Privacy Policy Notice

About this notice

This Privacy Notice explains how Geidea For Technology collects, uses, stores, shares, transfers and protects personal data relating to identifiable natural persons when they visit our Egypt website, use our Egypt products or services, represent or work for a merchant, contact us, or otherwise interact with us.

It is prepared under Egypt’s Personal Data Protection Law No. 151 of 2020 (the “Egypt PDPL”), its Executive Regulations issued by Ministerial Decision No. 816 of 2025, and other applicable Egyptian legal and regulatory requirements. Where a product-specific notice or consent is provided, that notice should be read together with this Privacy Notice.

The English and Arabic versions are intended to be consistent. If they conflict, the Arabic version shall prevail.

Who We Are and How to Contact Us

Geidea For Technology: Geidea For Technology is a Joint Stock Company registered in Egypt under Commercial Registration No. 155495. Its registered address is plot no. 14 d 06, Cairo Festival City, New Cairo, Egypt. The controller responsible for the processing described in this notice is Geidea For Technology.

Commercial Registration No.: 155495

Registered Address: Plot no. 14 d 06, Cairo Festival City, New Cairo, Egypt

For questions, complaints or requests concerning personal data, contact the Geidea For Technology Personal Data Protection Officer / Privacy Office.

Customer-support requests that are not privacy requests may continue to be submitted to customersupport.eg@geidea.net. Privacy requests sent through customer support must be securely transferred to the local Egypt privacy queue without delay. About Us

Who this notice covers

This notice covers personal data about website visitors, merchant owners and sole traders, authorised signatories, directors, beneficial owners, employees and users of merchant accounts, cardholders where Geidea processes their personal data, prospective customers, suppliers and their personnel, job candidates where a separate recruitment notice is not provided, and people who contact or visit us.

The Egypt PDPL protects personal data relating to natural persons. Information relating only to a legal entity is not personal data unless it identifies or can be linked to an individual.

Personal Data We May Collect

Geidea may collect and process the following categories of personal data, depending on your relationship and interactions with us:

• ✓Identity and verification: Name, date of birth, nationality, national ID/passport information, photograph, signature, role, authorised-signatory and beneficial-ownership information.
• ✓Contact: Business/home address where relevant, email, telephone, preferred language and communication preferences.
• ✓Merchant and professional: Business details, employment/role, branch/store information, contracts, licences, tax and registration details linked to an individual.
• ✓Financial and payment: Settlement/bank information, payment and transaction records, refunds, chargebacks, reconciliation, fraud/risk indicators and limited card or token data where required.
• ✓Device, online and location: IP address, device/browser identifiers, login and security logs, cookie/analytics identifiers, terminal/device identifiers, approximate or precise location where enabled and necessary.
• ✓Support and communications: Calls, emails, chats, complaints, service requests, surveys and other communications.
• ✓Compliance: KYC/KYB, AML/sanctions screening, fraud prevention, regulatory inquiries, audit records and evidence required by law.
• ✓Marketing: Consent records, campaign interactions and preferences.
• ✓Premises: CCTV or visitor records at Geidea locations where applicable and appropriately notified.

Sensitive personal data

Under the Egypt PDPL, sensitive personal data includes financial data and may also include health, genetic, biometric, religious-belief, political-view and criminal-record data; children’s data is always sensitive. Geidea processes sensitive personal data only where necessary, proportionate and legally permitted, after obtaining required PDPC licences/permits and written explicit consent or another legally authorised basis, and with enhanced safeguards.

How We Collect Personal Data

We may collect personal data through the following sources and methods:

Direct Collection

• ✓Directly from you, including forms, contracts, applications, product use, support contacts and surveys.
• ✓From the merchant or organisation you represent or work for, including account administrators and authorised representatives.
• ✓From banks, acquiring/settlement partners, payment schemes and processors involved in providing payment services.

Indirect Collection

• ✓From authorised governmental, identity-verification, credit, fraud-prevention, sanctions/AML and regulatory sources where lawful.
• ✓Automatically from websites, applications, terminals and devices through logs, cookies and similar technologies, subject to applicable consent requirements.
• ✓From Geidea group companies and approved service providers where lawful, necessary and subject to appropriate safeguards.

Why We Process Personal Data and Our Legal Basis

We process personal data for the purposes described below using the applicable legal basis under the Egypt Personal Data Protection Law framework.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already performed lawfully and does not stop processing supported by another legal basis. We will not use personal data for a new incompatible purpose without providing appropriate notice and obtaining consent or another lawful authorisation where required.

Data Minimisation

Geidea collects and processes only personal data necessary for the stated purposes and does not use personal data for incompatible purposes without an appropriate lawful basis.

When We Share Personal Data

We may share only the personal data necessary for the stated purpose with the following categories of recipients:

• ✓Geidea group companies where their involvement is necessary and lawful.
• ✓Banks, acquirers, settlement institutions, payment schemes, processors and other participants required to complete and manage payment services.
• ✓Identity/KYC, AML/sanctions, fraud-prevention, credit, communications, hosting/cloud, cybersecurity, analytics, maintenance and customer-support providers acting under appropriate instructions and confidentiality/security obligations.
• ✓Auditors, lawyers, insurers and other professional advisers with a legitimate need to know.
• ✓Egyptian courts, regulators, law-enforcement bodies and other competent authorities where disclosure is required or permitted by law.
• ✓A purchaser, investor or successor in a lawful corporate transaction, subject to appropriate safeguards and purpose limitations.

Geidea does not sell or rent personal data. We require processors to act only on documented instructions, protect the data, keep it confidential, support rights requests and delete or return it when their authorised work ends, subject to applicable law.

