Mon–Sat Support:+265 995 554 449
Free standard delivery on orders over MWK 500,000 nationwideLast updated: June 2026
When you shop or create an account, we collect your name, email, phone number, shipping address, username, referral source, and order history. Payments are made by bank transfer or cash on delivery — we never see or store card numbers. We also collect search queries, product views, and cart activity to improve our service.
privacy.howWeUse.body
We share data only with service providers necessary to operate our business. We do not sell your personal information to third parties. Our service providers include:
Under the Malawi Data Protection Act 2024, you have the right to access your personal data, correct inaccurate data, request deletion of your account and associated data, export your data in a machine-readable format, withdraw consent for marketing at any time, and lodge a complaint with the Data Protection Commissioner. To exercise any of these rights, email support@iconicmalawi.com or use the account deletion option in your profile settings. We will respond within 30 days.
We retain your account data for as long as your account is active. Order records are retained for 7 years for financial and tax compliance, even after account deletion. Support messages are retained for 24 months. Search query analytics are retained for 12 months. You may request earlier deletion of non-financial data.
We use essential cookies for cart persistence, authentication, and analytics. Plausible analytics is cookieless and does not track individuals. You can control non-essential cookies through your browser settings.
Our services are not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We use industry-standard security measures including encrypted database storage (AES-256), Row-Level Security on all database tables, HMAC-signed tokens, rate limiting, and bot protection (Cloudflare Turnstile). IP addresses are stored as salted HMAC hashes (not plaintext) for GDPR/DPA compliance.
In the event of a personal data breach, we will notify the Malawi Data Protection Commissioner within 72 hours and affected data subjects without undue delay, in accordance with the Data Protection Act 2024.
We may update this privacy policy from time to time. The Last updated date at the top of this page reflects the most recent revision. Continued use of our services after changes constitutes acceptance of the updated policy.
For privacy questions or requests, email support@iconicmalawi.com or call +265 995 554 449 during business hours (Mon–Sat, 9:00–17:00).