// JURISDICTION & LEGAL INFRASTRUCTURE

PRIVACY POLICY

DATA INTEGRITY // EGYPTIAN DATA PROTECTION LAW // EFFECTIVE 2024

PHINOX operates under direct Alexandria command and is regulated by the Egyptian Data Protection Law. This policy documents how we collect, process, store, and protect your personal data.

2.1 DATA COLLECTION SCOPE

We collect data necessary for order fulfillment, dispatch telemetry, payment processing, and customer support. Specifically: full name, phone number (E.164 format), email address, delivery address (city + country + postal code), and payment method tokens (last 4 digits + opaque provider token, never raw card numbers).

2.2 PROCESSING PURPOSES

Your data is processed exclusively for:

  • — Order placement, dispatch, and doorstep handover (PIN verification via SMS)
  • — Payment authorization via Paymob (CARD), valU (BNPL), FawryPay, or Cash on Delivery
  • — Order history archival (snapshots preserved per دستور §6 denormalization policy)
  • — Customer support inquiry resolution
  • — Aggregate analytics (anonymized, no individual tracking)

2.3 DATA RETENTION

Order history (incl. snapshot fields: SKU, name, unit_price) is retained indefinitely per دستور §6 (soft-delete only on catalog/order entities). Payment records are retained for 7 years per Central Bank of Egypt tax regulations. Marketing analytics data is anonymized after 24 months.

2.4 DATA SECURITY

All data is encrypted at rest (256-GCM SSL) and in transit (TLS 1.3). Payment card numbers are never stored — Paymob tokenizes them and returns only an opaque token + last 4 digits. Address PII is masked to governorate + city in non-admin logs. Per دستور §5, no secrets are logged; raw webhook payloads are stored in Payment.webhook_payload for audit only, with card numbers masked in admin rendering.

2.5 YOUR RIGHTS

Per Egyptian data protection law, you have the right to:

  • — Access your personal data via the profile archive
  • — Correct inaccurate data (contact dispatch for name/email/phone changes)
  • — Request deletion of marketing analytics data
  • — Object to direct marketing communications
  • — Lodge a complaint with the Egyptian Data Protection Authority

2.6 CONTACT

For privacy inquiries or to exercise your rights, contact our Data Protection Officer via the contact page. We respond within 30 days per Egyptian data protection law.