Privacy Policy

Welcome to Mall of the World Online.

Mall of the World Online is a digital platform operated by BOSSROSSY (Pty) Ltd, a company registered in the Republic of South Africa.

Our company details are:

• Registered company name: BOSSROSSY (Pty) Ltd
• Trading name: Mall of the World Online
• CIPC registration number: 2025/598251/07
• Information Regulator registration number: 2026-067228
• Website: https://malloftheworld.store

We respect your privacy and are committed to protecting the personal information of visitors, customers, store owners, vendors, business contacts and other individuals who interact with our platform.

This Privacy Policy explains how we collect, use, store, disclose, retain and protect personal information when you visit our website, create an account, register a store, subscribe to our services, contact us or interact with our store listings.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), other applicable South African laws and, where applicable, other relevant data-protection laws.

Please read this Privacy Policy together with our Terms and Conditions and other applicable platform policies.

The responsible organisation for Mall of the World Online is:

BOSSROSSY (Pty) Ltd, trading as Mall of the World Online

Our designated Information Officer is:

• Name: Hlulani Nukeri
• Position: Information Officer
• Appointment date: 29 July 2025
• Information Regulator registration number: 2026-067228
• Privacy email: privacy@malloftheworld.co.za

For privacy-related questions, access requests, correction requests, objections or complaints, please contact us using the details above.

In this policy, “we”, “us” and “our” refer to BOSSROSSY (Pty) Ltd, trading as Mall of the World Online.

Mall of the World Online helps businesses gain online visibility, showcase their stores and products, and connect with potential customers.

Our platform may include:

1. Store accounts registered and managed directly on our platform.
2. Paid subscription services that provide access to selected platform features.
3. Listings of existing businesses and stores that link visitors to the businesses’ external websites.
4. Store information, product listings and other content submitted by registered users.

Some businesses listed on our platform may not have registered an account with us. We may identify businesses and use relevant publicly available business information to create or maintain directory listings, subject to applicable law.

A listing does not necessarily mean that the business has registered with us, entered into a commercial agreement with us or authorised us to process its payments.

Where a customer follows a link to an independent store’s external website, that website may have its own terms, privacy policy, checkout, payment arrangements and fulfilment processes.

Our role depends on the particular service being used. We explain these distinctions to help users understand how their personal information may be processed.

The information we collect depends on how you interact with our platform.

4.1 Website Visitors

When you visit our website, we may collect technical and usage information, including:

• IP address.
• Browser type and version.
• Device type and operating system.
• Pages visited and features used.
• Date, time and duration of visits.
• Referring website or page.
• Approximate location derived from technical information, where applicable.
• Cookie identifiers and similar technical information.

We use this information where necessary to operate, secure, maintain and improve our website and services.

4.2 Customer and Account Information

When you create or manage an account, we may collect:

• Full name.
• Email address.
• Telephone or mobile number, where requested.
• Username and account identifiers.
• Authentication and account-security information.
• Account preferences.
• Communications with our support team.
• Information you voluntarily provide when using our services.

We use this information to create and manage accounts, provide requested services, communicate with users and protect account security.

4.3 Store Owner and Vendor Information

When a business registers or operates a store on Mall of the World Online, we may collect:

• Store owner’s name and contact information.
• Email address and telephone number.
• Business or trading name.
• Company registration information, where provided.
• Business address, where provided.
• Store website URL.
• Store descriptions, logos and images.
• Product listings and related content.
• Account registration and verification records.
• Subscription plan and payment status.
• Communications relating to store management and platform services.

We collect information appropriate to the account type and the services being provided.

We do not claim to have verified a person’s identity or a company’s registration merely because the person has completed registration on our platform.

4.4 Email Verification and OTP Information

Our current store registration process includes verification through a One-Time Password (OTP) sent to the store owner’s email address.

We may process the email address, verification status, verification timestamps and related technical records to confirm access to the email address and protect the registration process.

Email OTP verification confirms access to the email address used during registration. It does not, by itself, establish the person’s legal identity, confirm business ownership or verify company registration.

