Privacy Policy
Effective date: [Placeholder: effective date]
This policy explains what personal data we collect about you, why, who we share it with, where it is processed, how long we keep it, and your rights over it. It follows Personal Data Protection Law No. 151 of 2020 and its executive regulations issued by Decree No. 816 of 2025. The Arabic text is the authoritative text and this English text is a translation of it.
The rule we work by: we collect the least we need to deliver your order and look after you, and we never sell your data.
1. Who is responsible for your data
The controller of your data is [Placeholder: legal name], trading as Fanosia, registered in the commercial register under No. [Placeholder: commercial register number], at [Placeholder: registered address].
- Licence from the Personal Data Protection Centre: [Placeholder: Personal Data Protection Centre licence status]
- Data protection officer: [Placeholder: data protection officer's contact]
2. The data we collect
| Data | When we collect it | Required? |
|---|---|---|
| Name | When you order or sign up | Yes, to fulfil an order |
| Mobile number | When you order or sign up | Yes, because we confirm orders on WhatsApp and the courier calls you |
| Delivery address with the nearest landmark and delivery notes | When you order | Yes, to fulfil an order |
| Email address | When you order or sign up | No, optional |
| Your order history: items, amounts, payment method, delivery, return and warranty status | With every order | Created by your order |
| Proof of payment: the payment result and reference from Paymob, or the sender's name and transfer reference for Instapay or bank transfer | When you pay | Created by the payment |
| What you choose to send us: messages, photos of your room for a lighting consultation, photos of a defect or damage | When you message us | Your choice |
| Your choices: your consent to marketing messages and to cookies, with the time and source | When you choose | Recorded as proof of your consent: your marketing consent, with the consent text you saw, in a register we keep; your cookie choice in a cookie on your device, and with your order if you place one |
| Technical data: IP address, device and browser type | When you visit the website | Needed to run and secure the website; analytics only after your consent |
We do not receive or keep your full card number: card payments happen entirely on Paymob's page. We do not ask for your national ID number, and we collect no sensitive data.
3. Why we use your data, and on what basis
| Purpose | Legal basis |
|---|---|
| Confirming, preparing, delivering and installing your order, and collecting payment | Performance of our contract of sale with you |
| Messages about your order, including the confirmation, the tracking link and a request to review the piece after delivery | Performance of the contract |
| Customer care, returns, refunds and warranty | Performance of the contract, and our obligations under consumer protection law |
| Invoices and accounting and tax records | Legal obligation |
| Preventing fraud, securing the website, and protecting our rights in any dispute | Performance of the contract and protection of our legal rights |
| Measuring and improving how the website is used | Your consent in the cookie banner |
| Measuring the results of our advertising on Meta | Your consent in the cookie banner |
| Marketing messages on WhatsApp or by email | Your separate consent for each channel |
| Publishing your photo, message or review on the website or our accounts | Your consent, each time |
We do not use your data for any other purpose without telling you first and asking for your consent where it is needed.
4. Consent and marketing messages
- When you sign up to our waiting list you will see a separate, unticked box for Fanosia marketing messages on WhatsApp, and another separate box for email. We send you no marketing message unless you tick the box yourself. Placing an order in the store does not sign you up to any marketing messages.
- Consent is never a condition of buying.
- We record every consent with its time, its source, such as the sign-up page, and the consent text you saw.
- Every marketing message tells you how to stop them. You can also ask us to stop at any time on any of our channels, and we stop without delay.
- We will not send any marketing message before we hold the electronic marketing licence the law requires.
- Withdrawing consent does not affect any order of yours, or processing that took place before you withdrew it.
5. Who we share your data with
We do not sell or rent your data, or share it with anyone to market their products to you. We share only what each provider needs to perform its service for us, under an agreement that obliges it to protect the data and to use it for nothing else:
| Provider | What it does for us | Data | Where it is processed |
|---|---|---|---|
| Medusa Cloud [Proposed — master-plan decision 2, not yet approved] | Hosts the store's database and admin | Order and customer data | Outside Egypt |
| Vercel [Proposed — master-plan decision 2, not yet approved] | Runs the website's pages and passes what you enter to the database | Technical data and order data as you enter it | Outside Egypt |
| Cloudflare | Protects and speeds up the website and stores product images | Technical data | Outside Egypt |
| Paymob | Card and mobile-wallet payments | Name, mobile, email and amount | In Egypt [To confirm before publishing] |
| ShipBlu and Bosta | Delivering orders, collecting cash on delivery, and collecting returns | Name, mobile, address, landmark and the amount to collect | In Egypt [To confirm before publishing] |
| Our contracted installation team | Installation in your home | Name, mobile, address and appointment | In Egypt |
| Meta Platforms (WhatsApp, Instagram, Facebook) | Order messages and customer care, and advertising measurement after your consent | Mobile number and messages; for advertising measurement, usage data and your mobile and email in hashed form (section 10) | Outside Egypt |
| Google (Google Analytics) | Website analytics, only after your consent | Usage and technical data, and order details without your name, mobile, email or address | Outside Egypt |
| Microsoft Clarity | Recordings of how the website is browsed and heatmaps to improve it, only after your consent | Usage and technical data | Outside Egypt |
| Resend | Sends order emails from fanosia.com | Name, email and order details | Outside Egypt |
| Hostinger [To confirm before publishing] | The care@fanosia.com and sales@fanosia.com mailboxes | Your messages to us | Outside Egypt |
| Sentry | Monitors technical faults on the website | Technical data | Outside Egypt |
| Our accountant, our lawyer and public authorities | Accounting, legal advice, tax obligations, or an order from a competent authority | Only what is needed | In Egypt |
Before we add any new provider that receives your data, we add it to this table first.
