Privacy Policy

Our Privacy Policy was first posted on 16 Feb 2020.

Last updated: 21 October 2026.

This Privacy Policy explains what personal data MobileMall collects when you use mobilemall.co and its country sites, why we collect it, who we share it with, how long we keep it and the rights you have. It is written for visitors from the United States and from each of the 23 countries that have their own MobileMall site. MobileMall follows the data protection law of each of these countries, and the “Country and Regional Information” section explains, country by country, what that law says and how you can use your rights under it.

Who We Are

MobileMall ("we", "us", "our") publishes mobile phone prices and specifications. MobileMall is a registered company in Pakistan under the Securities and Exchange Commission of Pakistan (SECP), operating since 2016. For this website we decide why and how personal data is processed, which makes us the "controller" (in some laws the "data fiduciary", "business", "operator", "personal information handler" or "personal information controller"). You can reach us about anything in this policy at [email protected].

We do not sell phones or anything else on these sites, we do not take payments, and we do not send marketing emails or newsletters.

Websites This Policy Covers

This policy applies to mobilemall.co (our United States site) and all of its country subdomains (canada.mobilemall.co, india.mobilemall.co, kuwait.mobilemall.co, malaysia.mobilemall.co, nepal.mobilemall.co, philippines.mobilemall.co, qatar.mobilemall.co, saudiarabia.mobilemall.co, singapore.mobilemall.co, srilanka.mobilemall.co, uae.mobilemall.co, uk.mobilemall.co, indonesia.mobilemall.co, china.mobilemall.co, brazil.mobilemall.co, russia.mobilemall.co, morocco.mobilemall.co, algeria.mobilemall.co, nigeria.mobilemall.co, iran.mobilemall.co, thailand.mobilemall.co, egypt.mobilemall.co, vietnam.mobilemall.co). The country sites share this policy and link to it. mobilemall.pk and mobilemall.com.bd have their own policies. Websites we link to, including stores and Google, have their own privacy policies.

Personal Data We Collect

When You Browse

Device and usage data: IP address, browser and device type, operating system, language, the pages you open, the site that referred you, and the date and time of your visit. Our hosting provider and Cloudflare record this in server and security logs.
Approximate location: the country or city that can be worked out from your IP address. We do not collect precise GPS location.
Cookie and similar identifiers: see “Cookies, Analytics and Advertising” below.
Your compare list is kept in your own browser (local storage) and is not sent to us.

When You Give Us Information

Google sign-in (optional): if you choose “Continue with Google”, Google shares your name, email address, profile picture and Google account ID with us. We never see your Google password. You can remove MobileMall's access at any time in your Google Account settings under Security, “Your connections to third-party apps & services”.
Email and password account (optional): your name, email address and a securely hashed form of your password. We cannot read your password.
Ratings and comments: your name (shown with your comment), your star rating and comment text (public), your email address if you give it (optional, never shown), and the IP address, browser details and a device cookie we use to allow one rating per phone per device and to stop spam.
Contact and advertising forms, and emails to us: your name, email address, phone number if you give it, your message, and the details of your company and campaign for advertising inquiries.

We do not ask for sensitive data such as health, religion, ethnic origin, biometric, government ID or financial account details, and we ask you not to include it in comments or messages.

Spam and Abuse Protection

Our forms are protected by Cloudflare Turnstile, which checks that a visitor is human using signals from your browser and device. Cloudflare also protects and delivers our website, which means it processes IP addresses and request data for security and performance.

Cookies, Analytics and Advertising

Cookies are small files a website stores in your browser. Similar technologies include local storage and pixels. We use:

Strictly necessary cookies — keep you signed in, protect forms, remember your cookie choices and limit ratings to one per device. These do not need consent.
Analytics cookies (Google Analytics) — count visits and show which pages are used, so we can improve the site. Reports are aggregated; we do not use them to identify you.
Advertising cookies (Google AdSense) — third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and other sites on the internet.

Where the law of your country requires consent for analytics or advertising cookies, we ask for it in a cookie banner before those cookies are set, and you can change your choice at any time from the cookie settings link. Your country's section below says what applies to you. Where you have not consented to personalized ads, or where personalized ads are not allowed, Google may still show non-personalized ads, which are based on the page you are viewing and your general location and use cookies only for purposes such as frequency capping, fraud prevention and measurement.

You can opt out of personalized advertising by Google at Google Ads Settings, and from many other vendors at aboutads.info (USA), youradchoices.ca (Canada) or youronlinechoices.com (UK).
Learn how Google uses information from sites that use its services.
You can block or delete cookies in your browser settings. The site still works, but you will have to sign in again and repeat your cookie choice.
We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of your personal data and of targeted advertising. Our site does not respond to the older “Do Not Track” signal, for which there is no common standard.

