Legal
Emtelaak Platform Data Privacy Policy
1. Introduction
At Emtelaak, we are committed to protecting the privacy and security of your personal data. This Data Privacy Policy outlines how we collect, use, store, and protect your information in accordance with the provisions of the Personal Data Protection Law No. 151 of 2020 and its executive regulations, and any other applicable legislation.
This policy applies to all personal data collected through our electronic platform, mobile applications, investment and account management systems, customer interactions, and any other services provided by Emtelaak’s platform.
Emtelaak does not sell or rent your personal data. If Emtelaak is involved in a corporate transaction (such as a merger or transfer of assets), your personal data may be transferred as permitted by law and subject to appropriate safeguards and continued protection consistent with this Policy.
2. Definitions
The Company: Emtelaak for Projects Investment LLC, or any of its relevant affiliates or entities providing or participating in the relevant service or product, as applicable.
Platform: The electronic platform, applications, websites, and digital systems operated or made available by Emtelaak for providing its services and products.
Personal Data: Any information that identifies or can be used to identify an individual, such as name, contact details, identification numbers, or address.
Processing: Any operation or set of operations performed on Personal Data, whether by automated or non-automated means, including collection, recording, organisation, storage, modification, retrieval, use, disclosure, erasure, or destruction.
Data Controller: Emtelaak, the entity responsible for determining the purpose and means of processing personal data.
Data Processor: The natural or legal person that processes Personal Data on behalf of and in accordance with the instructions of the Data Controller.
Data Subject: The individual to whom the personal data belongs.
Sensitive Personal Data: Personal data that reveals or relates to financial data, biometric data, physical, mental or psychological health, genetic data, religious beliefs (including religion as shown on the Egyptian national ID, so copies of the ID are treated as sensitive data), political opinions, or security status, any personal data relating to children, and any other category designated as sensitive under applicable law.
PDPC: The Personal Data Protection Center established pursuant to the Egyptian Personal Data Protection Law No. 151 of 2020.
3. Types of Personal Data We Collect
We may collect the following types of personal data:
Contact Information: Name, email address, phone number, and mailing address.
Investment and Transaction Information: investment preferences, subscription and redemption requests, and payment details.
Identification Data: Passport details, national ID, or other government-issued identification.
Technical Data: IP address, browser type, device information, application identifiers, device identifiers, advertising identifiers, and cookies.
Financial and Investment Data: bank account details, payment methods, investment size, investment portfolios, Know Your Customer (KYC) procedure results, knowledge-test results and completion records, and data on compliance with anti-money laundering and counter-terrorist financing requirements.
Location Data: GPS data or other location-based information.
Location Data – purposes and methods: We collect precise location data only with your permission, for purposes such as detecting and preventing fraud, securing your account and transactions, and providing location-based features you request. We may also infer approximate location from your IP address or service-provider data for security and service operation. You can disable device location access in your settings. Location data is retained for up to 90 days, unless a longer period is required by law or necessary for a documented security investigation.
Biometric Data (where applicable): Where identity verification (such as face matching or liveness checks against your ID document) is used, we may process facial images or biometric templates solely for verification and fraud prevention, after obtaining your explicit written consent and in accordance with applicable law, and we delete biometric data within 30 days after verification is completed, unless a longer period is required by law or necessary to investigate fraud. Copies of your identity documents and the verification result are kept as identity-verification (KYC) records for the period set out in Section 9.
Communications Records: We may record and retain communications between you and us (including customer-support calls, chats, and emails) for quality assurance, training, dispute resolution, fraud prevention, and legal and regulatory compliance. Where required by law, we will notify you when a call is being recorded.
Additional categories and device permissions (where applicable):
Profile and Account Data (e.g., username, preferences, feedback, and survey responses).
Usage Data and Content (e.g., actions on the Platform, logs, and content you upload such as photos or media).
Device and Diagnostic Data (e.g., app version, device identifiers, crash logs, and performance data).
Permission-based access to your device features (e.g., camera, photos/media, microphone, and precise location) solely to deliver features you request. You can manage or revoke permissions in your device settings at any time.
Why we request device permissions (where the feature is available): Camera – to capture identity documents and photos for identity verification (KYC); Photos/media – to upload documents or images you choose; Microphone – for voice features or support calls you initiate; Precise location – for fraud prevention and security. We do not access these features without your permission.
