Privacy Policy

Pulse Park is a multi-sport facility located at Corner M1 and Bua Road, Area 6, Lilongwe, Malawi. Pulse Park is the data controller responsible for your personal data.

• Operator: Pulse Park, operating as a multi-sport facility in Lilongwe, Malawi.
• Postal address: Pulse Park, Corner M1 and Bua Road, Area 6, Lilongwe, Malawi.
• Data protection contact: Privacy Contact, Pulse Park — info@pulse-mw.com
• General contact: info@pulse-mw.com, +265 999 834 444 / +265 995 993 313

The website and mobile app are developed and maintained for Pulse Park by Zafar Systems Ltd, which acts on our instructions.

We collect information you give us, information created when you use our services, and a small amount of technical information from your device. What we collect depends on the features you use.

Your Account

• Full name, email address, phone number, and password. Passwords are stored only as a one-way hash and are never visible to staff.
• Your Pulse Park member ID, email verification status, and account status.
• Optional details you add: profile picture, preferred sport, and an emergency contact name and phone number.

Bookings and Check-In

• Facility, court, date, time, duration, add-ons (such as equipment or coaching), price, booking notes, and an organisation name if you book for one.
• Booking status, cancellations, reschedules, and a history of changes made to a booking, including the name and email of the customer or staff member who made each change.
• Check-in details: the session code or access PIN linked to your booking and the time your session started and ended.

Payments, Invoices, and Rewards

• Pay at the Park: amounts received, payment method, and the staff member who recorded the payment.
• Airtel Money: your Airtel Money mobile number, amount, transaction reference, and the payment status and messages returned by Airtel.
• Card payments: you enter your card details on the secure payment page of Standard Bank Malawi, powered by Network International (N-Genius). We never see or store your full card number or security code. We receive your email address (sent to the payment page), the order reference, amount, status, and the transaction response returned by the payment gateway, which may include limited card information such as the card type or a masked card number.
• Saved cards (optional): if you tick Save this card for next time while paying, Standard Bank keeps your card on file and gives us a token that stands in for it. We store that token together with the card type, the last four digits, the expiry month and the name on the card, so you can recognise the card and reuse it. We never receive your full card number or security code, and you enter your security code (CVV) on the bank page for every payment. You can remove a saved card at any time in the app under Settings → Payment methods, or on the website under Dashboard → Settings → Payment Methods, and all saved cards are removed when you delete your account.
• Saved Airtel Money number (optional): if you ask us to remember your Airtel Money number, we store it on your account to fill in at checkout. You can change or remove it in the same place.
• Invoices, receipts, part-payments, refunds (including the reason given), coupons issued to or redeemed by you, and your Pulse Rewards points balance, history, tier, and redemptions.

Store and In-Person Sales

• Products ordered, quantities, amounts, payment details as above, and the name, email, and phone number recorded for the sale.

Community

• Posts, captions, comments, likes, shares, and the photos and videos you upload (including any sound recorded with a video).
• Reports you submit about content, and view counts on posts.

Matchmaking

• Your matchmaking profile: bio, sports you are looking to play, preferred sport, and profile photo.
• Players you like or pass on, your matches, chat messages, read receipts, and when you were last active.

Rankings, Teams, and Tournaments

• Match results and scores you or your opponents submit, confirmations, ratings (Elo), wins and losses, and leaderboard positions.
• Teams you create: team name, motto, location, and the names of members you add.
• Tournament registrations: team name, contact name, phone number, email, age category, additional details, and payments.

Pulse Park Academy

• The registering parent or guardian's email and phone number.
• The athlete's name, date of birth (optional), and age group, the guardian's name and phone number, and any notes you add.
• Registration status and payments. See section 08 for more on children's data.

Job Applications

• Name, email, phone number, cover letter, and the CV you upload.

Notifications and Your Device

• If you allow notifications in the app: a push notification token, device platform (Android or iOS), device name or model, app version, and when the device was last active.
• Your notification preferences (bookings, messages, community, competition, promotions), and your in-app notification inbox.
• To protect sign-in and coupon features from abuse, our servers count requests per IP address in memory. These counts are not stored in our database. Our hosting provider may keep standard server logs, such as IP addresses, request times and error traces, for a short period under its own retention policy. We do not use these logs to build a profile of you.

What We Do Not Collect

• We do not collect your precise or approximate location. The weather forecast shown in the app and on the website is for Pulse Park's fixed location.
• We do not access your contacts, calendar, or photo library. When you choose a photo, video, or document, your phone's system picker shares only the item you select.
• We do not use advertising, analytics, or crash-reporting tools, and we do not ask for health information.

Pulse Park staff may also enter information about you, for example when they make a booking or record a payment for you at reception, and other users may add your name to a team or submit a match result that involves you.