How and Why We Use Personal Data

Each use below shows the legal basis we rely on. Some countries only allow consent or a short list of other grounds; your country's section below explains which basis applies there.

To run the website and show you prices for your country — needed to provide the service you ask for, and our legitimate interest in running a useful website.
To manage your account, ratings and comments, including moderation — needed to provide the service you signed up for, or your consent.
To answer your messages and advertising inquiries — needed to reply to your request, or your consent.
To measure use of the site with analytics — your consent where required, otherwise our legitimate interest in improving the site.
To show ads that pay for the site — your consent where required, otherwise our legitimate interest in funding a free website.
To keep the site secure and prevent spam, fraud and abuse — our legitimate interest, and legal obligations.
To comply with the law and respond to lawful requests from authorities.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Spam filters may hold a comment for manual review.

Who We Share Personal Data With

Service providers that run parts of the service for us under contract: website hosting, Cloudflare (security, delivery and Turnstile), email delivery, and Google (sign-in, Analytics and AdSense).
Google and its advertising partners, which collect cookie identifiers and browsing data on our site to show and measure ads (see “Cookies, Analytics and Advertising”).
Other visitors see your name, rating and comment when you post a comment. Your email address is never shown.
Authorities, courts or advisers when the law requires it, or to protect our users, the public or MobileMall.
A buyer or successor if MobileMall or the website is sold or merged; this policy would continue to protect your data.

We do not sell personal data for money, we do not rent our users' email addresses, and we do not send marketing emails.

Some US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), treat letting advertising partners collect cookie identifiers and browsing data on our site for personalized ads as a “sale” or “sharing” of personal information, or as “targeted advertising”, even when no money changes hands. In the last 12 months, identifiers (such as cookie IDs and IP addresses) and internet activity (pages viewed) may have been made available in this way to Google and its advertising partners. We do not knowingly sell or share the personal information of anyone under 16.

You can opt out at any time, and you do not need an account to do so:

Choose “Do Not Sell or Share My Personal Information” in our cookie settings; or
Turn on Global Privacy Control in your browser — we honor it automatically for that browser, and our cookie settings show that your opt-out has been applied; or
Email [email protected] with the subject “Do Not Sell or Share”.

After you opt out, we stop personalized advertising for your browser; you may still see non-personalized ads. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

How Long We Keep Personal Data

Account data: while your account exists. When you delete your account, we delete or anonymize it, except where we must keep something by law.
Ratings and comments: while they are published. You can ask us to delete them at any time.
Messages and advertising inquiries: as long as needed to deal with your request and any follow-up,.
Security logs and IP addresses used against spam: for a short period, unless needed to investigate abuse.
Analytics and advertising data: as set by Google's retention settings and policies.
Data you have withdrawn consent for: we stop using it and delete it within the time your law sets (for example 30 days in Russia), unless another legal basis lets us keep it.

How We Protect Personal Data

The site is served over HTTPS, passwords are stored only in hashed form, access to personal data is limited to the people who need it, and our providers are bound by contract to protect it. No method of transmission or storage is completely secure, but we work to protect your data.

If a personal data breach happens, we act to contain it, and we notify you and the data protection authority where the law requires, within the time your law sets. These deadlines differ by country (for example 72 hours to the regulator in the UK, Nigeria and Saudi Arabia, 24 hours in Kuwait and Russia, 3 business days in Brazil) and are listed in your country's section.

International Transfers

MobileMall is run from Pakistan, and our service providers, including Google and Cloudflare, process data in many countries, including the United States. Your personal data is therefore processed outside your country, including in countries whose laws give a different level of protection. We make these transfers only on a basis your law allows: for example a transfer that is needed to provide the service you ask for, your consent, contracts with standard data protection clauses, or the providers' own approved transfer mechanisms. Your country's section names the basis we use there.

Children

MobileMall is a general-audience website and is not directed to children. You must be at least 13, or the age at which your country's law lets you agree to the use of your personal data on your own if that is higher (for example 14 in China and Quebec, 15 in Egypt, 16 in Sri Lanka, 18 in India, Malaysia and Nigeria, and 20 in Thailand), to create an account or post a comment. We do not knowingly collect personal data from children below that age, and we do not knowingly use children's data for personalized ads or profiling. If you believe a child has given us personal data, contact us and we will delete it.

Your Rights

Wherever you live, you can ask us to:

tell you what personal data we hold about you, how we use it and who we share it with, and give you a copy;
correct data that is wrong or incomplete;
delete your data, your account, your ratings or your comments;
stop or restrict using your data, or object to how we use it;
give you your data in a portable format;
withdraw a consent you gave, as easily as you gave it, without affecting what was done before.