Contacts and third-party data: We do not access your contact list. If you choose to provide Personal Data about a third party, we process it as Controller in accordance with this Policy and applicable law; providing the data does not remove our duties as Controller.
Sources of Personal Data: We collect data directly from you, automatically from your devices and interactions with our Platform (including through cookies and similar technologies on our website), from public sources, from business partners, including KYC providers, sanctions-screening lists and databases, where applicable, service providers, and third-party services you choose to link or log in with (subject to your settings on those services).
4. How We Use Your Personal Data
We process your personal data for the following purposes:
To provide and manage our products and services.
To communicate with you regarding investment requests, account management, subscriptions to and purchases of fund certificates, redemptions of fund certificates and distributions, and to administer knowledge tests; to send service notifications and promotional offers (subject to Section 14).
To improve our services and customer experience.
To comply with legal and regulatory requirements.
To ensure the safety and security of our customers and staff.
We also use personal data to: send transaction and service notices, security alerts, and support messages; conduct analytics, research, testing, and quality assurance; detect, prevent, and investigate fraud, abuse, and security incidents; perform audits and ensure business continuity; protect or exercise our legal rights or defend against legal claims; and fulfill KYC/AML/CFT and other regulatory obligations.
Automated decision-making and profiling: We may use automated tools to help detect fraud, verify identity, and screen for KYC/AML compliance risk. Where an automated decision significantly affects you, you may request human review, express your point of view, and contest the decision, subject to applicable law.
5. Legal Basis for Processing
We process your personal data based on the following legal grounds:
Consent: When you provide explicit consent for specific purposes (e.g., marketing communications).
Contractual Necessity: To fulfill our obligations under a contract with you (e.g., subscribing to or redeeming fund certificates).
Legal Obligations: To comply with Egyptian laws and regulations and the requirements of competent authorities.
Legitimate Interests: For business purposes, such as improving our services or ensuring security.
Where we rely on legitimate interests, we apply a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interests at any time (see Section 10).
6. Data Sharing and Disclosure
We may share your Personal Data, only to the extent necessary and for legitimate purposes, with the following parties:
Service Providers: Third-party service providers that assist us in operating the Platform and delivering our services, including information technology providers, cloud hosting providers, payment processors, identity verification service providers, and customer support providers, subject to contractual obligations to protect the confidentiality and security of your Personal Data.
Government Authorities: Where required to comply with applicable laws, regulations, judicial orders, regulatory requirements, or requests from competent governmental or supervisory authorities.
Investment Service Providers: Including the Investment Manager, Custodian, Fund Manager, Registrar, Transfer Agent, or any other entity involved in the administration, operation, or management of the investment products or services, to the extent necessary for the provision of such services and compliance with applicable regulatory requirements.
Affiliated Companies: Within the group of companies for legitimate administrative, operational, compliance, and business continuity purposes, in accordance with applicable data protection laws.
Anti-Money Laundering and Counter-Terrorist Financing Authorities: We may disclose Personal Data to the Egyptian Money Laundering and Terrorist Financing Combating Unit (EMLCU) and other competent authorities where required to comply with applicable AML/CFT or other legal and regulatory obligations.
Analytics and Advertising Partners: Limited identifiers, as described in Section 11 and subject to your consent where required.
We ensure that all third parties with whom Personal Data is shared are contractually bound to implement appropriate technical and organizational measures to protect the confidentiality, integrity, and security of your Personal Data and to process such data solely for the purposes for which it was disclosed, in compliance with the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations.
Third-party links: Our Platform may contain links to third-party websites, apps, or services. Those third parties have their own privacy policies and practices. We are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party service you visit or use.
Third-Party SDKs and Service Providers (where applicable): Our Platform may use third-party Software Development Kits (SDKs) and service providers to operate, secure, and improve the Platform, such as analytics, crash-reporting, push-notification, payment, identity-verification, cloud-hosting, or customer-support providers. Depending on their function, they may process device identifiers, IP address, approximate location, usage and interaction data, crash and performance data, or payment information. We select and contractually require such providers to process Personal Data only for disclosed purposes, maintain appropriate safeguards, and comply with applicable law. We will provide links to relevant provider privacy notices where reasonably available.
7. International Data Transfers
If your personal data is transferred outside the Arab Republic of Egypt, the following applies:
Such transfer or access will be carried out in accordance with the requirements of the Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, including obtaining any license, permit, or authorization required from the Personal Data Protection Center (PDPC), where applicable.
