Privacy Policy

1. Who Controls Your Data

Mahinaz Elmessiry is the data controller for the personal data collected through this website. Our identity and registered contact details are published in the Seller Information section of this site.

For anything relating to your personal data — questions, requests or complaints — write to mahi@mahinazelmessiry.com.

We process personal data in accordance with the Personal Data Protection Law No. 151 of 2020 ("PDPL") and its Executive Regulations.

2. What We Collect

• Identity and contact details: your name, email address and telephone number.
• Delivery details: the shipping address you give us, and any delivery instructions.
• Order details: what you bought, when, and the amount paid.
• Correspondence: messages you send us, including bespoke enquiries.
• Technical data: IP address, browser and device information, and — only with your consent — analytics about how you use the site.

We do not see or store your card details. Payment is captured by our payment providers on their own secure systems.

We do not knowingly collect data from children under 16.

3. Why We Process It, and on What Basis

• To perform our contract with you: processing and delivering your order, handling returns, and providing customer support.
• To comply with a legal obligation: issuing invoices and retaining tax and commercial records as Egyptian law requires.
• With your consent: analytics and marketing cookies, and marketing emails about new collections. You may withdraw consent at any time, and withdrawing it is as easy as giving it.
• For our legitimate interests: keeping the site secure and preventing fraud, balanced against your rights.

We do not sell or rent your personal data, and we do not use it for automated decision-making that produces legal effects for you.

4. Cookies and Analytics

Essential cookies keep your shopping cart and session working — the site cannot function without them. Analytics and marketing cookies (Google Analytics, Meta Pixel) load only after you accept them in our consent banner. Declining them does not affect your ability to browse or buy. You can change your choice at any time by clearing your cookies and reloading the site.

5. Who We Share It With

We share your data only with the parties needed to fulfil your order, and each receives only what it needs:

• Shopify, which powers our checkout and order management.
• Our payment providers, who process your payment.
• Our delivery partners, who need your name, address and phone number to deliver.
• Professional advisers and government authorities, where the law requires disclosure.

Each of these acts as our processor under a written agreement and may not use your data for its own purposes.

6. Transfers Outside Egypt

Some of our processors — including Shopify — store data on servers outside Egypt. Where personal data leaves Egypt we do so in accordance with the PDPL's cross-border transfer rules, transferring only to countries or recipients that provide an adequate level of protection, under contractual safeguards, and with the licences or approvals the PDPL requires.

7. How Long We Keep It

We keep order and invoice records for as long as Egyptian tax and commercial law requires. Marketing consents are kept until you withdraw them. Data we no longer have a lawful reason to hold is deleted or anonymised.

8. Security

We protect your data with encrypted connections, access controls, and hosting arrangements chosen for their security posture. No system is perfect, but we take the measures the PDPL requires and review them regularly.

9. Your Rights

Under the PDPL you have the right to:

• Know what personal data we hold about you and obtain a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data erased where there is no lawful reason for us to keep it.
• Withdraw consent at any time, for any processing based on consent.
• Object to, or ask us to restrict, processing of your data.
• Receive your data in a structured, machine-readable format.
• Be informed if a breach of your personal data occurs.

To exercise any of these, write to mahi@mahinazelmessiry.com. We respond without undue delay and within the timeframes set by the PDPL and its Executive Regulations. Exercising your rights is free of charge.

10. Data Breaches

If a personal data breach occurs, we notify the Personal Data Protection Centre within 72 hours of becoming aware of it, and we notify you directly where the breach is likely to affect your rights, within the period the law requires.

11. Complaints

If you are not satisfied with how we have handled your data, you may complain to the Egyptian Personal Data Protection Centre, the supervisory authority established under the PDPL.

12. Updates

We may update this policy as the store or the law changes. The current version always appears on this page, and we note the date of the last change when we make a material one.