Where additional verification measures are introduced, we will process any additional personal information in accordance with applicable law and provide further information where required.

4.5 Publicly Available Business Information

We may identify existing businesses and stores and use relevant publicly available business information to create or maintain listings on Mall of the World Online.

Depending on the source and the type of listing, this may include:

• Business or trading name.
• Public website address.
• Publicly displayed store information.
• Business description.
• Publicly listed business contact information.
• Publicly available logos, images or product information, where their use is lawful.

We use such information to help visitors discover businesses and access their websites.

Where information identifies an individual, including a sole proprietor or a person whose name or contact details are associated with a business, it may constitute personal information under POPIA.

We will process such information in accordance with applicable law. We will also consider requests to correct inaccurate information and objections to processing where applicable.

4.6 Subscription and Payment Information

Vendors may subscribe to paid plans for access to platform services.

When a subscription is purchased, we may process information such as:

• Subscriber or account identifier.
• Selected subscription plan.
• Subscription price and billing frequency.
• Payment status.
• Transaction references.
• Subscription start, renewal and cancellation dates.
• Payment-related notifications and records.

Payments for our own platform services may be processed through third-party payment providers.

Those providers may collect and process payment information, including card or banking details, in accordance with their own terms and privacy policies.

We do not intentionally store full payment-card numbers where those details are processed directly by the relevant payment provider.

We retain the transaction information reasonably necessary to manage subscriptions, maintain financial records, respond to disputes and comply with applicable legal obligations.

4.7 Communications and Support

If you contact us by email, through our website or through another available communication channel, we may process:

• Your contact details.
• The contents of your message.
• Information or documents you choose to provide.
• Our responses and related support records.

We use this information to respond to enquiries, provide support, resolve complaints and maintain appropriate business records.

4.8 Order and Delivery Information

Where our platform supports a transaction or service that requires order or delivery information, we may process the information necessary to provide that service.

This may include order details, delivery addresses, recipient contact details, product information and transaction references.

For purchases completed entirely on an independent store’s external website, the external store and its service providers generally manage the transaction and related order information under their own arrangements.

We do not automatically receive the information submitted to an external website merely because we link to that website.

4.9 Information We Do Not Routinely Collect

Our subscription model does not require us to operate customer or vendor wallets, maintain transferable monetary balances, or hold vendor sales proceeds for subsequent payout.

We do not collect banking, identity or tax information from every store owner as a standard requirement of email OTP registration. Such information may be requested only where necessary for a service actually provided, a lawful business requirement or an applicable legal obligation.

We process personal information for specific, lawful and appropriate purposes, including:

• Operating and maintaining our website and services.
• Creating and managing customer and store-owner accounts.
• Verifying access to email addresses through OTP verification.
• Creating and maintaining store listings.
• Displaying relevant business and product information.
• Directing visitors to independent stores’ external websites.
• Managing paid subscriptions and access to subscription features.
• Processing payments for our own platform services through applicable payment providers.
• Communicating with customers, store owners and business contacts.
• Providing technical and customer support.
• Maintaining platform security and preventing fraud, abuse and unauthorised activity.
• Improving website performance and user experience.
• Understanding website usage where analytics are enabled.
• Maintaining appropriate business and financial records.
• Handling complaints, disputes and privacy requests.
• Complying with applicable laws and lawful regulatory requests.
• Sending marketing communications where permitted by law.

We will not use personal information for an unrelated or incompatible purpose unless the processing is permitted or required by applicable law.

We process personal information in accordance with POPIA’s conditions for lawful processing.

Depending on the circumstances, our lawful basis may include:

• Taking steps at your request or performing a contract.
• Providing a service you have requested.
• Complying with a legal obligation.
• Protecting legitimate interests where permitted by law and where the relevant requirements are met.
• Preventing fraud and protecting platform security.
• Responding to enquiries or requests.
• Obtaining consent where consent is required.

The appropriate justification depends on the information and the purpose for which it is processed.

Using our website does not automatically constitute consent to every possible use of personal information.