• To create and secure your account, verify your email address, and reset your password.
• To take and manage bookings, check you in at reception, process payments, part-payments and refunds, and issue invoices and receipts.
• To run Pulse Rewards, coupons, the store, tournaments, teams, rankings, and Pulse Park Academy.
• To show community content and matchmaking profiles, deliver chat messages, and calculate ratings, leaderboards, and matchmaking suggestions. Ratings and suggestions are calculated automatically but do not have legal or similarly significant effects on you.
• To send service emails (verification, password reset, booking confirmations, unpaid booking and payment notices) and push notifications you have chosen to receive, such as booking reminders, messages, and offers.
• To moderate content, handle reports, prevent fraud and abuse, and enforce our Terms & Conditions and Rules & Regulations.
• To contact your emergency contact or a Campus athlete's guardian if there is an incident at the park.
• To keep financial and accounting records, respond to legal requests, and comply with the law.
• To consider job applications.

We process personal data only where the Data Protection Act, 2024 of Malawi allows it. Depending on the activity, we rely on:

• Contract: to provide your account, bookings, payments, store orders, tournaments, and Academy registrations you request.
• Consent: for push notifications, camera and microphone access, optional profile details, community and matchmaking participation, and a parent or guardian's consent for a child's Academy registration. You can withdraw consent at any time; this does not affect processing that already took place.
• Legal obligation: to keep financial, tax, and accounting records and respond to lawful requests.
• Legitimate interests: to keep our services secure, prevent fraud and abuse, moderate content, and improve our facilities and services, where these interests are not overridden by your rights.
• Vital interests: to protect someone's life or health in an emergency.

Other Users

• Community posts, comments, photos, and videos are visible to other users together with your name and profile picture. Uploaded community and matchmaking media is stored so it can be displayed and may be viewable by anyone who has its link.
• Your matchmaking profile is shown to other matchmaking users, and chat messages are visible to the person you are chatting with.
• Your name, ratings, and results can appear on leaderboards, tournament pages, and in match confirmations sent to opponents.

Pulse Park Staff

Authorised staff can see the information they need for their role, such as bookings, payments, check-in, Academy registrations, or content moderation. Staff access is controlled by role-based permissions.

Service Providers

We use the following providers to run our services. They receive only the data needed for their service:

• Hostinger — hosting of the website, API, database, and uploaded files.
• Zafar Systems Ltd — development, maintenance, and technical support of the website and app.
• Airtel Malawi (Airtel Money) — mobile money payments (your mobile number, amount, and reference).
• Standard Bank Malawi and Network International (N-Genius) — card payments (your card details entered on their page, your email address, amount, and order reference).
• Resend — delivery of service emails (your email address, name, and booking or account details in the message).
• Expo (650 Industries) — push notification delivery and app updates. Notifications are passed on to Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) for delivery to your device. A notification can include its title and a short preview, for example the start of a chat message.
• Google Fonts, code.jquery.com, unpkg, html2canvas.hertzen.com, and Open-Meteo — fonts, website scripts, and the weather forecast. When your browser or the app loads these, the provider receives your IP address and browser or device information.
• Google Play and the Apple App Store — app distribution, under their own privacy policies.

Other Disclosures

• When required by law, court order, or a competent authority, or to protect the rights, property, or safety of Pulse Park, our users, or others.
• To a successor organisation if Pulse Park is reorganised, merged, or transferred, subject to this policy.

We do not sell personal data and we do not share it with third parties for their own advertising.

Some of our providers store or process data outside Malawi. Our hosting is provided by Hostinger, whose data centres are located outside Malawi, and Resend, Expo, Google, Apple, and Network International operate servers in other countries, including the United States and the European Union.

Where personal data is transferred outside Malawi, we take the steps required by the Data Protection Act, 2024 to make sure it remains adequately protected. In practice we rely on each provider's data processing agreement and standard contractual protections, we use only providers that commit to a comparable standard of security, and we send them the minimum data needed for the service they perform.

• Account and profile: while your account is open, and deleted when you delete your account.
• Community content and matchmaking data: until you delete it or delete your account.
• Booking, payment, invoice, refund, and store records: kept for six years from the end of the financial year they relate to, in line with Malawi tax and accounting record-keeping requirements. If you delete your account, these records are kept in anonymised form for accounting.
• Push notification tokens: used until you sign out, turn notifications off, or uninstall the app, after which the token is disabled; deleted when you delete your account.
• Notification inbox: deleted automatically after 180 days. Delivery receipts are deleted after 7 days.
• Pulse Park Academy registrations: for the duration of the program and 12 months afterwards, so we can handle re-enrolment and any safeguarding question, then deleted or anonymised. Payment records for the program follow the six-year rule above.
• Tournament registrations and match results: registrations are kept for 12 months after the tournament ends. Published results, standings and leaderboard entries stay part of the competition record until you delete your account, after which your name is removed from them.
• Job applications and CVs: 12 months after the vacancy closes, so we can consider you for similar roles, unless you ask us to delete them sooner.
• Backups: deleted data may remain in secure backups for up to 30 days before those backups are overwritten. Restored data is re-deleted if a backup is ever used.

We may keep information for longer where the law requires it or where it is needed to resolve a dispute, handle a legal claim, or prevent fraud.

