Privacy policy
Effective 27 June 2026. Governs data processed by Grand Musem Delta Guides LLC under Egypt Law No. 151 of 2020 on Personal Data Protection.
1. Data controller
Grand Musem Delta Guides LLC, 22 Gamal Abdel Nasser Street, Mansoura 35511, Egypt. Tax ID (ETA): 752-184-903. GAFI Registry: 462917. Email: [email protected]. Phone: +20 50 234 7816.
2. Scope
This policy covers personal data collected through grand-musem.xyz, email, phone, and in-person visits to our Mansoura office. It does not govern third-party museums, hotels, or transport operators you engage independently.
WhatsApp messages on paid tiers are covered when you initiate support through numbers we provide—do not send passport scans there.
3. Categories of data
Identity and contact: name, email, phone. Travel planning: dates, interests, mobility notes, tier selection. Technical: IP address and browser type in server logs retained fourteen days for abuse prevention. We do not collect passport numbers or payment card data through the website form.
4. Legal bases under Law 151/2020
Contract preparation: processing your route request to deliver agreed services. Consent: checkbox on contact form for storage and email reply. Legitimate interest: fraud prevention and fare-survey integrity without marketing profiling.
5. Purposes of processing
Preparing route PDFs, calling museums on your behalf, WhatsApp check-ins on paid tiers, invoicing with ETA-compliant receipts, and improving microbus fare tables aggregated without personal identifiers.
6. Storage location and security
Data resides on encrypted drives at our Mansoura office and on EU-hosted email when clients use Gmail or similar. Access limited to four coordinators under confidentiality undertakings. No sale of lists to hotels or cruise operators.
7. Retention periods
Active enquiries: until trip completion plus ninety days. Invoices and tax records: seven years per Egyptian commercial law. Marketing absence: we do not retain emails for newsletters; if you never complete a booking, delete requests after twelve months.
8. Sharing and processors
We share names and travel dates only with museum secretaries or tell guards when your tier includes verification calls. WhatsApp messages on nile-runner tiers pass through Meta infrastructure—avoid sending passport images there. No sharing with ad networks.
9. International transfers
Clients outside Egypt receive PDFs by email which may cross borders. We rely on your explicit request for cross-border communication. Bank transfers for desk fees follow your bank's jurisdiction.
10. Your rights
Under Law 151/2020 you may access, correct, delete, or restrict processing, and withdraw consent without affecting lawful prior processing. Object to processing based on legitimate interest by emailing [email protected] with subject "Data rights". We respond within thirty days.
11. Children
Services are directed at adults planning travel. If a parent contacts us for a family route, we process only the parent contact details unless the parent supplies minor first names for coordinator awareness—never publish those names.
12. Cookies and tracking
This site does not use analytics pixels, advertising cookies, or social trackers. No cookie banner is shown because no non-essential cookies are set. Server logs are not used to profile visitors.
13. Automated decision-making
We do not use automated profiling or credit scoring. Route suggestions are prepared manually by coordinators.
14. Complaints
Contact us first at [email protected]. You may lodge a complaint with Egypt's Personal Data Protection Centre when operational. Include our tax ID 752-184-903 in correspondence.
15. Changes
Material updates appear on this page with a revised effective date. Continued use after notice constitutes acceptance for new enquiries.
16. Data minimisation practice
We ask only for fields needed to route your trip. Optional phone numbers help WhatsApp tiers but are not mandatory on delta-explorer. Mobility notes may mention knee or heat sensitivity without medical record numbers.
17. Breach notification
If encrypted drives are compromised we notify affected clients within seventy-two hours with steps taken and Egypt PDPC reference when filed. Historical breach count: zero since 2013 incorporation.
18. Employee access logging
Coordinator access to enquiry folders is logged on office NAS with individual credentials. Departing staff accounts deactivate same day; PDF archives move to read-only shares.
19. Marketing absence statement
We do not buy email lists, retarget website visitors, or sync CRM to social platforms. Repeat contact happens only when you email us a new trip or hold an active coordinator tier.
20. Third-party email providers
Messages to Gmail, Outlook, or university hosts traverse their policies. We TLS-send from our domain; you may PGP-encrypt sensitive mobility medical notes if desired—keys on request.
Questions: contact form or [email protected].