Send your request to [email protected]. We may need to confirm your identity first, usually by asking you to reply from the email address linked to your account or comment. You can use an authorized agent or, where your law provides for it, a nominee or guardian. We reply within one month, unless your law sets a different deadline (listed in your country's section), and we will never treat you differently for using your rights. If you are not satisfied with our answer, you can complain to us again, and you can also complain to the data protection authority in your country.

Country and Regional Information

MobileMall follows the data protection and privacy laws of the United States and of every country that has a MobileMall site, and we review this policy when those laws change. The sections below explain, for each country, the law that applies, the legal basis and cookie rules we follow there, your rights and how to use them, how we handle transfers and breaches, the rules for children, and where to complain. Where a law gives you more protection than this policy, that law applies and we follow it.

United States

Laws: the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and its regulations, and the comprehensive privacy laws in force in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, as well as the federal Children's Online Privacy Protection Act (COPPA) and state data breach laws. We give the rights below to every US visitor, whether or not a particular state law applies to us.
What we collect (notice at collection): identifiers (name, email address, IP address, cookie and device IDs), internet or network activity (pages viewed, referring site), approximate location derived from IP address, and the content of comments and messages. We collect them from you, from your browser, and from Google when you use Google sign-in, for the purposes and periods described above. We do not collect sensitive personal information other than your account password, which we use only to sign you in.
Sale, sharing and targeted advertising: identifiers and internet activity may be made available to Google and its advertising partners for personalized ads, which these laws may treat as a “sale”, “sharing” or “targeted advertising”. You can opt out as described in “Do Not Sell or Share My Personal Information” above, and we honor Global Privacy Control as a valid opt-out in every state.
Your rights: to know or access the personal information we hold and how we use and disclose it, to correct it, to delete it, to get a portable copy, to opt out of sale, sharing, targeted advertising and profiling, and not to be discriminated against for using these rights. You or an authorized agent can send a request to us by email. We confirm receipt within 10 business days and answer within 45 days; if we need more time (up to another 45 days) we tell you why.
Appeals: if we decline your request, you can appeal by replying to our decision. We answer appeals within the time your state sets (generally 45 to 60 days), and if we deny the appeal you can contact your state Attorney General.
Children (COPPA): our sites are not directed to children under 13 and we do not knowingly collect their personal information or use it for targeted advertising. If we learn we have, we delete it.
Data breaches: we notify affected residents, and the state Attorney General where required, within the time state law sets (in California, within 30 days of discovering a breach).
Complaints: California residents can contact the California Privacy Protection Agency or the California Attorney General; residents of other states can contact their state Attorney General; anyone can report to the Federal Trade Commission.

Algeria

Law: Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended by Law No. 25-11 of 24 July 2025. It is supervised by the Autorité Nationale de Protection des Données à caractère Personnel (ANPDP).
Legal basis: we process your personal data with your express consent, or where the law allows it without consent, for example to provide the service you request or to meet a legal obligation.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner, and you can withdraw it at any time.
Your rights: to be informed, to access your data, to have it corrected, updated or deleted (we act on correction requests within 10 days, free of charge), to object to its processing, including for advertising, and not to be subject to decisions based solely on automated processing. Send your request to us by email.
Transfers: your data is processed outside Algeria, in Pakistan and by Google and Cloudflare worldwide, under the conditions the law sets for transfers abroad, including your express consent and the need to provide the service you ask for.
Breaches: we notify the ANPDP of a breach that may affect your data within 5 days of becoming aware of it where the law requires, and we inform you where it is likely to put your rights at risk.
Children: a child's data is processed only with the consent of their legal representative. Children should not create an account or post a comment.
Complaints: you can complain to the ANPDP.

Brazil

Law: the Lei Geral de Proteção de Dados Pessoais (LGPD, Law No. 13,709/2018) and the regulations of the Autoridade Nacional de Proteção de Dados (ANPD), and, for children and adolescents, the Digital Statute of Children and Adolescents (ECA Digital, Law No. 15,211/2025, in force since March 2026).
Legal basis: providing the service you request, our legitimate interests (running, securing and improving the site, which we have balanced against your rights), compliance with legal obligations, and your consent for analytics and personalized advertising.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner; strictly necessary cookies do not need consent.
Your rights: confirmation that we process your data, access, correction of incomplete, inaccurate or outdated data, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who we share data with and about the consequences of refusing consent, withdrawal of consent, and review of decisions based solely on automated processing. We confirm processing and give simplified access immediately, and a full statement within 15 days of your request.
Data protection officer (encarregado): you can contact our encarregado at [email protected].
Transfers: your data is processed outside Brazil, in Pakistan and by Google and Cloudflare worldwide, using the mechanisms of LGPD article 33 and ANPD Resolution No. 19/2024, such as standard contractual clauses, or where the transfer is needed to provide the service you asked for.
Breaches: we notify the ANPD and you within 3 business days of becoming aware of a security incident that may cause you significant risk or harm.
Children and adolescents: our site is not directed to children or adolescents. We do not knowingly create profiles of anyone under 18 for advertising. A child under 12 may only use features that collect personal data with a parent's consent.
Complaints: you can complain to us first, and then to the ANPD.