Where consent is relied upon, it must be obtained in a manner consistent with applicable law.

Mall of the World Online may list businesses that operate independently of our platform.

We may use relevant publicly available business information to create listings that help customers discover stores and visit their websites.

Where an independent store is listed:

• The listing does not automatically establish that the owner has registered with Mall of the World Online.
• The listing does not automatically establish that the owner has agreed to a paid subscription.
• Customers may be redirected to the store’s external website.
• The store owner generally controls transactions and personal information collected through that external website.
• The external website’s own privacy policy and terms may apply to activity conducted there.

We do not claim that an external store is owned or operated by BOSSROSSY (Pty) Ltd merely because it appears in our directory.

We take reasonable steps to address credible concerns about inaccurate or inappropriate listings. Store owners may contact us to request corrections, provide updated information or raise an objection to the processing of their personal information.

Any request will be assessed in accordance with applicable law, including relevant rights and obligations concerning public business information.

We do not sell personal information.

We may disclose personal information where necessary, appropriate and lawful for the purposes described in this policy.

8.1 Store Owners and Vendors

Where a service provided directly through our platform requires information to be shared with a store owner or vendor, we may share the minimum information reasonably necessary for that service.

We do not automatically share a person’s account information with every business listed on our platform.

8.2 Payment Service Providers

We may share relevant account, subscription and transaction information with payment providers that process subscription payments for our platform services.

The information shared depends on the payment method and the provider’s requirements.

Payment providers may process personal information under their own privacy policies and legal obligations.

8.3 Technology and Hosting Providers

We may use service providers for website hosting, cloud infrastructure, email delivery, authentication, analytics, security, software maintenance and customer support.

Where these providers process personal information on our behalf, we take reasonable steps to ensure appropriate safeguards and contractual arrangements are in place as required by applicable law.

8.4 Delivery Providers

Where a service provided through our platform requires delivery, relevant recipient information may be shared with the appropriate delivery or logistics provider.

We do not automatically receive or share delivery information relating to transactions completed on external websites.

8.5 Legal and Regulatory Authorities

We may disclose personal information where required or permitted by law, including to comply with legal obligations, court orders, regulatory requirements or lawful investigations.

8.6 Business Transactions

If our business undergoes a lawful restructuring, merger, acquisition or transfer of relevant operations, personal information may be transferred where necessary and subject to applicable legal requirements and appropriate safeguards.

We may communicate with registered users and business contacts about account services, subscriptions, platform updates and other relevant matters.

Marketing communications will be conducted in accordance with applicable law, including POPIA’s rules concerning direct marketing by electronic communication.

Where consent is required, we will obtain it before sending the relevant marketing communications.

The fact that a business email address is publicly available does not automatically mean that every form of unsolicited electronic marketing is permitted.

You may opt out of marketing communications using an available unsubscribe mechanism or by contacting us. Opting out of marketing will not necessarily prevent us from sending essential account, security, subscription or service-related communications.

We will process opt-out requests in accordance with applicable law.

Our website may use cookies and similar technologies to operate and improve the service.

These technologies may include:

Essential Cookies

Used for login, authentication, security, session management and core website functionality.

Preference Cookies

Used to remember settings or preferences where available.

Analytics Cookies

Used to understand how visitors interact with our website and to improve performance, where analytics services are enabled.

For example, we may use services such as Google Analytics where configured.

You can manage cookies through your browser settings and any cookie controls made available on our website. Blocking essential cookies may affect some website functions.

Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, misuse, disclosure, alteration or destruction.

Depending on the service and the risks involved, safeguards may include:

• HTTPS and appropriate encryption in transit.
• Access controls and authentication mechanisms.
• Secure hosting and infrastructure.
• Software updates and security maintenance.
• Monitoring and incident response procedures.
• Limiting access to personal information according to business needs.
• Appropriate administrative and technical controls.

No online service can guarantee absolute security.

Users should protect their account credentials and notify us if they suspect unauthorised access to their account.

If we become aware of a security compromise affecting personal information, we will take appropriate steps to investigate, contain and address the incident.