We will only transfer or permit access to Personal Data where the destination country provides a level of data protection that is not lower than the level of protection prescribed under applicable Egyptian data protection laws, or where an applicable legal basis or statutory exception permits such transfer.
Personal Data may be hosted or processed by our authorized service providers, including cloud hosting, identity verification (KYC), payment, analytics, customer support, and other technology providers. Depending on the services used by the Platform, such providers may process or host Personal Data in Egypt or in other jurisdictions. We maintain records identifying the relevant service provider, the country or region in which the Personal Data is hosted or processed, the categories of Personal Data involved, the purpose of the transfer, and the applicable legal safeguards.
For example, where applicable, hosting or processing may be carried out through cloud infrastructure such as AWS or Firebase, or through our appointed KYC or payment service providers. The specific hosting region and processing location applicable to each service will be determined based on the service configuration and the relevant service provider's contractual and technical arrangements.
We will apply appropriate contractual, technical, and organizational safeguards to protect Personal Data during any international transfer or remote access and will not rely on your general acceptance of this Privacy Policy as a substitute for any license, permit, or authorization required by applicable law.
8. Data Security
We implement robust technical and organizational measures to protect your personal data, including:
Encryption of sensitive data in transit and at rest.
Regular security audits and assessments.
Access controls and authentication mechanisms.
Employee training on data protection best practices.
No method of transmission or storage is 100% secure. While we work to protect your Personal Data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials, using strong passwords, keeping your devices and apps updated, and notifying us without undue delay of any suspicion of unauthorized access.
9. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Retention periods may vary depending on the type of data and legal obligations.
Upon expiry of applicable retention periods, we will delete or anonymize Personal Data in a secure manner. Copies stored in backups or archives will be isolated and deleted or anonymized on the next scheduled cycle. Where deletion is not possible due to legal or technical reasons, we will securely restrict processing and retain the data only for compliance purposes.
Indicative retention periods:
KYC/AML and identity-verification records: 5 years after the end of the business relationship, or for any longer period required under applicable laws, regulations, or AML requirements.
Transaction and investment records: 5 years from the date of the transaction, or for any longer period required under applicable laws or regulations.
Accounting and tax records: For the period required under applicable tax, accounting, and commercial laws and regulations.
Call recordings and support communications: 12 months for general customer support communications and call recordings, or for any longer period where required by applicable laws, regulations, regulatory requirements, dispute resolution, or legitimate business purposes.
Marketing preferences and consents: Until you withdraw your consent or close your account. Records evidencing your consent are kept for three (3) years, as described in Section 14.
Technical logs and cookies: 6 months for general technical logs and cookies, or for any longer period where necessary for information security, fraud prevention, troubleshooting, regulatory compliance, legal claims, or where otherwise required by applicable laws or regulatory requirements.
Biometric data: up to 30 days after verification is completed.
Location data: up to 90 days after collection.
Knowledge-test records: 5 years after completion of the test. Longer periods apply to biometric data, location data and knowledge-test records only where required by law or necessary for a documented investigation.
10. Your Rights
Under the Personal Data Protection Law No. 151 of 2020 (the “PDPL”), you have the rights available to you under the PDPL in relation to your Personal Data, including the right to access, review, correct, update, and delete your Personal Data, withdraw consent where processing is based on consent, and object to processing where permitted by the PDPL.
In addition to the rights provided under the PDPL, Emtelaak may, as an additional service to you, provide certain additional rights, including the right to request restriction of the processing of your Personal Data and the right to receive or request the transfer of certain Personal Data in a structured and commonly used format (data portability), subject to applicable law, technical feasibility, and any applicable contractual or legal requirements.
These additional rights are offered by Emtelaak voluntarily and do not constitute a representation that such rights are statutory rights under the PDPL.
Access: Request a copy of your personal data.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion of your data under certain conditions.
Restriction: Limit the processing of your data.
Objection: Object to processing based on legitimate interests.
Data Portability: Request transfer of your data to another controller.
Withdrawal of consent: Withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Objection to direct marketing: Object at any time to the use of your data for direct marketing.
Human review of automated decisions: Request human review of a decision made solely by automated means that significantly affects you (see Section 4).
Complaint: Lodge a complaint with us or with the Personal Data Protection Center (see Section 16).
To exercise these rights, please call +201205535888 (from inside or outside Egypt) or email dpo@emtelaak.com or support@emtelaak.com (see Section 19).