Canada

Laws: the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25.
Consent: we collect, use and disclose personal information with your consent for the purposes described in this policy. We rely on express consent for advertising cookies and implied consent where it is reasonable, for example to reply to a message you send us. You can withdraw consent at any time, subject to legal or contractual limits.
Cookies and ads: you can refuse or withdraw consent to advertising and analytics cookies in our cookie settings. For Quebec residents, technologies that can identify, locate or profile you are turned off by default and only turned on if you choose to activate them.
Your rights: to access the personal information we hold about you and learn how it has been used and disclosed, to have it corrected, and to withdraw consent. Quebec residents can also ask us to stop disseminating their information or to de-index it, get a copy in a structured, commonly used technological format, and be informed about automated decisions. We answer within 30 days; if we need up to 30 more days we tell you why.
Person in charge of personal information: for Quebec and for privacy questions in Canada, contact our person in charge of the protection of personal information at [email protected].
Transfers: your information is processed outside Canada (and outside Quebec), in Pakistan and by Google and Cloudflare worldwide. We remain responsible for it, protect it by contract and assess the protection it will receive before it leaves Quebec. It may be accessible to courts and authorities in those countries.
Breaches: if a breach creates a real risk of significant harm to you (in Quebec, a risk of serious injury), we notify you and the Office of the Privacy Commissioner of Canada (or the Commission d'accès à l'information), and we keep a record of every breach.
Children: in Quebec, the personal information of a child under 14 is only collected with a parent's or guardian's consent.
Complaints: you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

China

Law: the Personal Information Protection Law (PIPL), the Network Data Security Management Regulations, and the Cyberspace Administration of China (CAC) rules on cross-border data transfers, including the Provisions on Promoting and Regulating Cross-Border Data Flows (2024) and the certification measures for cross-border transfers (in force since 1 January 2026).
Legal basis: your consent, or where the PIPL allows processing without consent, for example to perform a contract with you (your account) or to meet a legal obligation. Where the PIPL requires separate consent, we ask for it separately.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner. You can refuse personalized advertising and still use the site.
Transfers outside China: your personal information is processed outside China. With your separate consent, it is received by MobileMall (Pakistan, contact: the email below) and by Google LLC and Cloudflare, Inc. (United States, and their data centers worldwide; contact through their privacy policies), for the purposes and categories of data described in this policy. You can exercise your rights against these recipients by contacting us.
Your rights: to know and decide how your personal information is processed, to restrict or refuse processing, to access and copy it, to transfer it to another handler where the conditions are met, to correct, complete and delete it, to withdraw consent, and to ask us to explain this policy. A close relative may exercise certain rights over a deceased person's information. We reply promptly, and within one month.
Breaches: if a personal information leak, alteration or loss occurs or may occur, we take remedial measures immediately and notify the authorities and you as the PIPL requires.
Children: the personal information of children under 14 is sensitive and is only processed with a parent's or guardian's consent. Children under 14 should not create an account or post a comment.
Complaints: you can complain to us, and to the Cyberspace Administration of China or another authority responsible for personal information protection.

Egypt

Law: the Personal Data Protection Law (Law No. 151 of 2020) and its Executive Regulations issued in late 2025, supervised by the Personal Data Protection Center (PDPC).
Legal basis: your explicit consent, or another ground the law allows, such as providing the service you request or meeting a legal obligation. You can withdraw your consent at any time.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner. We do not send you electronic marketing.
Your rights: to know what personal data we hold and to access it, to withdraw your consent, to have your data corrected, edited, updated or erased, to limit its processing to a specific scope, to be told of a breach affecting your data, and to object to processing that is not in line with your fundamental rights. Send your request to us by email; we answer within the time the Executive Regulations set.
Transfers: your data is processed outside Egypt, in Pakistan and by Google and Cloudflare worldwide. Transfers are made only under the conditions of the law and its Executive Regulations.
Breaches: we notify the PDPC within 72 hours of becoming aware of a breach and inform you within 3 working days after notifying the PDPC.
Children: personal data of a child under 15 is only processed with the consent of a guardian. Children should not create an account or post a comment.
Complaints: you can complain to the Personal Data Protection Center (PDPC).