Where required by POPIA or other applicable law, we will notify the Information Regulator and affected individuals in accordance with the relevant legal requirements.

We will also take reasonable steps to reduce the risk of further unauthorised access or disclosure.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where required or permitted by law.

Retention periods depend on the type of information, the service provided and the applicable legal requirements.

For example:

• Account information may be retained while an account remains active and for a reasonable period afterwards where necessary.
• Subscription and financial records may be retained for legally required recordkeeping and dispute-resolution purposes.
• Email verification records may be retained for account security and fraud prevention.
• Support communications may be retained for a reasonable period to manage enquiries and disputes.
• Public store listing information may be updated or removed when appropriate, subject to applicable law and legitimate recordkeeping requirements.

When information is no longer required, we will take reasonable steps to delete, destroy or de-identify it securely, subject to applicable legal obligations.

Subject to applicable law, you may have the right to:

• Request access to personal information we hold about you.
• Request correction or updating of inaccurate, incomplete or misleading information.
• Request deletion or destruction where legally applicable.
• Object to certain forms of processing.
• Withdraw consent where processing is based on consent.
• Object to direct marketing where applicable.
• Ask questions about how your personal information is processed.
• Lodge a complaint with the Information Regulator.

To exercise your rights, contact our Information Officer at privacy@malloftheworld.co.za.

We may request information reasonably necessary to verify your identity and understand your request.

We will respond in accordance with applicable legal requirements. Some requests may be limited where information must lawfully be retained or where another legal obligation applies.

Registered users may request deletion of their Mall of the World account through the available account controls or by contacting our support or privacy channel.

We will assess deletion requests and take appropriate steps to delete or de-identify information that is no longer required, subject to applicable law.

Some information may need to be retained for legal recordkeeping, financial compliance, security, fraud prevention or the establishment, exercise or defence of legal claims.

Deleting an account does not necessarily remove information held independently by external stores, payment providers or other third parties.

Our platform is not intended to knowingly collect children’s personal information in circumstances where the collection or processing is prohibited or requires additional legal safeguards that have not been met.

Where POPIA or other applicable law requires specific authorisation or consent for processing a child’s personal information, we will take reasonable steps to comply with those requirements.

If you believe a child’s personal information has been submitted to us unlawfully, please contact our Information Officer.

Some hosting, technology, analytics, payment or other service providers may process personal information outside South Africa.

Where personal information is transferred to another country, we will take reasonable steps to ensure that the transfer complies with applicable POPIA requirements, including the requirements applicable to cross-border transfers under section 72.

This may involve assessing the recipient’s legal protections, applicable agreements and other safeguards.

We take reasonable steps to ensure that personal information is accurate, complete and up to date where necessary for the purpose for which it is processed.

Registered users should update their account details when they change.

If a business owner believes that a store listing contains inaccurate information about their business or personal information, they may contact us to request a review and appropriate correction.

We may need to verify a request before changing or removing information.

Our website may contain links to independent stores, payment providers, social-media platforms and other external websites.

Once you visit an external website, that website’s own privacy practices, terms and security arrangements may apply.

We do not control all external websites and cannot guarantee how they collect or use personal information.

You should review the privacy policy of an external website before providing personal information or completing a transaction there.

If you believe that we have processed your personal information unlawfully or have not adequately addressed your privacy concern, please contact our Information Officer first so that we can investigate.

You may also lodge a complaint with the Information Regulator of South Africa where appropriate.

You may consult the Information Regulator’s official website for information about its complaints process and contact details.

We may update this Privacy Policy to reflect changes to our services, technology, business operations, data-processing practices or legal obligations.

The latest version will be published on our website with an updated revision date.

Where required by applicable law, we will provide additional notice or take other appropriate steps to inform affected individuals of material changes.

We encourage users to review this policy periodically.

This Privacy Policy is governed by the laws of the Republic of South Africa, including the Protection of Personal Information Act 4 of 2013 and other applicable legislation.

For privacy requests, corrections, objections or complaints, contact: