Privacy Policy

1. Controller

EGY POLISH is the controller of personal data processed through egypolish.com and the official API that serves it.

We operate under Egypt’s Personal Data Protection Law No. 151 of 2020 where it applies, consumer-protection rules, and related regulations.

2. Data we collect

Account data: full name, email, phone, hashed password, language preference, and an optional profile photo cropped and compressed on the server.

Service data: vehicles (make, model, year, plate, colour), saved addresses and coordinates, bookings, selected services, and notes.

Technical data: HttpOnly session cookie, CSRF cookie, theme and language in local storage, and approximate IP plus user-agent for session security.

We do not collect card numbers on this website unless a later official payment flow is announced with its own notice.

3. Purposes and bases

Contract: account creation, verification, booking, cancellation, and appointment notices.

Limited legitimate interests: session security, fraud prevention, login history, and internal operations — not data sale.

Consent: optional analytics after the banner. You may choose essential-only.

Legal obligation: retention needed for tax or disputes when applicable.

4. Cookies and storage

Essential cookies run the session and block forged write requests. Sign-in does not work without them.

Local storage holds theme, language, and analytics choice. Browser storage is not a substitute for the secure session cookie.

We do not set third-party advertising IDs before analytics consent.

5. Sharing and processors

Hosting, email, and infrastructure processors may handle data on our instructions and may not use it for their own marketing.

Authorised operations staff may see booking data to deliver the appointment. Staff permissions are enforced on the server.

We do not share data with advertisers. We may disclose to a competent authority if legally required, and only as narrowly as needed.

6. Retention

Account and booking records are kept while the account exists and for as long as needed afterwards for disputes or legal duties.

Sessions end on logout, expiry, or when the session cap is exceeded.

Verification codes are short-lived. Profile photos are replaced on a new upload or removed when you delete them.

7. Security

Where the site is served over HTTPS we use encryption in transit, password hashing, HttpOnly session cookies, and CSRF checks on mutating requests.

No system is perfectly secure. Report suspected account compromise via the Contact page immediately.

8. Your rights

You may view and update profile data in-account, request correction of inaccuracies, and request deletion where law or an active booking does not require keeping the record.

You may withdraw analytics consent by resetting the banner choice or clearing the consent key and revisiting the site.

Privacy requests: use Contact and provide reasonable identity evidence. We may refuse abusive or excessive requests as the law allows.

9. Children

The service is not directed at anyone under 18. We do not knowingly collect their data. If we learn of a minor’s account we delete it.

10. Cross-border processing

Infrastructure may sit in Egypt or abroad. Where data is transferred we use appropriate processor terms where practicable.

11. Incidents

If a legally relevant data incident occurs we will act under applicable duties, including notifying the competent authority and affected people when required.

12. Updates

We update this page when practices change. The effective date is above. Material changes are announced on the site where practicable.

13. Contact

Privacy requests: use the Contact page and state that the message concerns personal data so it can be routed correctly.