India

Laws: the Information Technology Act, 2000 and the Reasonable Security Practices and Sensitive Personal Data or Information Rules, 2011 apply today. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 are coming into force in phases: the Data Protection Board of India was set up from 13 November 2025, and the duties on notice, consent, rights, breaches, children and transfers apply from 13 May 2027. We already follow the DPDP Act.
Legal basis: your consent, given freely and for the specific purposes in this notice, or a legitimate use the DPDP Act allows (for example information you provide voluntarily for a purpose such as a message to us). You can withdraw consent as easily as you gave it, and we then stop processing the data for that purpose.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to a summary of your personal data and how it is processed and of who we have shared it with, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights in case of death or incapacity. You can ask to read this notice in English or in any language listed in the Eighth Schedule to the Constitution.
Grievance officer: send grievances and requests to our grievance officer at [email protected]. We acknowledge them promptly and resolve them within one month.
Transfers: your data is processed outside India, in Pakistan and by Google and Cloudflare worldwide. Transfers are allowed under the DPDP Act except to countries the Government of India restricts, and we will follow any such restriction.
Breaches: we inform affected users without delay and the Data Protection Board, followed by a detailed report within 72 hours, as the DPDP Rules require, and report cyber incidents to CERT-In where Indian rules require.
Children: a child under 18 may only use features that collect personal data with the verifiable consent of a parent or lawful guardian. We do not track or behaviorally monitor children or target ads at them.
Complaints: if our grievance officer has not resolved your complaint, you can complain to the Data Protection Board of India.

Indonesia

Law: the Personal Data Protection Law (Law No. 27 of 2022, the PDP Law), fully in force since 17 October 2024, and its implementing government regulation. The Ministry of Communication and Digital Affairs (Komdigi) supervises it until the personal data protection agency is set up.
Legal basis: your explicit consent for the specific purposes in this notice, or another basis the PDP Law allows, such as performing a contract with you (your account), a legal obligation or our legitimate interests.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to information about the processing, to access and get a copy of your data, to correct and complete it, to end processing and delete or destroy it, to withdraw consent, to object to decisions based solely on automated processing including profiling, to delay or restrict processing, to data portability, and to claim compensation for a violation. We act on most requests within 3 × 24 hours, as the PDP Law requires.
Transfers: your data is processed outside Indonesia, in Pakistan and by Google and Cloudflare worldwide, on the bases the PDP Law allows: adequate protection in the receiving country, appropriate binding safeguards, or your consent.
Breaches: we notify you and the authority in writing within 3 × 24 hours of a personal data protection failure.
Children: a child's personal data is only processed with the consent of a parent or guardian. Children should not create an account or post a comment.
Complaints: you can complain to us, and to Komdigi or the personal data protection agency once it is established.

Iran

Law: Iran does not yet have a single comprehensive data protection law; a Personal Data Protection Bill approved by the Cabinet in 2024 has not been enacted. The Constitution protects privacy, and the Electronic Commerce Law (2003) and the Computer Crimes Law (2009) protect personal data in electronic communications and commerce.
How we protect you: we apply all of this policy to visitors from Iran: we collect personal data only for the purposes described here, with your consent where needed, keep it secure and give you the rights listed in “Your Rights”.
Cookies and ads: you can refuse analytics and advertising cookies in our cookie settings.
Transfers: your data is processed outside Iran, in Pakistan and by Google and Cloudflare worldwide, to provide the service you ask for.
Breaches: if a breach puts your data at risk, we will tell you.
Complaints: contact us by email; we will follow any new data protection law and regulator as soon as they exist.

Kuwait

Law: the Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority (CITRA Resolution No. 26 of 2024) and the Electronic Commerce Law (Law No. 20 of 2014).
Legal basis: your consent, given after we explain the service, the purpose of the processing and how your data is used, or another basis the regulation allows.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to be informed, to access, change and delete your data, and to withdraw your consent, after which we delete the data unless the law requires us to keep it.
Transfers: your data is processed outside Kuwait: in Pakistan (MobileMall), and in the United States and other countries where Google and Cloudflare run their services. It is protected there by HTTPS encryption, access controls and our providers' contractual security commitments.
Breaches: we notify CITRA within 24 hours of becoming aware of a breach, and inform you unless the measures we have taken make that unnecessary.
Children: children should not create an account or post a comment without a parent's or guardian's consent.
Complaints: you can complain to CITRA.

