Privacy policy
PRIVACY POLICY
Effective Date: May 2026 · Applies to all interactions with cravve.co and related communications
Crafton Group Sdn Bhd, operating as Cravve. ("we", "us", "our"), is committed to protecting the personal data of our customers, waitlist members, and website visitors. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over your data.
This policy is prepared with reference to the Personal Data Protection Act 2010 (PDPA) of Malaysia, as amended from time to time. By using our website or purchasing from us, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent for a particular form of processing, we will obtain the required consent.
1. Personal Data We Collect
We collect personal data that you provide directly to us, as well as data collected automatically when you interact with our website and online store.
1.1 Data You Provide to Us
- Full name
- Email address
- WhatsApp or mobile number — collected via waitlist signup, customer communications and checkout where applicable
- Billing and delivery address
- Payment and transaction information — processed by our payment gateway and service providers
- Order details and purchase history
- Account information, where you create an account
- Information you provide when contacting us
- Any other information you voluntarily provide to us
1.2 Data Collected Automatically
When you visit cravve.co, we may automatically collect information through cookies, pixels and similar tracking technologies, including:
- IP address and general location data
- Browser type and device information
- Operating system and network information
- Pages and products visited
- Shopping cart activity
- Time and date of visits
- Browsing and website interaction behaviour
- Referral source — how you arrived at our website
We use Shopify to operate our online store. Shopify and relevant service providers may process information relating to your use of our store in order to provide, maintain, secure and improve the services.
We may also use Meta Pixel, TikTok Pixel and Google Analytics to understand how visitors interact with cravve.co, measure advertising effectiveness and improve our marketing activities. These services operate under their respective privacy policies.
2. How We Use Your Personal Data
We use the personal data we collect for the following purposes:
2.1 To Process and Fulfil Your Order
- To confirm and process your purchase or pre-order
- To process payments
- To arrange delivery and share necessary information with delivery and logistics partners
- To send order confirmations, shipping updates and delivery notifications
- To handle cancellations, returns, refunds and exchanges
- To provide warranty and after-sales support
- To maintain appropriate transaction and business records
2.2 To Communicate With You
- To respond to your enquiries, requests and customer service matters
- To send important updates regarding your orders
- To communicate regarding delivery, returns, refunds or warranty matters
- To notify waitlist members when pre-orders or products become available
- To maintain our customer relationship with you
2.3 For Marketing and Promotional Purposes
Where permitted by applicable law, we may use your personal data to:
- Send promotional emails and product updates
- Announce new products, launches and offers
- Notify waitlist members of pre-orders or early access opportunities
- Send promotional WhatsApp messages where applicable
- Deliver, measure and improve targeted advertising through platforms including Meta and TikTok
You may opt out of marketing communications at any time. Opting out of marketing communications does not affect necessary transactional communications relating to your orders or services.
2.4 To Improve Our Products and Services
- To analyse website traffic and customer behaviour
- To improve our website and shopping experience
- To improve our products and services
- To measure advertising and marketing performance
- To conduct internal research and business planning
- To detect, investigate and prevent fraud or unauthorised activity
2.5 For Legal and Regulatory Purposes
We may use personal data where reasonably necessary to comply with applicable laws, regulations, court orders, lawful requests from authorities, or to establish, exercise or defend our legal rights.
3. Who We Share Your Personal Data With
We do not sell your personal data as a standalone business activity. We share personal data only where reasonably necessary to operate our business, fulfil your orders, provide our services, comply with applicable law or protect our rights.
3.1 Shopify and Technology Providers
Our online store is powered by Shopify. Shopify and other technology providers may process personal data in connection with operating, hosting, securing and improving our online store and related services.
3.2 Logistics and Delivery Partners
We share information such as your name, delivery address and contact number with courier and logistics partners where necessary to deliver your order.
3.3 Payment Processing Providers
Your payment and billing information may be processed by authorised payment gateways and payment service providers. We do not intentionally store complete card or banking credentials on our own systems unless otherwise stated.
3.4 Marketing and Analytics Platforms
We may use Meta, TikTok, Google Analytics and other marketing or analytics providers. These platforms may collect and process information regarding your website activity in accordance with their respective privacy policies.
3.5 Other Third-Party Service Providers
We may engage third-party service providers for purposes such as:
- Website and IT services
- Cloud storage
- Customer support
- Fulfilment and warehousing
- Accounting
- Marketing
- Fraud prevention
- Security
- Other services necessary to operate our business
We seek to limit the personal data shared with such providers to information reasonably necessary for the relevant purpose.
3.6 Business Sale or Transfer
If Cravve or Crafton Group Sdn Bhd sells, merges, restructures, transfers or otherwise disposes of all or part of its business or assets, personal data may be transferred as part of that transaction.
Where required by applicable law, we will take reasonable steps to ensure that personal data continues to receive appropriate protection.
3.7 Legal and Regulatory Disclosure
We may disclose personal data where required or permitted by applicable law, regulation, court order or legal process.