You must be at least 18 to create a Pulse Park account and use the community and matchmaking features. Our app and website are not directed at children, and we do not knowingly allow children to create their own accounts.

Pulse Park Academy Registrations

• Children are registered for Pulse Park Academy by a parent or legal guardian, using the guardian's own account.
• By registering a child, you confirm that you are their parent or legal guardian and consent to Pulse Park processing the child's details for the program.
• We collect only what the program needs: the child's name, date of birth (optional), and age group, and the guardian's name and phone number. Please add health information to the notes only if staff need it to keep the child safe.
• Academy registration details are available only to authorised staff and are not shown to other users.
• Before we use any photo or video in which a child can be recognised, we ask the parent or guardian for written consent at registration. Consent is optional, it is never a condition of taking part, and you can withdraw it at any time by emailing info@pulse-mw.com, after which we stop using the material in anything we publish from then on.

Parents and guardians can ask to access, correct, or delete their child's information using the contact details in section 17. If we learn that a child's data was provided without the necessary consent, we will delete it.

• Data sent between your device and our servers is encrypted in transit using HTTPS.
• Passwords are stored as one-way hashes, and sign-in sessions use signed tokens. In the app, your session is kept in the phone's secure storage.
• Card details are entered on the bank's secure payment page, not on our systems.
• Staff access is limited by role-based permissions, and sign-in attempts are rate limited.

No method of transmission or storage is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the authorities as required by law.

Subject to the conditions and exceptions in Malawi's Data Protection Act, 2024, you have the right to:

• Be informed about how your personal data is used, as set out in this policy.
• Access the personal data we hold about you.
• Correct inaccurate or incomplete data. You can update most profile details yourself in Settings.
• Delete your personal data, including by deleting your account (section 11).
• Object to or ask us to restrict certain processing, including promotional notifications.
• Withdraw consent where we rely on it, for example by turning off notifications or camera access.

To exercise these rights, contact us using the details in section 17. We may need to verify your identity before acting on a request, and we will respond within the time required by law. If you are not satisfied with our response, you can complain to Malawi's data protection authority, the Malawi Communications Regulatory Authority (MACRA).

You can delete your Pulse Park account at any time:

• In the app: Settings → Delete account.
• On the web: pulse-mw.com/delete-account.
• By email: write to info@pulse-mw.com from the email address linked to your account.

What Is Deleted

• Your personal profile: name, email, phone number, password, profile picture, emergency contact, and preferences.
• Your community posts, comments, likes, shares, and uploaded media.
• Your matchmaking profile, likes, matches, and messages.
• Your push notification tokens, notification preferences, and notification inbox.

What Is Kept

• Booking, payment, invoice, refund, and store records, kept in anonymised form so they no longer identify you, for accounting and legal purposes (section 07).
• Information we must keep to comply with the law, resolve disputes, or prevent fraud.

Account deletion is permanent. Unused Pulse Rewards points and coupons are forfeited when the account is deleted and cannot be restored, including on a new account opened with the same email address. If you only want to stop notifications or remove specific content, you can do that without deleting your account.

The app asks for permissions only when a feature needs them. You can use the app without granting them, but the related feature will not work.

• Camera: to scan the check-in QR code on the reception screen and to take photos and videos for community posts, your profile picture, and your matchmaking card.
• Microphone: to record sound when you film a video for a community reel. Your phone asks the first time you record.
• Notifications: for booking confirmations and reminders, matchmaking messages, community and competition updates, and Pulse Park offers. You can choose categories in Settings → Notification settings.

How to Change Permissions

• In the app: Settings → App permissions, or Settings → Notification settings.
• Android: Settings → Apps → Pulse Park → Permissions or Notifications.
• iPhone: Settings → Pulse Park.

Our website does not use advertising or analytics cookies. It uses your browser's local storage to:

• Keep you signed in (your session token and a copy of your basic profile).
• Remember your store cart, bookings and payments in progress, and the last email used to sign in.
• Remember display choices, such as a dismissed booking tour or dashboard layout, and whether the site is in maintenance mode.

The app stores your session in the phone's secure storage and keeps similar preferences on your device. Clearing your browser's site data or signing out removes this information, and you will need to sign in again.

• Service emails, such as email verification, password resets, booking confirmations, and payment notices, are part of the service and are sent from noreply@pulse-mw.com.
• Push notifications, including promotions, are sent only if you allow notifications. You can turn off any category, including promotions, in Settings → Notification settings.

Payments by card open the bank's payment page, and our pages link to services such as Facebook, Instagram, WhatsApp, and maps. These services have their own privacy policies, which apply when you use them.

We may update this Privacy Policy from time to time. We will change the "Last Updated" date above and, for significant changes, tell you in the app, by email, or on our website before they take effect.

For privacy questions, requests to exercise your rights, or complaints, contact:

• Data protection contact: Privacy Contact, Pulse Park — info@pulse-mw.com
• Email: info@pulse-mw.com
• Phone: +265 999 834 444 / +265 995 993 313
• Visit: Pulse Park reception, Corner M1 and Bua Road, Area 6, Lilongwe, Malawi