Malaysia

Law: the Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024, fully in force since 1 June 2025, and the Personal Data Protection Commissioner's guidelines.
Legal basis: your consent for the purposes in this notice, or another ground the Act allows, such as performing a contract with you or a legal obligation.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to access your personal data and have it corrected (we answer within 21 days), to withdraw consent, to prevent processing likely to cause damage or distress, to stop processing for direct marketing, and to data portability. You can choose not to give us data; you can still browse the site, but cannot create an account or comment without it.
Transfers: your data is processed outside Malaysia, in Pakistan and by Google and Cloudflare worldwide, on the bases section 129 of the Act allows, such as your consent, a transfer needed to provide the service you ask for, or binding contractual safeguards.
Breaches: we notify the Personal Data Protection Commissioner within 72 hours of a breach that causes or may cause significant harm, and inform you within 7 days after that.
Children: a child under 18 needs the consent of a parent or guardian. Children should not create an account or post a comment.
Complaints: you can complain to the Personal Data Protection Commissioner.

Morocco

Law: Law No. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data and its implementing decree, supervised by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), including its rules on cookies.
Legal basis: your unambiguous consent, or another ground the law allows, such as providing the service you request, meeting a legal obligation or our legitimate interests where they do not override your rights.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to be informed, to access your data, to have it corrected, updated or deleted (we act on correction requests within 10 days, free of charge), and to object to its processing for legitimate reasons, and at any time and free of charge to its use for advertising.
Transfers: your data is processed outside Morocco, in Pakistan and by Google and Cloudflare worldwide. Transfers follow articles 43 and 44 of Law 09-08 and are made with your express consent or where they are needed to provide the service you ask for.
Breaches: if a breach puts your data at risk, we will tell you and cooperate with the CNDP.
Children: children should not create an account or post a comment without a parent's or guardian's consent.
Complaints: you can complain to the CNDP.

Nepal

Law: the Constitution of Nepal (Article 28), the Individual Privacy Act, 2075 (2018) and the Individual Privacy Regulation, 2077 (2020), and the Electronic Transactions Act, 2063 (2008).
Legal basis: we collect and use personal information only with your consent or as the law allows, and only for the purposes described in this policy.
Cookies and ads: you can refuse analytics and advertising cookies in our cookie settings.
Your rights: to know what personal information we hold, to have it corrected or updated, to have it deleted, and to withdraw your consent. Send your request to us by email.
Transfers: your data is processed outside Nepal, in Pakistan and by Google and Cloudflare worldwide, to provide the service you ask for.
Breaches: if a breach puts your data at risk, we will tell you.
Children: children should not create an account or post a comment without a parent's or guardian's consent.
Complaints: Nepal has no separate data protection authority. You can complain to us, and you can bring a complaint about a violation of the Individual Privacy Act before the competent District Court.

Nigeria

Law: the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025, in force since 19 September 2025, supervised by the Nigeria Data Protection Commission (NDPC).
Legal basis: your consent, performance of a contract with you (your account), legal obligations, and our legitimate interests in running and securing the site where they do not override your rights.
Cookies and ads: our cookie banner lets you accept or reject analytics and advertising cookies with equal ease before they are set; strictly necessary cookies do not need consent. We keep a record of your choice, and you can change it at any time.
Your rights: to be informed, to access your data and get a copy, to correction, to erasure, to restriction of processing, to data portability, to object, including to processing for advertising, not to be subject to decisions based solely on automated processing, and to withdraw consent at any time.
Transfers: your data is processed outside Nigeria, in Pakistan and by Google and Cloudflare worldwide, on a basis Part VIII of the NDPA allows, such as appropriate safeguards (including standard contractual clauses), your consent after being told of the risks, or a transfer needed to provide the service you ask for.
Breaches: we notify the NDPC within 72 hours of becoming aware of a breach likely to risk your rights, and inform you promptly if the risk is high.
Children: a child under 18 may only use features that collect personal data with the consent of a parent or guardian. Children should not create an account or post a comment.
Complaints: you can complain to the NDPC.

Philippines

Law: the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations and the circulars of the National Privacy Commission (NPC).
Legal basis: your consent, the performance of a contract with you (your account), legal obligations, and our legitimate interests where they do not override your rights. We ask for consent for analytics and advertising cookies.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to file a complaint and to damages. Your lawful heirs and assigns may exercise these rights on your behalf.
Data protection officer: you can contact our data protection officer at [email protected].
Transfers: your data is processed outside the Philippines, in Pakistan and by Google and Cloudflare worldwide. We remain responsible for it and protect it by contract, as the Act requires.
Breaches: we notify the NPC and affected users within 72 hours of knowing of a breach that requires notification.
Children: minors should not create an account or post a comment without a parent's or guardian's consent.
Complaints: please contact us first; if we do not resolve your concern, you can complain to the National Privacy Commission.