6. Transfers outside Egypt
Some of the providers above process data outside Egypt, because the store's hosting, message and email delivery, and analytics tools run from there. We follow the conditions the law sets for these transfers:
- Cross-border transfer permit from the Personal Data Protection Centre: [Placeholder: cross-border transfer permit status]
- We transfer data only to providers that give a level of protection no lower than Egyptian law requires, under written data-processing agreements.
- We tell you about this transfer where you enter your details, on the checkout and sign-up pages, before you send them. [To confirm before publishing] Analytics and advertising tools run only after your consent in the cookie banner.
7. How long we keep data
| Data | Period |
|---|---|
| Order records and invoices | The period required by tax and commercial law, and at least until the piece's warranty ends 3 years after you receive it |
| Your messages and photos about an order or a warranty claim | As long as the order record itself |
| Your messages and photos not linked to an order, such as a lighting consultation | As long as they are needed to help you, then deleted |
| Sign-up data and marketing lists | Until you withdraw consent |
| The record of your consent and its withdrawal | As long as needed to prove we complied with the law |
| Google Analytics data | 14 months |
| Microsoft Clarity recordings | 30 days |
| Technical security logs | The shortest period needed to protect the website |
When a period ends we delete the data or make it no longer identify you.
8. Your rights
You have the right to:
- Know what data we hold about you, and receive a copy of it.
- Have it corrected or updated.
- Have it deleted, except what the law requires us to keep, such as invoices; in that case we tell you what we kept and why.
- Withdraw your consent at any time, to marketing messages or to cookies.
- Ask us to limit the processing of your data to a defined scope, and object to its processing.
- Be told of any security breach affecting your data.
- Complain to the Personal Data Protection Centre.
How to ask: message us on WhatsApp at [Placeholder: WhatsApp number] or at care@fanosia.com, or contact our data protection officer at [Placeholder: data protection officer's contact]. We may ask you to confirm your identity, for example with a message from the mobile number on your order. We answer and act on your request within 14 days, free of charge.
9. Keeping your data safe, and what we do if there is a breach
- The website runs over an encrypted connection (HTTPS), and card data never reaches us at all.
- Only the people on our team who need your data for their work can see it, and everyone who works with us is bound by confidentiality.
- We keep daily backups so your order data is not lost.
- If a security breach affects your data, we notify the Personal Data Protection Centre within 72 hours of learning of it, and notify you within 3 working days after that of what happened, which data was affected, and what you can do.
10. Cookies and the consent banner
Cookies are small files your browser stores on your device. We use three kinds:
| Kind | Purpose | Tools | Needs your consent? |
|---|---|---|---|
| Essential | The cart, your language, remembering your cookie choice, and website security | Fanosia's own cookies and Cloudflare | No, because the website cannot work without them |
| Analytics | Understanding and improving how the website is used | Google Analytics and Microsoft Clarity | Yes |
| Advertising measurement | Knowing which ads led to real orders | Meta Pixel and the Meta Conversions API | Yes |
- On your first visit, you can accept all optional cookies, reject non-essential cookies, or open Settings and choose Analytics separately. Browsing without making a choice leaves optional tools off.
- When analytics is enabled and you consent, Google Analytics measures how visitors find the site and which pages they use. Geographic reports show approximate locations. Microsoft Clarity uses masked session replays and heatmaps to help us see where people click, scroll, or have trouble using the site. Form inputs and sensitive page content are masked.
- If you accept advertising measurement, we send Meta your mobile number and email in hashed form, with the order details, so we know which ad led to a delivered order. Hashing is a one-way conversion that turns each item into a fixed code which does not show the number or email itself and cannot be turned back into it. We never send the number or email itself; Meta uses the code to match it against the codes of accounts registered with it. We send Google neither your number nor your email, in any form.
- You can turn analytics off at any time from "Privacy settings" at the foot of the site. This stops new analytics collection on that browser.
11. Children
Our store is meant for adults, and we do not knowingly collect data from anyone under 18. If you learn that a child has sent us their data, contact us and we will delete it.
12. Changes to this policy
Every change is published here with a new effective date. If a change is significant, such as a new purpose or a new provider outside Egypt, we explain it at the top of this page before it applies, and ask for your consent again where that is needed.
13. Contact
- Email: care@fanosia.com
- WhatsApp: [Placeholder: WhatsApp number]
- Data protection officer: [Placeholder: data protection officer's contact]
- Address: [Placeholder: registered address]