We may also disclose information to regulators, auditors, legal advisers, law enforcement authorities or other relevant parties where reasonably necessary to:
- Comply with legal obligations
- Protect our rights or property
- Investigate suspected fraud or unlawful activity
- Protect the safety of our customers or others
- Establish, exercise or defend legal claims
4. How Long We Retain Your Data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including:
- Fulfilling orders and providing customer service
- Providing warranty and after-sales support
- Maintaining transaction and business records
- Complying with legal, accounting and tax obligations
- Resolving disputes
- Preventing fraud
- Protecting our legal rights
Different categories of personal data may be retained for different periods depending on the purpose for which the information was collected and applicable legal requirements. Waitlist and marketing information may be retained until you opt out, request deletion, or the information is no longer reasonably required for its original purpose.
Website analytics information may be retained in accordance with the relevant platform's data retention policies. You may request deletion of your personal data by contacting us. Such requests remain subject to legal, regulatory, contractual or other legitimate requirements that may require us to retain certain information.
5. How We Protect Your Data
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, alteration or disclosure.
These measures include:
- Secure HTTPS encryption on cravve.co
- Use of reputable payment gateways and service providers
- Access controls and limiting personal-data access to authorised personnel
- Security measures provided by Shopify and other technology providers
- Not intentionally storing complete payment card or banking credentials on our own systems
- Appropriate procedures for handling personal data
While we take reasonable precautions, no method of data transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security of personal data transmitted through or stored on the internet, but we remain committed to taking reasonable measures to protect the information under our control.
6. Your Rights
Subject to applicable law and any applicable limitations or exemptions, you may have the following rights regarding your personal data:
- Right of Access — You may request access to personal data that we hold about you. We may request reasonable information to verify your identity before processing the request.
- Right to Correct — You may request that inaccurate or incomplete personal data be corrected.
- Right to Withdraw Consent — Where processing is based on consent, you may withdraw your consent, subject to applicable legal or contractual restrictions.
- Right to Opt Out of Marketing — You may opt out of promotional emails or WhatsApp marketing communications at any time.
- Right to Request Deletion — You may request deletion of your personal data where legally permissible.
These rights are not absolute and may be subject to applicable legal requirements, exemptions or legitimate reasons for retaining information.
To exercise your rights, please contact us at:
Email: hello@cravve.co
We may need to verify your identity before processing certain requests.
7. Account and Login Security
Where you create an account on cravve.co, you are responsible for maintaining the confidentiality of your login credentials.
You should:
- Keep your login credentials confidential
- Not share your password with another person
- Take reasonable steps to secure your account
- Notify us promptly if you suspect unauthorised access to your account
Where permitted by applicable law, we will not be responsible for losses arising directly from your failure to maintain the security of your account credentials.
8. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to improve your browsing and shopping experience and to understand how visitors use cravve.co.
Types of Cookies and Tracking Technologies We May Use
- Essential cookies — required for the website and checkout to function properly
- Analytics cookies — used to understand website traffic and customer interactions, including through Google Analytics
- Marketing cookies and pixels — used by services such as Meta and TikTok to measure advertising effectiveness and, where applicable, provide relevant advertising
You may disable or manage certain cookies through your browser settings or other available cookie controls. Please note that disabling essential cookies may affect certain website or checkout functions.
9. Third-Party Links
Our website or communications may contain links to third-party websites, applications or platforms, including social media platforms.
We are not responsible for the privacy practices, security or content of third-party websites or services that we do not control.
We encourage you to review the privacy policies and terms of third-party websites before submitting personal data to them.
10. International Data Transfers
Some of our service providers, including Shopify, payment providers, analytics providers, marketing platforms and cloud or technology providers, may be located outside Malaysia or may process information using systems located outside Malaysia.
As a result, your personal data may be transferred, stored or processed outside Malaysia where reasonably necessary for the purposes described in this Privacy Policy.
Where required by applicable Malaysian law, we will take appropriate steps and comply with applicable requirements relating to cross-border transfers of personal data.
11. Children's Privacy
Our website and services are not intentionally directed towards children.
We do not knowingly collect personal data from children where such collection is prohibited by applicable law.
If you believe that we have inadvertently collected personal data from a child in circumstances where we should not have done so, please contact us and we will review the matter and take appropriate action.
12. Changes to This Policy
We reserve the right to update or amend this Privacy Policy from time to time to reflect changes to:
- Our business
- Our website
- Our products or services
- Our data processing practices
- Our service providers
- Applicable laws or regulations
- Other operational requirements
Any changes will be published on this page with an updated effective date. We encourage you to review this Privacy Policy periodically.
13. Contact Us
If you have any questions, concerns or requests regarding this Privacy Policy or the handling of your personal data, please contact us:
Crafton Group Sdn Bhd
Operating as cravve.
Email: hello@cravve.co
Website: cravve.co
This Privacy Policy is governed by the laws of Malaysia.