Qatar

Law: Law No. 13 of 2016 on the Protection of Personal Data Privacy (PDPPL) and the guidelines of the National Data Privacy Office of the National Cyber Security Agency (NCSA).
Legal basis: your consent, or a lawful purpose the law allows, such as providing the service you request or meeting a legal obligation.
Cookies and ads: analytics and advertising cookies are used only with your prior consent, given through our cookie banner. We do not send electronic marketing.
Your rights: to withdraw consent, to object to processing that is not necessary for its purpose or is excessive or unlawful, to have your data corrected or erased, to be told of processing and of any disclosure of inaccurate data, and to access your data. We answer within 30 days.
Transfers: your data is processed outside Qatar, in Pakistan and by Google and Cloudflare worldwide, in line with article 15 of the PDPPL.
Breaches: we notify the NCSA and you of a breach that may cause serious damage, within 72 hours as the NCSA guidelines provide.
Children: our site is not directed to children, and children should not create an account or post a comment without a parent's or guardian's consent.
Complaints: you can complain to the National Cyber Security Agency.

Russia

Law: Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, as amended, supervised by the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor). This policy is our policy on the processing of personal data under article 18.1 of that law.
Consent: where 152-FZ requires your consent, we ask for it separately from this policy and from any other text, specifically for the purposes, data and actions described, and you can withdraw it at any time by writing to us. After you withdraw it, we stop processing the data and destroy it within 30 days unless the law allows us to keep it.
Cookies and analytics: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to receive information about the processing of your personal data, to access it, to require us to clarify, block or destroy data that is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, to withdraw consent, and to appeal our actions. We answer within 10 working days, extendable by 5 working days with a reasoned notice.
Transfers: your data is processed outside Russia, in Pakistan and by Google and Cloudflare worldwide.
Breaches: if personal data is unlawfully transferred or leaked, we notify Roskomnadzor within 24 hours and report the results of our investigation within 72 hours.
Children: children should not create an account or post a comment without the consent of a parent or legal representative.
Complaints: you can appeal our actions to Roskomnadzor or in court.

Saudi Arabia

Law: the Personal Data Protection Law (Royal Decree No. M/19 of 1443H, as amended), fully enforceable since 14 September 2024, its Implementing Regulations and the Regulation on Personal Data Transfer outside the Kingdom, supervised by the Saudi Data and AI Authority (SDAIA).
Legal basis: your consent, or another basis the law allows: performing a contract with you (your account), a legal obligation, or our legitimate interests in running and securing the site.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner. We do not send marketing messages.
Your rights: to be informed, to access your data and get a copy in a readable format, to correct, complete or update it, to have it destroyed when it is no longer needed, and to withdraw your consent. We answer within 30 days; if we need up to 30 more days we tell you why.
Transfers: your data is processed outside the Kingdom, in Pakistan and by Google and Cloudflare worldwide, under the Transfer Regulation, using appropriate safeguards such as the standard contractual clauses issued by SDAIA or another permitted basis, after assessing the risks.
Breaches: we notify SDAIA within 72 hours of becoming aware of a breach that may harm you, and inform you without undue delay where it may cause you harm.
Children: the data of a person who lacks full legal capacity is processed only with the consent of their legal guardian. Children should not create an account or post a comment.
Complaints: you can complain to SDAIA.

Singapore

Law: the Personal Data Protection Act 2012 (PDPA) and its regulations, supervised by the Personal Data Protection Commission (PDPC).
Consent: we collect, use and disclose personal data with your consent, or deemed consent, for the purposes in this notice, or where the PDPA allows it without consent, for example for our legitimate interests in securing the site.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner, and you can withdraw it at any time.
Your rights: to access your personal data and learn how it has been used or disclosed in the past year, to correct it, and to withdraw consent (we will tell you the likely consequences). We answer as soon as reasonably possible; if we cannot answer within 30 days we tell you when we will.
Data protection officer: you can contact our data protection officer at [email protected].
Transfers: your data is processed outside Singapore, in Pakistan and by Google and Cloudflare worldwide, and is protected to a standard comparable to the PDPA by legally binding contracts.
Breaches: we notify the PDPC within 3 calendar days of assessing that a breach is notifiable (likely to cause significant harm or affecting 500 or more people), and inform affected users.
Children: children under 13 should not create an account or post a comment without a parent's or guardian's consent.
Complaints: you can complain to the PDPC.