Response time: We will respond to your request within the time limits prescribed by applicable law. Where no specific statutory period applies, we will respond within a reasonable period having regard to the nature and complexity of the request.
We may need to verify your identity and authority before fulfilling your request. You may also submit certain requests through in‑app or website settings where available. We may deny or limit requests where an exemption applies (e.g., to comply with legal obligations), and we will inform you of the reason when we do so.
To request account closure or deletion of your Personal Data, please see “Account and Personal Data Deletion” below.
Account and Personal Data Deletion
You may, at any time, request the closure of your account and the deletion of the personal data associated with it through the “Delete Account” feature available on the Platform, or by contacting us using the contact details provided in Section (19).
Upon submitting an account deletion request, we may require you to complete certain procedures necessary to verify your identity and confirm that the request has been submitted by the account holder or by a person legally authorized to submit such request.
If you still hold fund certificates, or have pending transactions, distributions or balances, we may not be able to close your account until these have been redeemed, transferred or settled in accordance with the applicable fund terms. We will tell you if this applies.
Following completion of the verification procedures, we will delete or anonymize personal data that is no longer required to be retained, including account profile information and saved content, to the extent permitted by applicable law.
However, we may retain certain data and information where such retention is necessary or required by applicable law, including Know Your Customer (KYC) and Anti-Money Laundering (AML) records, transaction and investment records, accounting and tax records, and information necessary for fraud prevention, dispute resolution, or the establishment, exercise, or defense of legal claims, for the period required by law or as otherwise necessary for legitimate legal purposes.
Upon expiry of the applicable retention period, we will securely delete or anonymize the data that is no longer required, in accordance with our applicable procedures and applicable law.
Account Deletion Request Procedure:
Log in to your account on the Platform.
Navigate to “More”, then select “Account Management – Profile.”
Select “Delete Account” or “Request Account Deletion.”
Confirm your deletion request in accordance with the procedures provided on the Platform.
You may be required to complete an additional identity verification process before your request is processed.
We will process your deletion request within 30 calendar days of verifying your identity, subject to any data that we are legally required to retain. If applicable law requires a longer period, we will inform you of the reason and expected timeframe.
You may also request the deletion of your account or inquire about the status of your deletion request by contacting us using the contact details provided in Section (19).
Upon submitting an account deletion request, we will cease sending marketing communications to you, subject to the reasonable processing period required to process your opt-out request.
11. Cookies and Tracking Technologies
We use cookies and similar technologies to enhance your experience on our electronic platform, where applicable, and app SDKs and device or advertising identifiers in our mobile application to improve our services. You can manage website cookie preferences through your browser and manage in-app tracking choices through the app settings or your device privacy and advertising controls.
Categories and choices: We may use (i) strictly necessary cookies (required for the Platform to function), (ii) functional cookies (to remember preferences), (iii) analytics cookies (to understand usage and improve services), and (iv) advertising or performance cookies (to deliver or measure promotions for our services). You can control cookies via your browser or device settings and, where offered, through in‑app preferences. Disabling certain cookies may affect some features.
Analytics and advertising: Where used, analytics tools help us understand and improve the Platform. We may work with partners to show promotions for our services on other platforms based on your interactions with our Platform. See those partners’ privacy policies for their practices. You can adjust your advertising preferences in your device or browser settings.
Mobile app tracking and consent: Where we use analytics, advertising, or attribution SDKs in our mobile app, we will request your consent through an in-app prompt or settings where required by law. On iOS, we ask for your permission through Apple’s App Tracking Transparency prompt before tracking you across other companies’ apps and websites. You can withdraw consent at any time in the app settings or by resetting or limiting the advertising identifier in your device settings.
Advertising partners: We may share limited identifiers (such as a hashed email address, user ID, or device advertising ID) with analytics and advertising partners, to measure and deliver promotions across platforms and devices. We do not share your identity documents or financial account details with advertising partners.
Do Not Track: Our Platform may not respond to Do-Not‑Track signals. You can use the controls described above to manage tracking technologies.
12. Children’s Privacy
The Platform is available only to persons aged 21 or over with full legal capacity. Opening an account and using investment services are not available to anyone under 21.
We do not knowingly collect personal data from anyone under 21, and we do not knowingly direct marketing to minors.
If we learn that we have collected personal data of a person under 21, we will delete it promptly unless the law requires us to keep it.
13. Changes to This Policy
We may update this policy from time to time. Any changes will be posted on our website and in the Emtelaak mobile application with the updated effective date.
