Legal

Privacy Policy

Version 1.0.0 · Effective date 2026-07-25

This Privacy Policy explains how Empire Kreatives Limited (“we”, “us”, “Empire Kreatives”) handles personal data when you use https://empirekreatives.com and related ordering tools. It is written with the Malawi Data Protection Act, 2024 in mind. It does not claim certification, registration status, or a filed DPA notice beyond what is stated here.

1. Controller identity and contact

Legal entity: Empire Kreatives Limited
Registration number: TMBRS 1010034
Principal place of business: Area 58/NJW/8033K, Lilongwe, Malawi
Website: https://empirekreatives.com

Contact for privacy and data-subject requests:

2. Categories of personal data

Depending on how you use the service, we may process:

  • Account and identity: email address; name/profile fields from Google OAuth when you choose that sign-in (scopes: openid, email, profile via our authentication provider); session identifiers.
  • Order and contact details: full name, email, phone, company/brand details, delivery preferences and notes, cardholder names/titles/contact lines you enter for print.
  • Artwork and uploads: logos and related files you upload for design/print fulfilment.
  • Payment-related data: when online payment is enabled, payment references and verification outcomes needed to confirm payment to Empire. Card details are handled by the payment provider — not stored as Empire card numbers. Online payment checkout is currently dormant/disabled in product.
  • Technical and preference data: auth and order-flow cookies, theme preference, and consent preference — see the Cookie Notice.
  • Analytics (optional): pseudonymous usage events only after you grant Analytics consent. Necessary consent alone does not enable Analytics or Marketing.

3. Purposes

  • Create and manage your account / sign-in session
  • Save drafts, resume orders, and fulfil paid print jobs
  • Communicate about your order (email / WhatsApp as applicable)
  • Process payments when online payment is enabled
  • Secure the service and prevent abuse
  • Optional analytics only after Analytics consent — tags remain dormant until that consent is recorded

4. Lawful bases (Malawi Data Protection Act, 2024)

We rely on bases that typically apply to this kind of service, including:

  • Contract / steps prior to contract: processing needed to take and fulfil your order (account, draft, artwork, delivery, payment verification when enabled).
  • Legitimate interests: keeping sessions secure, preventing fraud/abuse, and improving reliability of the ordering tools — balanced against your rights.
  • Consent: optional analytics and marketing (none active until the matching consent categories are accepted) and any other optional processing we clearly ask you to opt into.
  • Legal obligation: retaining payment, accounting, tax, dispute, or regulatory records where required by law.

5. Processors and service providers

Empire Kreatives uses service providers for hosting, authentication, analytics, communications, and payment processing. Some providers may process information outside Malawi. Empire Kreatives maintains appropriate contractual, security, and cross-border-transfer safeguards for those arrangements.

We do not publish exact infrastructure regions or data-centre locations of individual providers on this public page.

6. International transfers

When you use features that rely on our service providers, your personal data may be processed outside Malawi. We use contractual, security, and transfer safeguards appropriate to those arrangements. Contact empirekreatives@gmail.com if you need more detail about a specific processing activity.

7. Retention

Empire Kreatives does not retain all personal data permanently. We keep information only for the periods below, or longer where required by law, an open complaint, investigation, dispute, or regulatory obligation.

  • Auth sessions: browser auth cookies are configured with a persistent maxAge of about 400 days (session refresh model).
  • Unpaid / abandoned drafts and unpaid logo uploads: eligible for deletion 90 days after last update.
  • Confirmed unpaid orders: retained for 180 days after last update unless a complaint, investigation, or dispute remains open.
  • Paid order, payment, accounting, and tax records: retained for 7 years from the order date, or longer where required by law, an investigation, dispute, or regulatory obligation.
  • Paid logos and production/print assets: retained for 24 months after fulfilment unless required for an open complaint, reprint, dispute, investigation, or legal obligation. Related financial order metadata still follows the 7-year rule above.
  • Consent and consent-withdrawal evidence: retained for 24 months.
  • Server, Traefik, and application logs: retained for 90 days, or the hosting provider’s minimum period if longer.
  • Backups: follow hosting-provider backup expiry periods. Deleted information may remain temporarily in protected backups until those backups expire.
  • Draft locator cookie (ek_v2_draft_id): up to 60 days.
  • Conversion / mid-sign-in cookies: short-lived (minutes), as described in the Cookie Notice.

You may request deletion subject to the exceptions above. See Your rights below.

8. Security

We apply practical security measures appropriate to an online ordering service, including HTTPS in production, server-side ownership checks for drafts and uploads, and payment verification that does not treat browser return URLs as proof of payment. No method of transmission or storage is perfectly secure.

9. Your rights

Subject to the Malawi Data Protection Act, 2024 and applicable exceptions, you may request:

  • Access to your personal data
  • Rectification of inaccurate data
  • Deletion
  • Restriction of processing
  • Portability of data you provided, where applicable
  • Objection to processing based on legitimate interests
  • Withdrawal of consent where processing relies on consent

To exercise rights, email empirekreatives@gmail.com. We may need to verify your identity before acting.

10. Complaints — Malawi Data Protection Authority

If you are not satisfied with our response, you may contact the Malawi Data Protection Authority at info@dpa.mw. Listing this address is for complaint routing only — it is not a claim of certification or registration status.

11. Children’s data

The service is not directed at children under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided data, contact us so we can delete it.

12. Personal data breaches

If a personal data breach occurs that is likely to affect your rights, Empire Kreatives will assess the incident and notify affected individuals and/or the Authority where required by law. We aim to notify the Authority within applicable statutory timelines (including any 72-hour expectation where it applies).

13. Version and changes

This is version 1.0.0, effective date 2026-07-25. Material updates will be posted on this page with a new version number.