How Long We Store Your Personal Data

We retain personal data for the period necessary to fulfil the purposes for which it was collected, or for longer where retention is required or permitted by applicable Egyptian law, regulatory requirements, legal proceedings, or the establishment or defence of legal rights. When retention is no longer necessary, personal data will be securely deleted, destroyed or anonymised in accordance with applicable requirements.

Where Do We Process and Transfer Your Personal Data?

Geidea may share or transfer personal data to Geidea group companies or approved service providers where lawful, necessary and subject to appropriate safeguards. Any transfer of personal data outside Egypt will be carried out in accordance with the Egypt Personal Data Protection Law and applicable regulatory requirements, including any required licences, permits, approvals, safeguards or contractual arrangements.

How We Protect Personal Data

• ✓We use risk-based technical and organisational measures designed to protect the confidentiality, integrity and availability of personal data and prevent unauthorised access, loss, alteration, disclosure or misuse.
• ✓Measures include access control, authentication, encryption where appropriate, secure development and configuration, logging and monitoring, vulnerability and incident management, continuity controls, staff training, supplier assurance and periodic testing.
• ✓Payment-card processing is subject to applicable payment-security and regulatory standards.
• ✓No internet service is completely secure. You are responsible for protecting your credentials and promptly telling us if you suspect unauthorised access.

Cookies and similar technologies

We use strictly necessary technologies to operate and secure the website and, only with the required consent, analytics, preference or advertising technologies. You can manage non-essential choices through the Egypt cookie preference tool. Details of cookies, providers, purposes and durations are available in the Egypt Cookie Policy at https://www.geidea.net/egy/en#.

Direct electronic marketing

We send direct electronic marketing only with the required consent. Marketing communications identify Geidea, state their marketing purpose, provide valid contact details and include a clear, simple and free method to opt out or withdraw consent. We maintain evidence of consent and preference changes for the period required by Egyptian law. Service, security and regulatory messages are not marketing and may continue where necessary.

Your Rights

• ✓Right to Know, Review, Access and Obtain Your Personal Data: You have the right to know, review, access and obtain your personal data held by a holder, controller or processor, subject to the Egypt PDPL and applicable exceptions.
• ✓Right to Withdraw Prior Consent: You have the right to withdraw prior consent to the retention or processing of your personal data.
• ✓Right to Correct, Edit, Delete, Add to or Update Your Personal Data: You have the right to request correction, editing, deletion, addition or updating of your personal data, subject to applicable law.
• ✓Right to Limit Processing: You have the right to limit the processing of your personal data to a specified purpose, subject to applicable legal requirements.
• ✓Right to Be Informed of a Personal Data Breach: You have the right to be informed of a breach or infringement affecting your personal data where notification is required by law.
• ✓Right to Object to Processing: You have the right to object to processing or its results where it conflicts with your fundamental rights and freedoms, subject to applicable law.

Personal-data breaches

We maintain incident-response procedures. Where legally required, Geidea will notify the PDPC within the applicable statutory period and notify affected data subjects within three business days from notifying the PDPC, using the agreed communication method, with information about the breach and security measures taken.

Children’s data

Geidea’s business services are not directed to children. We do not knowingly condition a child’s participation in an activity on providing more data than necessary. If children’s personal data must be processed, we treat it as sensitive data, obtain the required guardian consent and regulatory permission, and apply enhanced safeguards.

Third-party sites and services

Our website or services may link to third-party sites or services that apply their own privacy notices. Geidea is not responsible for those independent notices or practices. Review them before providing personal data.

How to Exercise Your Rights and Response Time

Submit a written request through the Egypt privacy contact channels in the 'Who We Are and How to Contact Us' section. Tell us which right you wish to exercise and provide enough information to locate the relevant data. We may request proportionate identity or authority evidence to protect you and others from unauthorised disclosure. Geidea For Technology will reply within six working days from the date the request is submitted, as required by Article 32 of the Egypt PDPL. If we cannot fulfil a request, we will explain the lawful reason and available complaint route.

Request Costs

Geidea does not generally charge for rights requests. Any charge, if applicable, will be imposed only in accordance with a decision of the Personal Data Protection Center (PDPC), will not exceed the lawful amount, and will be communicated before processing the request. No charge applies to your legal right to be informed of a personal-data breach.

Your Responsibilities

• ✓You are responsible for protecting your account credentials and other authentication information.
• ✓You should promptly notify Geidea if you suspect unauthorised access to your account or personal data.
• ✓When using third-party websites or services linked from our website, you should review their applicable privacy notices before providing personal data.

Contacting Geidea for Personal Data Requests

For questions, complaints or requests concerning personal data, contact the Geidea For Technology Personal Data Protection Officer / Privacy Office. You may also submit a written request to exercise your rights through the Egypt privacy contact channels.

Personal Data Protection Officer / Privacy Office

Address: Plot no. 14 d 06, Cairo Festival City, New Cairo, Egypt

Telephone: +20114652881

Email: GDMO@geidea.net

Complaints

Please contact Geidea For Technology DPO/Privacy Office first so we can review and resolve your concern. Without prejudice to your right to seek judicial or other lawful remedies, you may complain to Egypt’s Personal Data Protection Center if you believe your rights have been infringed, you have not been enabled to exercise them, or you disagree with a decision on your request.

Personal Data Protection Center (PDPC): https://pdpc.gov.eg/

Changes and Language

We may update this notice to reflect legal, regulatory, service or processing changes. We will publish the updated date and provide additional notice or obtain consent where required. The English and Arabic versions are intended to be consistent. If they conflict, the Arabic version shall prevail.

Governing Law

This Privacy Notice is prepared under Egypt's Personal Data Protection Law No. 151 of 2020, its Executive Regulations issued by Ministerial Decision No. 816 of 2025, and other applicable Egyptian legal and regulatory requirements.