Privacy Policy — Mono & Co

1. Who we are

Mono & Co ("we", "us", "our") is an e-commerce enabler based in Malaysia. We manage online marketplace stores, including Shopee and Lazada, on behalf of brands and businesses, and we run marketing and advertising for those stores.

This policy explains how we collect, use, share and protect personal data when you visit our website, contact us, engage our services, or interact with our social media pages. It applies to data we control. Where we handle data on behalf of a client, for example customer data inside a client's Shopee or Lazada store, we act on that client's instructions and the client's own privacy policy also applies.

By using our website or contacting us, you agree to this policy. If you do not agree, please do not use our services.

2. Information you give us

We collect personal data that you provide directly, including:

• Contact details: name, email address, phone or WhatsApp number, company name and role.
• Enquiry content: messages you send us through our website forms, WhatsApp, email, Facebook Messenger, Instagram direct messages or comments on our posts.
• Client and account information: business registration details, billing and payment details, bank details for invoicing, and contact details for your team members.
• Store access credentials: access tokens or logins you authorise us to use for your Shopee, Lazada, TikTok Shop, Meta or other platform accounts, so that we can manage them on your behalf.
• Anything else you choose to send us, such as product information, photographs, marketing materials or documents.

You are not obliged to give us this data, but without it we may be unable to respond to your enquiry or provide our services.

3. Information collected automatically

When you visit our website, we and our analytics providers may collect:

• IP address and approximate location (city or region level)
• Browser type, device type and operating system
• Pages viewed, time spent, and the site or advertisement you arrived from
• Cookie identifiers and similar technologies (see section 14)

This data helps us keep the website working, understand how it is used, and measure our advertising.

4. Information from platforms and third parties

We receive data from platforms when you interact with us there, or when a client authorises us to manage their accounts:

We only access platform data for accounts whose owners have authorised us, and only to the extent needed to provide our services.

5. How we use your information

We do not sell your personal data. We do not use your personal data to make automated decisions that produce legal effects for you.

6. Our use of Meta platform data

We operate a Meta application that connects to our own Facebook Page and Instagram account, and, where authorised, to client pages and accounts.

What the application accesses

• Publishing posts, images and captions to the connected Facebook Page and Instagram account
• Reading the page's own published posts and engagement statistics, to plan content
• Reading the list of pages and Instagram accounts the authorising user manages, so the correct account can be selected

What we do with it

• Create and schedule our own marketing content, and content for clients who have engaged us
• Review performance so that future content is more useful

What we never do

• Sell, rent or trade platform data
• Transfer platform data to data brokers, advertising networks or any party not acting for us
• Use platform data to build profiles of individuals for purposes unrelated to the services
• Access private messages or personal profiles beyond what the platform makes available for the connected business account

Access tokens are stored securely and are used only for the purposes above. A client or page administrator can revoke our access at any time in Meta Business Settings, which immediately stops all access.

7. When we share information

We share personal data only as described here:

• Service providers who process data on our behalf under contract, including cloud hosting, workflow automation, artificial intelligence services used to draft content, email and messaging services, analytics providers, and accounting or payment processors.
• Marketplace and social platforms where we publish or manage content on your instructions, such as Meta, Shopee, Lazada and TikTok Shop.
• Professional advisers such as our accountants, auditors and lawyers, where necessary.
• Authorities, where we are required by Malaysian law, a court order or a regulatory request.
• A buyer or successor, if our business is sold or merged, in which case this policy continues to apply to the transferred data.

We require our service providers to protect personal data and to use it only for the purposes we specify. We do not sell personal data to anyone.

8. Storage and international transfers

Our systems and service providers operate on cloud infrastructure that may be located outside Malaysia, including in Singapore, the European Union and the United States. Where we transfer personal data outside Malaysia, we take reasonable steps to ensure it is protected to a standard comparable to the Personal Data Protection Act 2010, including contractual commitments from our providers.

9. How long we keep data

When data is no longer needed, we delete it or anonymise it so that it can no longer identify you.

10. Security

We take reasonable technical and organisational measures to protect personal data, including:

• Access tokens, platform credentials and API keys are stored in encrypted credential stores, not in documents, spreadsheets or chat messages
• Access is limited to team members who need it for their work
• Two-factor authentication on business-critical accounts
• Encrypted connections (HTTPS) for our website and the services we use
• Prompt revocation of access when a team member leaves or an engagement ends

No system is completely secure. If a data breach occurs that is likely to cause you significant harm, we will notify you and the relevant authorities as required by law.

11. Your rights

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate, incomplete or out of date
• Withdraw consent to our processing, including marketing messages
• Limit processing for direct marketing purposes
• Ask about disclosure, meaning the classes of parties we have shared your data with

To exercise any of these rights, email us at gary.lum@monodigital.my with the details of your request. We may ask you to verify your identity. We will respond within 21 days, as required by the Act, and will tell you if a fee applies for a data access request.

If you are unhappy with our response, you may lodge a complaint with the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi) of Malaysia.

12. Requesting deletion of your data

You can ask us to delete the personal data we hold about you at any time.

How to request deletion

• Email gary.lum@monodigital.my with the subject line "Data deletion request", or send us a WhatsApp message at +60 10-231 1602.
• Tell us your name, the email address or phone number you used with us, and, if the request relates to Facebook or Instagram, the account or page name.
• We will confirm receipt and complete the deletion within 30 days.

Data obtained through Meta platforms. If you have interacted with our Facebook Page or Instagram account, or authorised our Meta application, we will delete the data we hold from that platform on request. You can also remove our application's access yourself at any time:

• As a page or account owner: go to Meta Business Settings, open Apps, select our application and remove it.
• As a person who messaged or commented: go to your Facebook Settings, then Apps and Websites, and remove the application, or contact us using the details above.

We may keep certain records after a deletion request where the law requires it, such as invoices and accounting records, which we retain for seven years. We will tell you when this applies.

13. Cookies and tracking

Our website uses cookies and similar technologies to keep the site working, remember your preferences, measure traffic and understand the performance of our advertising. These may include cookies set by Google Analytics and Meta.

You can block or delete cookies in your browser settings. Some parts of the website may not work properly if you do.

14. Children

Our services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

15. Other websites and platforms

Our website and social media content may link to other sites, including Shopee, Lazada, TikTok Shop and Meta platforms. We are not responsible for their privacy practices. Please read their privacy policies before providing personal data to them.

16. Changes to this policy

We may update this policy as our services, technology or the law change. The date at the top shows when it was last updated. Material changes will be announced on this page, and we will notify existing clients directly. Continuing to use our services after an update means you accept the revised policy.

17. Contact us

For any question about this policy, or to exercise your rights or request deletion:

In case of conflict between the English and Bahasa Malaysia versions of this policy, the English version prevails.