OFFICIAL CUSTOMER DOCUMENT

Privacy Policy

Customer App · KCM Rider App · Main Website · E-commerce Web Application · Admin / Management Panel

Effective date: 26 September 2026

Last updated: 26 September 2026

1. The KCM digital platform

KCM operates through two connected web properties of the same digital commerce platform. They are not two separate businesses.

The main website includes a prominent SHOP NOW button. When a customer selects SHOP NOW, they open shop.khybercitymall.pk to browse products, select their branch, add products to the cart, check out, place orders and track deliveries.

Customers may also shop through the KCM Customer App. Deliveries are carried out through the KCM Rider App by a KCM Delivery Rider. Branch operations, catalogue, inventory, order confirmation and rider assignment are managed in the KCM Admin / Management Panel.

This Privacy Policy applies to the KCM Customer App, the KCM E-commerce Web Application, the main website at www.khybercitymall.pk, the KCM Rider App, and relevant KCM administrative systems. It applies to customer, rider and staff information processed in connection with KCM services.

KCM services in Mardan are provided under the legal business name NEW KHYBER CITY MALL MARDAN. KCM services in Swabi are provided under the legal business name KHYBER CITY MALL. Both branches use the same KCM digital commerce platform.

2. Information we collect

2.1 Customer information

When you use the KCM Customer App or the E-commerce Web Application, KCM may collect your phone number for OTP-based sign-in and the name you provide for your account.

2.2 KCM Delivery Rider information

For a KCM Delivery Rider, KCM may process the rider name, email address and other account information provisioned by KCM for access to the KCM Rider App and delivery operations. This Policy describes that operational information. It does not classify a rider as an employee or an independent contractor.

2.3 Staff and admin information

Authorized KCM staff may have account information such as a name and email address. Administrative systems may also give authorized staff access to personal information already contained in operational order and delivery records when needed to manage the service.

2.4 Delivery address information

When you save a delivery address, KCM stores the address details you enter. These may include an address label, address lines, landmark, city, recipient name and recipient phone number.

2.5 Order information

KCM processes information connected with your order, including the products ordered, the selected branch, the payment method, delivery notes, the delivery charge shown at checkout, and coupon codes you use.

2.6 Delivery verification

KCM uses a one-time delivery OTP to verify handoff of an order. The current system stores the delivery confirmation code in hashed form rather than as plain text.

2.7 Device and notification information

KCM uses Firebase Cloud Messaging to support push notifications. The current system stores a device notification token so KCM can send order updates and delivery alerts. The current implementation removes the token when you sign out.

2.8 Rider location

When a KCM Delivery Rider has an active delivery, the KCM Rider App collects device location only while the app is open and that delivery is active. This information is used to show live location to the customer receiving that delivery. KCM does not currently track rider location in the background or while the rider is off duty.

3. How we collect information

• Directly from you when you sign in, provide account details, save an address, place an order, use a coupon, add delivery notes or contact KCM support.
• Through normal use of the Customer App, the main website or the E-commerce Web Application, including order status, delivery verification and push-notification registration.
• From a rider device while the KCM Rider App is open and the rider has an active delivery, for the live-delivery location feature.
• Through third-party technology services that support account sign-in, push notifications and map display.

4. How we use information

KCM uses information for purposes reasonably connected with operating and supporting the service, including:

• Creating and managing customer, rider and staff accounts.
• Authenticating customers with phone number and OTP, and supporting authorized rider and staff access.
• Processing, confirming and delivering orders, including branch-based availability.
• Showing the applicable distance-based delivery charge before an order is placed.
• Providing saved delivery addresses and delivery notes.
• Assigning deliveries and coordinating delivery operations.
• Verifying delivery with the one-time delivery OTP.
• Providing customer service and responding to order-related questions, claims and privacy requests.
• Sending order updates, delivery alerts and other service communications through in-app and push notifications.
• Showing rider live location to the customer during an active delivery.
• Where promotional communications are enabled, sending offers or service information, subject to the opt-out described below.
• Protecting the service against misuse or security issues where reasonably necessary.

KCM does not sell customer personal information.

Where promotional communications are enabled, you may opt out of those promotional messages. Opting out does not stop essential order, delivery and account messages needed to provide the service. This Policy does not describe a particular SMS, email or WhatsApp marketing system. Promotional messages are sent only through a channel KCM has actually enabled.

5. Delivery and location information

Customer saved address. A saved customer address is text entered by the customer, such as address lines, landmark and city. KCM uses this information to prepare and complete delivery. A saved address is not a continuously tracked GPS location.

