Privacy Policy

This policy explains how Aviator Retail ([registered legal entity name and commercial registration no. — to be confirmed], "Aviator", "we") processes personal data in connection with the Aviator platform and the Master Control Center at control.aviatorretail.com. For that processing we act as the data controller. This policy is issued in accordance with Egypt's Personal Data Protection Law No. 151 of 2020 ("PDPL").

Where Aviator hosts retail services on behalf of a merchant (a tenant) and processes the personal data of that merchant's customers, Aviator acts as a processor and the merchant is the controller; that customer-facing processing is governed by the relevant merchant's own privacy notice.

• Account & identity data — name, email address, and the credentials of platform operators, authenticated through our identity service.
• Usage & operational data — actions taken in the control center (an audit log of administrative operations), timestamps, and the tenant context of each action.
• Technical data — IP address, browser and device information, and security/session cookies necessary to keep you signed in and to protect the service.
• Communications — messages you send to us and transactional email we send to you.

The control center is a restricted operations tool; it does not collect data from the general public.

We process personal data to:

• authenticate operators and secure access to the platform;
• operate, maintain, and support the service and its tenants;
• keep an audit trail for security, accountability, and fraud prevention;
• send service and security communications; and
• comply with our legal obligations.

Our lawful bases under the PDPL are the performance of our contract with you or your organisation, our legitimate interest in securing and operating the platform, and, where required, your consent.

We do not sell personal data. We share it only with service providers that process data on our behalf under appropriate safeguards:

• Google Cloud — infrastructure hosting.
• Cloudflare — DNS, content delivery, and web application firewall.
• Resend — transactional email delivery.
• Keycloak (self-hosted) — identity and access management.

We may also disclose data where required by law or competent authority.

Some providers listed above process data outside the Arab Republic of Egypt. Where personal data is transferred across borders, we rely on the mechanisms permitted by the PDPL and its executive regulations and take reasonable steps to ensure an adequate level of protection.

We retain personal data only for as long as necessary for the purposes above and to meet legal or regulatory requirements, after which it is deleted or anonymised. Security and audit records are retained for [retention period — to be confirmed].

Access is restricted to authorised operators, traffic is encrypted in transit (TLS), the origin is fronted by a web application firewall, and administrative actions are logged. We keep these measures under review.

Subject to the PDPL, you have the right to:

• be informed about, and access, the personal data we hold about you;
• have inaccurate data corrected and, in defined circumstances, erased;
• object to or restrict certain processing, and withdraw consent where processing relies on it;
• lodge a complaint with the Egyptian Data Protection Centre.

To exercise any of these rights, contact us using the details below.

We use strictly necessary cookies to authenticate you and secure your session. We do not use advertising or third-party analytics cookies on this control center.

We may update this policy from time to time. Material changes will be reflected by the "last updated" date above.

For any privacy question or to exercise your rights, contact our data protection contact at privacy@aviatorretail.com. Postal address: [registered address — to be confirmed].