Detailed retention schedule
Contact form submissions: active folder until trip plus ninety days, then archive zip encrypted. WhatsApp logs exported monthly to NAS, deleted from phones. Invoice PDFs seven years in tax cabinet per Egyptian commercial code article practice.
Access request procedure
Email [email protected] subject Data access with full name used on form. We verify via reply-from-same-email or phone callback to number on file. Export delivered JSON or PDF within thirty days.
Deletion procedure
Request deletion post-trip—we remove enquiry folder and WhatsApp export unless invoice retention mandates name on PDF copy. Anonymised fare survey statistics may remain without identifiers.
Subprocessors list
Email transit: your provider (Gmail, etc.). NAS vendor: Synology hardware on office LAN only. No Mailchimp, no HubSpot, no analytics SaaS.
Security measures
Office NAS AES volume. Laptop full-disk encryption. No client PDF on USB sticks—email or secure download link only. Coordinator phones screen-locked, wiped on resignation.
Law 151/2020 alignment statement
We process data lawfully, fairly, transparently; collect for specified purposes; ensure accuracy; store limited duration; secure integrity and confidentiality; demonstrate accountability via this policy and internal logs.
23. Sensitive categories
We do not seek health data beyond mobility notes you volunteer. Religion inferred only for Ramadan scheduling— not stored as profile field.
24. DPIA summary
Low risk processing: contact details, travel dates, no systematic monitoring, no large scale sensitive data. Review annual next June.
25. Contact DPO role
Nadia El-Kholy privacy contact [email protected] same as general—not separate DPO hire at our scale.
26. Cookie absence confirmation
No first party cookies set. No localStorage tracking. Form data not persisted browser side beyond session.
27. WhatsApp Business disclaimer
Meta processes messages when you use WhatsApp tier—their policy applies to transit. We export then delete phone copies post-trip.
28. Records of processing
Processing register maintained on office NAS: contact enquiries, invoices, WhatsApp exports, fare surveys anonymised. Reviewed annually each June alongside policy update.
29. Your acknowledgement
Contact form checkbox records consent timestamp in enquiry email headers—we do not store separate consent database.
30. Archival requests from authorities
Lawful Egyptian authority requests reviewed by Nadia before disclosure. Clients notified when gag order does not apply. Historical count zero through 2026.
31. Paper records
Signed invoice copies stored fireproof cabinet seven years. Shredded cross-cut after retention. No client PDF printed except on request—default digital.
32. Cross-border email
Replies to EU or UK inboxes cross borders by nature of your mailbox choice. We minimise attachments to route PDF only—no bulk marketing sends.
33. Children data
Parents emailing family trips: we store parent contact only unless parent lists child first names for coordinator awareness—never marketed to minors.
34. Data portability
Export includes enquiry emails and PDF copies we sent—JSON or zip on request within thirty days of verified identity.
35. Policy contact
Privacy questions: [email protected] with subject Privacy. Nadia El-Kholy responds within thirty days per Law 151/2020 practice even though formal DPO role is not separately staffed at our scale.
36. Retention audit
Annual June review deletes enquiry folders past retention and tests NAS restore from offline backup tape stored locked cabinet.
37. Transparency report
We publish no marketing analytics—zero ad pixels—and confirm annually in this policy that status unchanged. No third-party trackers load on grand-musem.xyz pages.
Enquiry emails stored encrypted NAS folder named by month not surname alone—reduces casual browsing risk.
Coordinator laptops auto-lock five minutes idle.
Backup NAS monthly offline drive stored locked cabinet—not cloud sync.
Enquiry deletion requests honoured unless invoice retention seven years applies.
34. Incident response
NAS failure restores from monthly offline backup within forty-eight hours—client data loss risk minimal. Laptop theft protocol remote wipe same day report.
35. Consent withdrawal
Withdraw consent email stops marketing—we send none anyway. Active trip processing continues until completion then delete per retention.
Policy effective date top page—material changes bump date and email active clients with open enquiries only.
Law 151 rights exercised zero requests 2013–2026—table maintained anyway readiness.
Questions privacy [email protected] thirty day response target Law 151.
Enquiry deletion honoured post-trip unless invoice retention requires name on file seven years.
Coordinator phones wipe on resignation—client PDF removed same day.
We do not sell or rent enquiry lists—ever—confirmed annual policy review.
Law 151 access requests answered within thirty days—email [email protected].