PRIVACY POLICY

Effective Date: May 2026  ·  Applies to all interactions with cravve.co and related communications


Overview

Crafton Group Sdn Bhd, operating as cravve. ('we', 'us', 'our'), is committed to protecting the personal data of our customers, waitlist members, and website visitors. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over your data.

This policy is prepared in compliance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. By using our website or purchasing from us, you consent to the practices described in this policy.


1. Personal Data We Collect

We collect personal data that you provide directly to us, as well as data collected automatically when you interact with our website.

1.1  Data You Provide to Us

  • Full name

  • Email address

  • WhatsApp or mobile number — collected via waitlist signup and checkout where applicable

  • Delivery address — collected at checkout

  • Payment information — processed securely by our payment gateway partners. We do not store your full card or banking details on our systems

  • Order details and purchase history

  • Any communications you send to us via email or contact forms

1.2  Data Collected Automatically

When you visit cravve.co, we may automatically collect the following through cookies and tracking technologies:

  • IP address and general location data

  • Browser type and device information

  • Pages visited, time spent on site, and browsing behaviour

  • Referral source — how you arrived at our website

We use Meta Pixel, TikTok Pixel, and Google Analytics on our website. These tools help us understand how visitors interact with cravve.co and improve the effectiveness of our advertising. Each of these tools operates under its own privacy policy.


2. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

2.1  To Process and Fulfil Your Order

  • To confirm and process your purchase or pre-order

  • To arrange delivery and share necessary details with our logistics partners

  • To send order confirmations, shipping updates, and delivery notifications

  • To handle cancellations, returns, refunds, and warranty claims

2.2  To Communicate With You

  • To respond to your enquiries, requests, and customer service matters

  • To send you important updates about your order or our products

  • To notify waitlist members when pre-orders open, including exclusive early access communications

2.3  For Marketing and Promotional Purposes

  • To send you promotional emails, product updates, new launches, and offers from cravve.

  • To send WhatsApp messages where you have provided your number and consented to communications

  • To deliver targeted advertising on platforms including Meta (Facebook and Instagram) and TikTok based on your interaction with our website

You may opt out of marketing communications at any time. See Section 6 for details.

2.4  To Improve Our Products and Services

  • To analyse website traffic and customer behaviour through Google Analytics, Meta Pixel, and TikTok Pixel

  • To improve our website experience, product offerings, and marketing campaigns

  • To conduct internal research and business planning



3. Who We Share Your Personal Data With

We do not sell your personal data to any third party. We share your data only where necessary to operate our business and fulfil your orders, as follows:

3.1  Logistics and Delivery Partners

We share your name, delivery address, and contact number with our courier and logistics partners solely for the purpose of delivering your order. These partners are required to handle your data securely and use it only for delivery purposes.

3.2  Payment Processing Providers

Your payment and billing information is processed by our authorised payment gateway partners. We do not store your full card or banking details on our systems. Payment providers process your data under their own privacy and security policies.

3.3  Marketing and Analytics Platforms

We use Meta Pixel, TikTok Pixel, and Google Analytics, which may collect and process data about your website activity in accordance with their respective privacy policies. These platforms may use your data to serve you relevant advertising across their networks.

3.4  Business Sale or Transfer

In the event that cravve. or Crafton Group Sdn Bhd sells, merges, or transfers any part of its business or assets to a third party, your personal data may be transferred as part of that transaction. In such an event, we will take reasonable steps to ensure that your data continues to be protected in accordance with this policy. Where required by law, we will notify you of any such transfer.

3.5  Legal and Regulatory Disclosure

We may disclose your personal data if required to do so by law, regulation, court order, or legal process. We may also disclose your data to regulators, auditors, legal advisors, or law enforcement authorities where we are legally obliged to do so, or where necessary to protect the rights, property, or safety of cravve., our customers, or others.

3.6  Future Third-Party Service Providers

If we engage third-party fulfilment, warehousing, or other service providers in the future, this policy will be updated accordingly. We will only share the minimum data necessary and require all partners to maintain appropriate data security standards.



