Privacy Policy

Scope of this policy

• This policy applies to everyone who uses the Piperona website or app, whether a customer making purchases or a merchant making sales.
• The data controller is Piperona Commerce, registered under Commercial Registration No. 58385.
• Using the platform means that you have reviewed this policy. This does not replace any express consent we request when collecting specific data.

Data we collect from customers

• Name, telephone number, and email address.
• Delivery address and any alternative addresses you add.
• Order details and your purchase and return history.
• Bank-account or wallet details when you choose to receive a refund for an order paid by cash on delivery.
• Your correspondence with Customer Service.
• Technical data about your device, browser, and use of the platform.

Data we collect from merchants

• Store name and the establishment's legal name.
• Commercial registration, tax card, and documents supporting the business activity.
• Information about the establishment's representative and how to contact them.
• The bank account designated for payouts.
• Order-preparation addresses and pickup times.
• Operational performance data on the platform.

Payment data

• Piperona does not retain payment-card numbers and does not have access to them at any stage.
• Electronic payments are processed entirely by a payment-service provider licensed by the Central Bank of Egypt.
• For reconciliation and refunds, we retain the result of the transaction, its reference number, and the last four digits of the card when available.
• No Piperona employee will ask for your card details or account password under any circumstances.

Purposes and legal bases

Who we share data with

What we do not do

• We do not sell your personal data to any party.
• We do not share your data with advertisers or data brokers.
• A merchant may not use customer data outside the scope of fulfilling the order, contact a customer for marketing purposes, or direct a customer to buy outside the platform.
• We do not use your data to make automated decisions that have a legal effect on you without human review.

Children's data

• The platform is intended for adults. A person under 18 may not create an account.
• Because of the nature of our products, a parent or guardian may enter data about a child, such as date of birth or size, to receive suitable product recommendations.
• By entering this data, the parent or guardian consents in their capacity as the child's legal guardian and may delete it at any time through account settings.
• We do not use children's data for targeted marketing.

Data retention

• We retain your data for as long as needed for the purpose for which it was collected.
• Order, delivery, and payment records are retained for at least 18 months so we can respond to payment disputes.
• Accounting and tax records are retained for the period required by law.
• When an account is closed, data that no longer serves a purpose is deleted, and only data required by law is retained.

Your data rights

The Personal Data Protection Law grants you the following rights:

• To know about, access, and obtain the data relating to you.
• To correct, amend, erase, supplement, or update it.
• To withdraw prior consent to its retention or processing.
• To restrict its processing to a specific scope.
• To be informed of any breach or violation affecting your data.
• To object to the processing of your data or its results where it conflicts with your fundamental rights and freedoms.

To exercise any of these rights, contact us using the Data Protection Officer details at the end of this page. We will respond within the period prescribed by law. We may be unable to fulfil an erasure request in full where the data is required to meet a legal obligation; if so, we will explain the reason and retention period.

Data security

• We apply technical and organisational measures to protect data from unauthorised access, disclosure, or alteration.
• Access to data is limited to those whose work requires it and to what is necessary to perform their duties.
• If a breach affects your data, we notify the competent Center within 72 hours of becoming aware of it and notify affected data subjects within three business days.
• The notice describes the breach, affected data, its consequences, and the measures taken to address it.

Cookies

• We use cookies to operate the platform, save your preferences, and retain your shopping cart.
• We use analytics cookies to measure and improve the platform's performance.
• You can control non-essential cookies through browser settings or the consent notice on the website.
• Disabling essential cookies may prevent parts of the platform from working correctly.

Transfers outside Egypt

• Some data may be processed or stored by technology service providers outside the Arab Republic of Egypt.
• This occurs only to the extent permitted by the Personal Data Protection Law and provided that a level of protection no lower than that required by law is available.
• We bind service providers to contractual obligations of confidentiality and prohibit them from using data for purposes other than those agreed.

Changes to this policy

• We may update this policy from time to time. The date of the latest update appears at the top of the page.
• If we make a material change, we will notify you through your registered email address or an in-platform notice.
• Your continued use of the platform after a change takes effect means that you have reviewed it.