1. Nando's Chickenland Malaysia Sdn Bhd and Nando’s Chickenland Singapore Pte. Ltd. (“Nando's”, “we”, “our”, or “us”) collects, uses, discloses, stores, and protects your personal data, in accordance with the Personal Data Protection Act 2010 of Malaysia ("Malaysia PDPA") and the Personal Data Protection Act 2012 of Singapore ("Singapore PDPA").

This Policy applies to personal data processed in Malaysia and Singapore, whether through our websites, applications, or offline channels, and informs you of your rights and choices concerning your personal data.

2. Types of Personal Data We Collect

We may collect and process different types of personal data, depending on your interaction with us, including:

• Full name, NRIC/FIN/passport number, date of birth, and nationality;
• Email address, telephone number, billing and delivery address;
• Purchase history, payment details, preferences, loyalty information;
• IP address, browser type and version, device identifiers, operating system, and platform;
• Location and demographic data (e.g., age, gender, income).

Sensitive personal data such as health information or religious beliefs will only be collected with your express consent in accordance with Malaysia PDPA.

3. How We Use Your Personal Data

We use your personal data for purposes necessary to provide you with our services, including:

• Fulfilling orders, processing payments, and delivering goods;
• Managing your participation in contests, surveys, and loyalty programmes;
• Communicating with you about changes to our services or terms;
• Responding to enquiries and complaints;
• Marketing and promotional efforts (with consent);
• Developing customer insights and improving our products and services.

We may aggregate or anonymize personal data for statistical and research purposes.

4. Consent and Legal Basis

By using our services or submitting personal data, you consent to our collection and use as described.

In Singapore, consent may be implied or deemed under specific conditions. In Malaysia, express consent is required to process sensitive personal data.

You may withdraw your consent at any time by contacting our Data Protection Officer. This will not affect processing based on consent before withdrawal.

5. Cookies, Web Beacons, and Tracking Technologies

We use cookies, pixels, and similar technologies to personalise content and ads, provide social media features, and analyse traffic.

Cookies allow us to remember user preferences, understand how visitors interact with the website, and provide customised experiences.

Web beacons are small graphic images embedded in emails or websites that track engagement.

In Singapore, non-essential cookies will only be enabled with your express consent. You may adjust your browser settings to refuse or delete cookies, but this may affect site functionality.

6. Forums and Public Disclosures

If our platforms include chat rooms, blogs, message boards, or forums, any personal data disclosed by you in such areas is deemed public.

We urge you not to share sensitive personal data on these platforms. We are not responsible for how third parties may use the data you disclose publicly.

7. Direct Marketing

With your prior consent, we may use your data for direct marketing of Nando's or affiliated companies' products and services.

You may also consent to marketing from selected third-party partners.

We will always offer a simple means to opt out of marketing messages. In Singapore, express consent is required for third-party marketing.

8. Disclosure of Personal Data

We may share your personal data with:

• Our group companies and affiliates for administrative purposes;
• Third-party vendors and service providers (e.g., IT, logistics, marketing, payment processors);
• Legal, regulatory, or governmental bodies upon lawful request;
• Successors in title or business transfers.

All third-party processing is subject to binding agreements requiring data protection safeguards.

9. Cross-border Data Transfers

Your personal data may be transferred to or accessed from jurisdictions outside Malaysia and Singapore.

In such cases, we will take appropriate steps to ensure the receiving country offers comparable data protection standards or ensure contractual safeguards (e.g., model clauses) are in place.

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal, regulatory, or internal policy requirements.

Typically, transaction and financial data is retained for 7 years, while marketing consent records may be stored until consent is withdrawn.

11. Your Rights

You have the following rights under the PDPA:

• Access to your personal data;
• Correction of inaccurate or incomplete personal data;
• Withdrawal of consent (with limitations);
• Objection to direct marketing (especially under SG PDPA);
• Lodge complaints with JPDP (Malaysia) or PDPC (Singapore).

We will verify your identity before acting on your request and respond within the statutory time frame.

12. Data Security Measures

We implement administrative, physical, and technical measures to safeguard your personal data.

These include encryption, secure servers, access controls, employee training, and regular system audits.

While we strive to protect your data, no system is entirely foolproof. We continually improve our security based on emerging risks.

13. Data Breach Notification (Singapore PDPA)

If a data breach likely to result in significant harm or involving 500 or more individuals occurs in Singapore, we will notify the PDPC and affected individuals within 3 calendar days, in accordance with the Singapore PDPA.

14. Third-party Advertising and Partners

Our platforms may include links to third-party websites, advertisements, or co-branded promotions.

These partners may collect personal data via their own cookies or data collection technologies. Their use of your data is governed by their own privacy policies.

We encourage you to review the privacy terms of any third-party site or service you engage with.

15. Contacting Us

For Malaysia and Singapore:

Email: peri-peri@nandos.com.my

Phone: +603-8966 2500

Address: R-03A & R-03C, 3rd Floor, Citta Mall, 1, Jalan PJU 1A/48, PJU 1A, Ara Damansara, 47301, Petaling Jaya, Selangor

16. Changes to this Policy

We may update this Policy from time to time to reflect legal or business changes. Material changes will be posted on our website and, where appropriate, notified directly to you.

17. Governing Law

This Policy shall be governed by and construed in accordance with the laws of Malaysia and Singapore, based on the location where processing occurs. Disputes shall be submitted to the relevant courts of jurisdiction.