4. How Long We Retain Your Data

  • Order and transaction data is retained for a minimum of 7 years in compliance with Malaysian accounting and tax requirements.

  • Waitlist data is retained until you request removal or until it is no longer required for the purpose it was collected.

  • Marketing contact data is retained until you opt out or request deletion.

  • Website analytics data is retained in accordance with the respective platform's data retention policies.

You may request deletion of your personal data at any time by contacting us at cravveco@gmail.com. We will process your request within a reasonable time, subject to any legal obligations we are required to fulfil.



5. How We Protect Your Data

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, or disclosure. These measures include:

  • Secure HTTPS encryption on cravve.co

  • Use of reputable, industry-standard payment gateways that are PCI-DSS compliant

  • Limiting access to personal data to authorised personnel only

  • Not storing full payment card or banking details on our own systems

While we take all reasonable precautions, no method of data transmission or storage over the internet is completely secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.



6. Your Rights

Under the Personal Data Protection Act 2010 (PDPA) of Malaysia, you have the following rights regarding your personal data:

  1. Right of Access — You may request a copy of the personal data we hold about you. To protect your privacy, we may request proof of identity before fulfilling any data access request. Accepted proof of identity includes your registered email address and order details.

  2. Right to Correct — You may request that we correct any inaccurate or incomplete personal data we hold about you.

  3. Right to Withdraw Consent — You may withdraw your consent to the processing of your personal data at any time, subject to legal and contractual restrictions.

  4. Right to Opt Out of Marketing — You may opt out of receiving marketing emails or WhatsApp messages from us at any time by replying to any marketing message with 'Unsubscribe' in the subject line, or by emailing hello@cravve.co with your opt-out request. We will process your request within 5 business days. Opting out of marketing does not affect transactional communications related to your orders.

  5. Right to Request Deletion — You may request that we delete your personal data, subject to any legal obligations that require us to retain certain records.


To exercise any of the above rights, please contact us at:

Email: hello@cravve.co

We aim to respond to all data-related requests within 14 business days.



7. Account and Login Security

Where you create an account on cravve.co, you are responsible for maintaining the confidentiality of your login credentials including your email address and password. You are responsible for all activity that occurs under your account.

  • Do not share your login credentials with any other person.

  • We strongly recommend that you do not use your browser's password auto-save function on shared or public devices, as this may allow other users to access your account and personal information.

  • If you suspect that your account has been accessed without your authorisation, please contact us immediately at cravveco@gmail.com.

We will not be held responsible for any loss or damage arising from your failure to keep your login credentials secure.



8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience and help us understand how visitors use cravve.co.

Types of Cookies We Use

  • Essential cookies — required for the website to function properly

  • Analytics cookies — used by Google Analytics to collect anonymous data about how visitors interact with our site

  • Marketing cookies — used by Meta Pixel and TikTok Pixel to measure the effectiveness of our advertising and to serve relevant ads

You may disable cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of our website.



9. Third-Party Links

Our website or communications may contain links to third-party websites or platforms, including social media platforms. We are not responsible for the privacy practices of any third-party websites. We encourage you to review the privacy policies of any external sites you visit before submitting any personal data to them.



10. Children's Privacy

Our products and services are not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately at cravveco@gmail.com and we will take steps to delete the information promptly.



11. Changes to This Policy

We reserve the right to update or amend this Privacy Policy at any time. Any changes will be published on this page with an updated effective date. We encourage you to review this policy periodically. Your continued use of cravve.co after any changes constitutes your acceptance of the updated policy.



12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at:


Crafton Group Sdn Bhd

Operating as cravve.

Email: cravveco@gmail.com

Website: cravve.co



This Privacy Policy is governed by the laws of Malaysia and prepared in accordance with the Personal Data Protection Act 2010 (PDPA). For any unresolved concerns, you may contact the Department of Personal Data Protection Malaysia at www.pdp.gov.my.


cravve.  ·  create what you cravve.  ·  cravve.co