Sri Lanka

Law: the Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, supervised by the Data Protection Authority of Sri Lanka. Its processing and controller obligations come into force on 1 January 2027 and the rights of data subjects on a date still to be announced; we already follow the Act.
Legal basis: your consent, performance of a contract with you (your account), legal obligations, and our legitimate interests where they do not override your rights.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to access your personal data, to withdraw consent, to rectification or completion, to erasure, and to ask for a review of decisions based solely on automated processing. We answer within one month; if we need up to two more months we tell you why.
Transfers: your data is processed outside Sri Lanka, in Pakistan and by Google and Cloudflare worldwide, under the conditions of section 26 of the Act, such as appropriate safeguards or your consent.
Breaches: we notify the Data Protection Authority and, where required, you, in the manner and time its rules set.
Children: the data of a child under 16 is only processed with the consent of a parent or guardian. Children under 16 should not create an account or post a comment.
Complaints: you can complain to the Data Protection Authority of Sri Lanka.

Thailand

Law: the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and the notifications of the Personal Data Protection Committee (PDPC).
Legal basis: performance of a contract with you (your account), legal obligations, our legitimate interests in running and securing the site where they do not override your rights, and your consent for analytics and advertising.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner, and you can withdraw it as easily as you gave it.
Your rights: to access and get a copy of your data and to learn how it was obtained without your consent, to data portability, to object, to erasure, to restriction, to rectification, and to withdraw consent. We answer access requests within 30 days.
Transfers: your data is processed outside Thailand, in Pakistan and by Google and Cloudflare worldwide, on a basis sections 28 and 29 of the PDPA allow, such as appropriate safeguards, your consent after being told about the receiving country's protection, or a transfer needed to provide the service you ask for.
Breaches: we notify the PDPC within 72 hours of becoming aware of a breach unless it is unlikely to risk your rights, and inform you without delay if the risk is high.
Children: a minor under 20 needs a parent's consent for features that collect personal data, and a child under 10 always does. Minors should not create an account or post a comment without that consent.
Complaints: you can complain to the Personal Data Protection Committee.

United Arab Emirates

Law: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Its Executive Regulations have not yet been issued, and we will follow them when they are. Free zones such as the DIFC and ADGM have their own laws, which do not apply to us.
Legal basis: your consent, or another basis the PDPL allows, such as performing a contract with you (your account) or meeting a legal obligation.
Cookies and ads: analytics and advertising cookies are used only with your consent, given through our cookie banner.
Your rights: to get information about the processing, to data portability, to correction and erasure, to restriction of processing, to stop processing, including for advertising, to object to decisions based solely on automated processing, and to withdraw consent.
Transfers: your data is processed outside the UAE, in Pakistan and by Google and Cloudflare worldwide, under articles 22 and 23 of the PDPL, including your express consent or a transfer needed to provide the service you ask for.
Breaches: we notify the UAE data protection authority and you of a breach that affects the privacy, confidentiality or security of your data, as the PDPL requires.
Children: children should not create an account or post a comment without a parent's or guardian's consent.
Complaints: you can complain to the UAE Data Office, or the federal authority that takes over its role.

United Kingdom

Laws: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.
Legal basis: the legal bases listed under “How and Why We Use Personal Data”: performance of a contract, legitimate interests (which we have balanced against your rights), legal obligation and consent.
Cookies and ads: advertising cookies are only set with your consent, given through our cookie banner. Analytics cookies used only to understand and improve our site may be set without consent, as the law now allows, because we tell you about them here and you can turn them off at any time in our cookie settings.
Your rights: to be informed, to access, to rectification, to erasure, to restrict processing, to data portability, to object to processing based on legitimate interests and at any time to processing for direct marketing including advertising profiling, not to be subject to solely automated decisions with significant effects, and to withdraw consent. We answer within one month; for complex or numerous requests we may extend this by two months and will tell you why.
Transfers: your data is processed outside the UK, in Pakistan and by Google and Cloudflare worldwide. Where UK law requires, we and our providers use the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses.
Breaches: we report a personal data breach to the Information Commissioner's Office within 72 hours unless it is unlikely to risk your rights, and tell you without undue delay if the risk is high.
Children: you must be 13 or older to create an account or post a comment.
Complaints: you can complain to us by email; we acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office.

Changes to This Policy

We update this policy when our website or the law changes. The “Last updated” date at the top shows the latest version. If a change significantly affects how we use your personal data, we will make that clear on the website and, where the law requires, ask for your consent again.

Contact Us

For any question, request or complaint about privacy, email [email protected] or use our contact page. Please mention which MobileMall site you use and, for a request about your data, the email address linked to your account or comment. Our data protection officer, grievance officer (India), encarregado (Brazil) and person in charge of the protection of personal information (Quebec) can all be reached at this address.