Data Processing Agreement

Last updated: 2026-10-05 · Part of the Terms of Use between ZAIN'S and the subscriber under Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.

1. Who is responsible for what

The subscriber is the controller of the customer and staff data they enter into the system: they decide what is collected and why. ZAIN'S is the processor of this data: we store and process it on the subscriber’s behalf and only on their instructions. We don’t use it for any other purpose or sell it and we only contact the subscriber’s customers through messages the subscriber has turned on.

2. Data we process

• Subscriber’s customers: name · mobile number · address · orders · accounts and installments · points · bookings · ratings · WhatsApp and Instagram messages.
• Subscriber’s staff: name · mobile · attendance · payroll · bonuses and advances.
• Operational data: items · prices · inventory · suppliers · expenses and journal entries.

3. Providers that help us operate

We only use these providers and each one receives only what it needs for the service it provides:

• Hostinger: Hosting · database and email.
• Meta (WhatsApp and Instagram): Messages the subscriber has turned on (verification codes · receipts · alerts · orders).
• Paymob: Online payments if the subscriber turns them on.
• Egyptian Tax Authority: E-receipts if the subscriber turns them on as required by law.
• Google (Gemini): Item photo enhancement if the subscriber uses it (photos only with no customer data).
• Anthropic (Claude): The AI Assistant if the subscriber uses it: aggregated figures (sales by day and hour · items · staff names and numbers) with no customer names or numbers.
• Off-server backups (email, or Cloudflare R2 when enabled): password-encrypted copies.

If we add a new provider that processes the subscriber’s customer data we update this page and notify subscribers 14 days in advance.

4. Security

• Connections are encrypted (https). Passwords and PINs are stored encrypted and integration keys (WhatsApp · Paymob · Tax Authority) are stored encrypted too.
• Each shop is isolated from the others. Each staff member sees only what their permissions allow and all sensitive actions are logged.
• Our admin panel requires a password plus a code from an authenticator app. Any support access to a shop’s account is visible to that shop and logged.
• A nightly backup that is checked for completeness plus an off-server copy locked with a password.

5. In case of a breach or leak

We log any incident as soon as we learn about it and notify the Personal Data Protection Center and affected subscribers within 72 hours: what happened · which data · what we did and what the subscriber should do. The subscriber is responsible for notifying its customers if the law requires it and we help with the information they need.

6. Data subject rights

If a customer asks the subscriber to see or delete their data the subscriber can do it from the customer page: “Download their data” creates an Excel file with everything about them and “Erase customer data” removes their name · number · addresses and messages. Their invoices stay in the accounts without a name as tax laws require.

7. Retention and deletion

• Data is kept while the subscription is active and for 90 days after it ends so the subscriber can return or download their copy.
• The subscriber can request permanent account deletion from “Settings ← Your data”: it’s carried out after 14 days (cancellable during that time) and everything is deleted including images and files. Old backups are deleted automatically within 14 days after that.
• The subscriber’s subscription invoices with us (their payments to ZAIN'S) are kept for the period required by tax law and contain no data about their customers.

8. Data location

Data is stored on servers in the hosting company (Hostinger). If it’s transferred outside Egypt this stays within what the law and its regulations allow and with the required safeguards.

9. Ending the subscription

On termination the subscriber can download all their data in a single file (CSV that opens in Excel) before deletion. This file contains no passwords or integration keys.

10. Data Protection Officer

ZAIN'S · WhatsApp +201035885000