Rider live location. For an active delivery, the KCM Rider App collects the rider device location while the app is open and the rider has that active delivery. The location is shown to the customer receiving that delivery. Collection stops when the active-delivery workflow ends. KCM does not currently track rider location in the background or while the rider is off duty.

KCM currently delivers in the approved areas below. Being inside a service area does not mean KCM collects your precise GPS location. Coverage may change. A location beyond the published areas, including a location beyond 15 km, is served only if KCM has enabled that area, and any applicable delivery charge is shown at checkout.

6. Payments

Cash on Delivery (COD) is the active payment method. Under the current system, customer checkout does not collect or store credit-card numbers, debit-card numbers, bank-account details or wallet credentials. Card, wallet, Easypaisa and JazzCash are not active checkout payment options. If KCM later enables an additional payment method, this Privacy Policy and the service terms will be updated before that method is offered as an active checkout option.

7. Cookies and similar technologies

The main website and the E-commerce Web Application may use cookies or similar technologies where they are enabled in the deployed web configuration. These technologies may support essential session management, security, preferences or service performance.

The exact cookies or similar technologies depend on the current deployed configuration. KCM does not describe a named analytics or advertising tracker in this Policy unless that technology is part of the deployed configuration. If KCM later introduces non-essential analytics, advertising or other tracking that materially changes how information is collected or used, this Privacy Policy will be updated.

8. Third-party services

KCM uses the following third-party services to support specific platform features. Each provider operates its own systems and may process information under its own terms and privacy practices.

Relevant provider information: Google Privacy Policy at https://policies.google.com/privacy; Firebase Privacy and Security at https://firebase.google.com/support/privacy; Google Maps Platform security information at https://developers.google.com/maps/security/compliance/security-compliance.

9. Data sharing

KCM may share or make information available only as reasonably necessary to operate the service, including:

• The assigned KCM Delivery Rider: delivery information needed to complete that delivery, including the delivery address and recipient contact details.
• Authorized KCM staff: operational records needed to manage products, orders, branch inventory and rider assignments.
• Technical service providers: information processed through necessary services such as Firebase and Google Maps.
• Legal or regulatory requests: information KCM is required to disclose under applicable law or a valid legal process.

KCM does not sell customer personal information. Delivery personnel and service providers are not authorized to use customer information for unrelated purposes.

10. Data security

KCM uses administrative and technical measures intended to protect personal information against unauthorized access, misuse, loss and other security risks. The current system stores customer and user information in a PostgreSQL database, stores delivery confirmation codes in hashed form, and uses Google Cloud Storage for product images and related media. No method of transmission or storage removes every security risk.

11. Data retention

KCM retains personal information only for as long as reasonably necessary for legitimate operational, security, dispute-resolution and legal requirements. When information is no longer needed for those purposes, KCM will delete or de-identify it where appropriate and feasible.

12. Your privacy choices and requests

You may contact either KCM branch to ask about the personal information associated with your account, or to request access to, correction of, or deletion of that information, subject to applicable requirements and any information KCM is required or permitted to retain.

KCM may ask for reasonable information to verify the identity of the person making the request. Where some information must be retained, KCM will explain that limitation when appropriate. You may also opt out of promotional communications where those communications are enabled. Essential service messages about your order and account may continue.

13. Children’s privacy

KCM services are not intended for children under 18. KCM does not knowingly request personal information from children under 18 for independent use of the platform. If a parent or guardian believes that a child has provided personal information to KCM, please contact either branch using the details in Section 16.

14. Account closure and deletion

You may request deletion of your customer account in either of these ways:

• KCM Customer App: Account / Settings → Delete Account.
• Web: the web-based account-deletion request made available on the KCM platform.

These are the deletion paths KCM provides. Deletion may require a reasonable processing period. KCM will delete personal information associated with the account unless a record must be kept for a legitimate operational, security, dispute-resolution or legal requirement. Any retained record is limited to what is reasonably necessary for that purpose.

15. Changes to this Privacy Policy

KCM may update this Privacy Policy when the service, features or privacy practices change. When appropriate, KCM may provide notice through the website, the app or another reasonable channel. The updated version will show its effective date and last updated date.

16. Contact us

For company, official, or general questions, email info@khybercitymall.pk. For privacy questions about an order, or any other store matter, contact the branch that serves you:

E-commerce Web Application: shop.khybercitymall.pk

This document is published for customers, banking and merchant review, and official KCM business use. Final legal compliance remains subject to review by qualified Pakistani legal counsel. Nothing in this document removes a consumer right or remedy that cannot lawfully be excluded under the law of Pakistan.