access to personal information within our team is limited to those who need it to serve you, and our systems and partners are chosen with security as a requirement, not a preference. No system on earth is perfectly secure — but if an incident ever affects your data, we will inform you and the relevant authorities as the law requires.

12.Children

Our site and products are intended for adults. We do not knowingly collect personal information from anyone under 18; if you believe a minor has provided us information, write to us and we will delete it.

13.Changes to this policy

When we change this policy, we update the date at the top of this page; for significant changes, we will tell you more prominently. The current version always lives at malang.pk/privacy.

14.Contact

For anything concerning your personal information:
Email: hello@malang.pk
Phone / WhatsApp: +92 302 052 1000