- Status
- Not published
- Version
- Not assigned
- Effective date
- Not effective
Privacy Notice
Draft for legal review. This document is not yet effective. No legal entity, registration identifier, version, effective date or last-updated date is published until authoritative information and approval are supplied.
Registration details shown as *** are being completed. They are published only once the authoritative company record and legal approval are supplied.
This Privacy Notice explains how personal data is collected, used, disclosed, protected and retained when you visit the OCTK Restaurant OS website, create an account, communicate with OCTK or use our services.
We are committed to processing personal data in accordance with applicable Egyptian laws, including the Personal Data Protection Law, its Executive Regulations and decisions issued by the competent authority.
1. Who is responsible for personal data?
For data whose purposes and means of processing are determined by OCTK, *** is the data controller.
The configured privacy contact is [email protected]. A DPO contact is published only after appointment and approval.
2. When OCTK acts as controller
Depending on actual use, controller activities may include account creation, the subscription contact, communications, sales and support requests, billing and commercial records OCTK determines how to use, security and access records necessary to protect the platform, and OCTK marketing where an appropriate legal basis exists.
3. When OCTK acts as processor
When a subscribing restaurant uses OCTK Restaurant OS to process data relating to its operations and determines the purposes and means, the restaurant acts as controller and OCTK as processor on its behalf and documented lawful instructions, subject to law and the DPA.
4. Data categories
The data processed varies according to how the website or service is used. Categories may include name, business role, email and phone; business and restaurant details and onboarding information; configured subscription and billing references; communications; technical and security records when actually collected; website preferences; and restaurant-processed data according to actual functions. No card number is represented as stored by this frontend.
5. Data sources
Data may be obtained directly from you, from the business on whose behalf you use the service, from your use of the service and its technologies, and from providers or integrations used by the system where lawful and appropriate.
6. Purposes and legal bases
The table below preserves the required purpose, data and legal-basis structure. The final legal basis for security and support activities remains subject to the approved data mapping and applicable facts.
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation and administration | Account, identity and business data | Contract performance or steps necessary for it, as applicable |
| Service provision and operation | Account, business and service-use data | Contract performance |
| Billing and payments | Subscription, billing and transaction data | Contract performance and related legal obligations |
| Legal and tax obligations | Identity, business, billing and tax evidence | Legal obligation |
| Security and misuse prevention | Technical and security records actually collected | The appropriate basis established after approved data mapping, such as legitimate interest where its conditions are met |
| Support | Account and communication data | Contract performance or legitimate interest, as applicable |
| Direct marketing | Contact details and marketing consent evidence | Consent where required under Egyptian law |
7. Electronic direct marketing
Acceptance of subscription terms is not treated as consent to direct marketing. Where consent is required, it is obtained separately and explicitly and may be withdrawn using the method in the message or by contacting OCTK. No electronic direct marketing is enabled until the operational and regulatory state is verified.
9. International transfers
All personal data described in this Notice is processed outside the Arab Republic of Egypt. This is not occasional or exceptional: the cloud infrastructure OCTK Restaurant OS runs on has no Egyptian region, so every account, order, invoice, file and log is stored and processed abroad.
Two destinations are involved today. The primary one is the United States, where the databases, server-side processing, authentication and file storage operate. The second is the Russian Federation: when an address is searched or a location is selected on a map in the customer ordering flow, that address text and those coordinates are sent to a geocoding provider operating from Russia, together with the technical request data any web request carries.
Delivery route calculation additionally sends the delivery coordinates and the assigned driver position to an external routing service.
The recipients, and what each one receives, are listed in the Sharing and subprocessors section below. The requirements, safeguards, licences or permits applicable to these transfers under the Personal Data Protection Law, its Executive Regulations and the decisions of the Personal Data Protection Centre are under review and are not claimed as complete.
10. Retention
OCTK does not retain personal data longer than necessary for the legitimate purposes for which it was collected or processed, taking into account legal, tax and accounting obligations, dispute resolution and security requirements.
Three periods are settled and are stated below. Two are not yet decided, and are named rather than omitted: a period that has not been chosen is not the same as a period of unlimited length, and neither should be discovered by a reader after the fact.
Remaining categories follow an approved retention matrix that is still being completed. Until it is approved, this Notice does not state a period it cannot support.
| Category | Period | Basis |
|---|---|---|
| Invoices and tax records | 5 years | Tax law in Egypt and Saudi Arabia |
| A terminated account | 30 days, then permanent deletion | Reversible by the owner throughout that period |
| Support tickets | 180 days after the ticket is closed | Automatic deletion once the period ends |
| Employee attendance records | Not yet decided | Stated here rather than left unmentioned |
| Diner order history | Not yet decided | Stated here rather than left unmentioned |
11. Data subject rights
A data subject may exercise rights available under Egyptian law and applicable procedures, including rights relating to awareness, access, correction or updating, deletion requests, withdrawal of consent where processing is based on it, objection, or restriction where provided by law.
Some requests may be subject to legal limitations or exceptions, such as the need to retain certain records to meet a legal obligation.
12. How to exercise rights
A personal-data request may be sent to: [email protected]. A dedicated privacy mailbox is being completed; until it is published, this is the correct address.
We may request appropriate information to verify the requester’s identity and protect data from unauthorized disclosure.
The request will be handled under the periods and procedures established by law. The submission backend is not connected and the frontend does not claim receipt.
13. Complaints
If you have a concern about processing your data, you may first contact us at [email protected]. You also retain the right to submit a complaint to the Egyptian Personal Data Protection Center under the procedures established by applicable law, regulations and decisions.
14. Protection
OCTK uses technical and organizational measures appropriate to the nature of the data and risks to protect data against unauthorized access, disclosure, alteration, loss or destruction.
No unverified certification, technical standard, availability, backup or infrastructure guarantee is stated.
16. Changes
Published changes require version, last-updated and effective-date metadata. Material changes receive appropriate notice and renewed consent where required.