If we make material changes, we will provide additional notice through the Platform and/or by email where required by law, and will indicate the date the changes take effect.
14. Marketing Communications
We send electronic marketing communications only with your prior consent, which is required in all cases, and under the electronic-marketing permit required from the Personal Data Protection Center. We keep records of each consent (date, time, channel and the wording or version you accepted) for three (3) years. Every message identifies Emtelaak, states that it is marketing, and gives you a simple, free way to opt out. Withdrawing marketing consent does not affect service, security or regulatory notices.
You can opt out by using the unsubscribe link in emails, changing in‑app notification preferences where available, or contacting us using the details in Section 19. You cannot opt out of essential service or transactional communications (e.g., security alerts, account notifications).
15. Processing of Sensitive Personal Data
Where necessary, the Company may process Sensitive Personal Data, including identity documents or other categories of data designated as sensitive under applicable law, solely for lawful purposes and in accordance with the Egyptian Personal Data Protection Law No. 151 of 2020, its Executive Regulations, and any other applicable legal requirements. Such processing shall only be carried out after obtaining the necessary approvals, permits, or consents where required by law.
We apply heightened safeguards to Sensitive Personal Data, including strict access controls, encryption in transit and at rest, and restricted retention consistent with legal obligations.
Categories we treat as Sensitive Personal Data include financial data, KYC results, copies of identity documents, and biometric data (where used). We process them only with your explicit written consent or where required by law, and after obtaining any permit or license required from the Personal Data Protection Center (PDPC), where applicable.
16. Complaints
If a Data Subject believes that his or her rights under this Privacy Policy or applicable data protection laws have been violated, the Data Subject may submit a complaint to the Company for review and resolution. The Data Subject also has the right to lodge a complaint with the Personal Data Protection Center (PDPC) in accordance with the Egyptian Personal Data Protection Law and its Executive Regulations.
We will acknowledge complaints and respond within the timeframes required by applicable law. If you are not satisfied with our response, you may escalate to the PDPC as permitted by law.
17. Personal Data Breach Notification
In the event of a Personal Data breach that may compromise the confidentiality, integrity, or security of Personal Data, the Company shall take all appropriate technical and organizational measures to mitigate the impact of the breach and, where required by applicable law, notify the competent authorities and affected Data Subjects within the prescribed legal timeframes, which under the Personal Data Protection Law and its Executive Regulations include notifying the Personal Data Protection Center within 72 hours of becoming aware of the breach, and notifying affected Data Subjects within three working days of the date the breach was reported to the Center.
Where notification to Data Subjects is required, we may notify you via email, in‑app notification, SMS, or other appropriate means and include information about the nature of the breach, steps we have taken, and guidance on how you can mitigate potential harm. We maintain an internal breach register.
18. Regulatory Compliance
In addition to the other purposes described in this Policy, the Company processes Personal Data to the extent necessary to comply with applicable legal and regulatory requirements, including, without limitation, Know Your Customer (KYC) procedures, Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) obligations, record retention requirements, regulatory reporting, and other obligations imposed by the competent authorities.
19. Contact Us
If you have any questions or concerns about this policy or our data practices, please contact us at:
Emtelaak for Projects Investment LLC
Email: support@emtelaak.com
data protection requests: dpo@emtelaak.com
Phone: +201205535888 (from inside or outside Egypt)
Address: Unit No. 104/2, First Floor, Al Jazeera Plaza Mall, 26th of July Corridor, Sheikh Zayed City, Giza, Arab Republic of Egypt.
Data Protection Officer (DPO): In accordance with the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, Emtelaak has appointed a Data Protection Officer responsible for overseeing our data protection practices and supporting compliance with applicable law. You may contact the DPO regarding the exercise of your data protection rights, questions or concerns about this Policy, complaints concerning the processing of your Personal Data, or reports of a Personal Data breach or security incident. DPO contact details: Email: dpo@emtelaak.com, Phone: +201205535888 (from inside or outside Egypt); Address: Unit No. 104/2, First Floor, Al Jazeera Plaza Mall, 26th of July Corridor, Sheikh Zayed City, Giza, Arab Republic of Egypt.
Legal entity details: Full legal name: Emtelaak for Projects Investment LLC Commercial Registry No. 217647
20. Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of the Arab Republic of Egypt, including, without limitation, the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, as amended from time to time. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of the Arab Republic of Egypt.