Malli Privacy Policy

Draft for legal review — not yet published.

Effective date: [DATE]
Last updated: [DATE]

This Privacy Policy explains how Next Wave LLC ("Next Wave", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use Malli, our consumer-facing mall, retailer, shop, event, offer, and voucher platform (the "Services").

Malli is operated by Next Wave LLC:

Legal name: [LEGAL COMPANY NAME]
Registered address: [REGISTERED ADDRESS]
Privacy email: [PRIVACY EMAIL]
Support email: [SUPPORT EMAIL]

We are generally the controller of the personal data described in this Policy. The exact rights and obligations that apply depend on applicable law and your location.

1. When this Policy applies

This Policy applies when you:

browse Malli or search for malls, retailers, shops, events, offers, or vouchers;
create or use a Malli account;
sign in with email/password or Google;
join an event, request access, save a preference, or use a voucher;
submit information, feedback, a review, photograph, or support request; or
otherwise interact with Malli.

This Policy does not govern the independent privacy practices of malls, retailers, merchants, Google, Meta, payment providers, or other third parties. Their own notices may also apply.

2. Personal data we may collect

Depending on the features you use, we may collect:

Account and identity data

Your name or display name, email address, account identifier, role, account status, authentication records, and settings.

Google sign-in data

If you use Google sign-in, we may receive your Google account identifier, verified email address, name, profile image, and confirmation that Google authenticated you. We do not receive your Google password.

Mall, event, and participation data

Your selected mall, event or join requests, access status, vouchers, offers, redemption or attendance records, and related support or dispute information.

Retailer and business interaction data

If you interact with a retailer or business feature, we may process the information necessary to handle that interaction, including retailer selection, approvals, submissions, and communications.

Technical and usage data

IP address, browser and operating-system information, device and application information, login and security events, dates and times of access, pages and features used, referral information, diagnostic information, and cookie or similar-technology information.

Communications and content

Information in support requests, feedback, reviews, photographs, messages, and other content you choose to submit. Do not submit passwords, complete payment-card details, identity documents, or another person’s private information unless specifically requested through a secure process.

Payment information

When paid features become available, our payment provider may process payment-card details. We expect to receive transaction references, payment status, limited payment-method information, refunds, failures, disputes, and information needed for accounting and support. Unless stated otherwise at checkout, Malli will not store complete payment-card numbers or card security codes.

3. How we collect data

We collect data:

directly from you when you register, sign in, select a mall, submit a form, join an event, or contact us;
automatically through the website, browser, server logs, cookies, and similar technologies; and
from providers involved in authentication, payments, hosting, security, communications, or the delivery of a feature you request.

4. How we use personal data

We may use personal data to:

create and secure accounts and maintain login sessions;
provide mall, retailer, shop, event, offer, and voucher functionality;
remember a selected mall and other requested settings;
process event participation, retailer interactions, redemptions, purchases, refunds, and support requests;
authenticate users through Google where selected;
detect fraud, abuse, duplicate submissions, and unauthorized access;
operate, troubleshoot, secure, and improve Malli;
communicate about accounts, security, transactions, events, vouchers, service changes, and support;
send marketing communications where permitted and where required choices have been provided; and
comply with law, protect rights and safety, and establish or defend legal claims.

We may create aggregated or de-identified statistics. We will treat information as personal data if it can reasonably be linked back to you.

5. Legal grounds

Depending on the circumstances and applicable law, we may process personal data because:

it is necessary to provide a service you requested or perform a contract;
you gave consent;
we must comply with a legal obligation;
it is necessary for security, fraud prevention, or the establishment or defence of legal rights; or
another lawful ground applies.

Where processing relies on consent, you may withdraw it. Withdrawal does not affect processing that was lawful before withdrawal.

6. Who may receive personal data

We may share personal data with:

hosting, database, security, monitoring, email, support, and other technology providers;
Google when you choose Google sign-in;
payment providers when you use a paid feature;
participating retailers, malls, merchants, or event organisers where necessary to provide or validate a requested event, offer, voucher, or support resolution;
professional advisers, auditors, insurers, and service providers bound by appropriate duties; and
courts, regulators, public authorities, or other parties where disclosure is required or permitted by law.

We do not sell personal data in the ordinary sense of selling an identifiable customer list for money. We do not share more information than is reasonably needed for the relevant purpose where practical.

7. Marketing

We may send promotional email, SMS, WhatsApp, push, or other marketing communications where permitted by law and where the required consent or other lawful basis exists. You can unsubscribe using the message controls or by contacting us.

We may still send essential communications, including security alerts, account notices, purchase confirmations, event information, voucher information, and material policy changes.

8. Cookies and similar technologies

Malli currently uses an encrypted, signed first-party session cookie named _malli_key for core functions such as authentication, selected-mall state, security, and temporary sign-in or onboarding state. The cookie is described in more detail in the Malli Cookie Policy.

Malli may also load the Meta/Facebook SDK for WhatsApp business onboarding. That integration and any cookies or information collected by Meta are subject to Meta's own terms and privacy information. We will not use optional analytics or advertising technologies without the notices and choices required by applicable law.

9. International transfers

Next Wave and our providers may process personal data outside the country where it was collected, including through cloud, authentication, communications, payment, or technology providers. Where required, we will use an appropriate legal transfer mechanism and safeguards.

10. Security

We use reasonable administrative, technical, and organisational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, and destruction. No internet service can be guaranteed completely secure.

11. Retention

We retain personal data only for as long as reasonably necessary for the purposes described here, including to provide the Services, maintain security, resolve disputes, keep accounting records, prevent fraud, enforce agreements, and comply with legal obligations. Different categories may have different retention periods. We may delete, anonymize, or securely isolate information when it is no longer required.

12. Your rights and choices

Subject to applicable law, you may have rights to request access, correction, deletion, restriction, portability, or information about our processing; object to certain processing; withdraw consent; opt out of marketing; and complain to a competent data-protection authority.

Contact [PRIVACY EMAIL] to exercise a right or ask a question. We may request information needed to verify your identity and protect your account. Rights are not absolute and legal, security, fraud, accounting, and dispute records may need to be retained.

13. Account deletion

You may request account deletion through an available account function or by contacting [PRIVACY EMAIL]. Deletion may remove access to saved preferences, event participation, vouchers, and account history. We may retain information required for legal, accounting, security, fraud-prevention, or dispute purposes.

14. Children

Malli is not intended for children under 18. We do not knowingly collect personal data from children in violation of applicable law. Contact us if you believe a child has provided personal data.

15. Changes

We may update this Policy when the Services, providers, data practices, or applicable law change. We will post the updated version and revise the date above. We will provide additional notice for material changes where required.

16. Contact

Privacy questions, requests, and complaints may be sent to:

Next Wave LLC
Address: [REGISTERED ADDRESS]
Privacy email: [PRIVACY EMAIL]
Support email: [SUPPORT EMAIL]