Privacy policy
This is a translation. The Arabic version of this document is the authoritative text and governs its interpretation. This English version is provided for convenience only. If the two differ, the Arabic prevails. Read the Arabic version.
Who we are
"Hive Stewards Egypt" is the trading name of [Egyptian company name], registered in the commercial register under number [...] and tax card number [...], with its address at [address]. We are the controller of the personal data described in this policy for properties and clients in Egypt.
Our processing of your data is governed by Personal Data Protection Law No. 151 of 2020 and its executive regulations.
For anything about your data, email dpo@hivestewards.com.
What we collect
If you contact us
- Your name and email address, and a contact phone number if you choose to provide one. Providing a phone number is optional.
- The area or address of your property, and any listing link you share
- Anything you send us on WhatsApp, if you use the message button
The WhatsApp button on our site is an ordinary link: it opens the app on your device and stores nothing with us. What you send afterwards is held in your account and ours, and is subject to Meta’s terms as well as this policy.
When you send the enquiry form, we save a private recovery copy on our hosting account and send the details to our business inbox. The retention periods below explain how long these copies are kept.
If you become a client
- Contact and billing details, and bank account details so we can pay you what you are owed
- Property details, entry codes, the holiday-home licence, and safety and insurance documents
- Booking and earnings records for the properties we manage
- Guest names and contact details as they come through the booking platforms
Guest details reach us from the booking platform or the property owner, including bookings made directly with the owner, and we use them to run the stay itself: arranging entry, answering questions, coordinating the changeover, issuing compound entry permits, and passing guest details to the owner as licence holder so they can file them with the authorities on time; requesting a review through the platform after checkout; and keeping the records the law requires. We send guests our Guest privacy notice with the first message we send them.
Why we use it, and our legal basis
- To answer enquiries and prepare quotes, at your request and as steps before a contract.
- To provide the management service, in performance of our contract with you.
- To meet legal obligations: tax records, and the tourist accommodation licensing and guest data requirements.
- To improve the service and keep a record of what we did, for our legitimate interest in running the business, balanced against your rights.
We use your data for electronic marketing only with your express consent, which you can withdraw at any time without affecting the lawfulness of anything done before you withdrew it.
You are not obliged to give us this information, but there is some we cannot work without. If you do not give us the property address, the licence details or the entry codes, we cannot manage the property.
No automated decisions
We make no decisions about you by automated means and we do not profile you. Nightly pricing is set by software, but it concerns the price of the property rather than people.
Who we share it with
We share only what is necessary, with:
- The booking platforms you use
- Compound management or security, to issue guest entry permits
- Cleaners, trades and contractors, who are given only the details for a specific job
- Our sister company in the United Kingdom, with whom we share the same systems, so its staff can reach records held on them
- Our accountant, our insurer and our professional advisers
- The software we use to run the service, such as pricing and messaging tools
- The authorities where the law requires it of us directly, noting that routine guest reporting to the Ministry of Tourism and Antiquities falls on the owner as licence holder
We never sell personal data.
Transfers outside Egypt
We share the systems and software we run the service on with our sister company in the United Kingdom, and those systems are hosted by companies outside Egypt. This means your data, including your property details and your guests’ details, is held outside Egypt and can be reached from the United Kingdom.
That transfer happens only so far as the Personal Data Protection Law and its executive regulations permit, under the authorisations set by the Personal Data Protection Centre, and with your express consent where the law requires it. Our duty to protect your data continues exactly as if it were held in Egypt, and access is limited to those who need it to do their job.
How we keep it safe
Our hosting provider keeps standard server logs, including the IP address, the time of the visit and the page requested, for security purposes. They are deleted automatically on the provider’s usual schedule, we use them for nothing else, and we can tell you the current period on request. Access to client records is limited to those who genuinely need it, through accounts protected by strong passwords and two-step verification wherever the service offers it. Devices are encrypted and kept up to date.
If a breach affects your personal data, we notify the Personal Data Protection Centre within the period the law allows (72 hours), and then notify those affected within three working days of notifying the Centre, as the law requires.
Children’s data
Our services are aimed at property owners, and we do not collect children’s data for our own purposes. A booking may state how many children are staying, and we use that only to prepare the property. Where compound entry permits or official guest reporting require the details of everyone staying, including minors, we provide them only to the extent that obligation requires, and they are subject to the retention periods set out below.
How long we keep it
We save a private recovery copy of website submissions so we can confirm receipt and retry emails if mail is unavailable. We use the email address you provide to send an automatic receipt after recording enquiries. We normally delete the recovery copy 30 days after our mail server accepts all required emails or they are manually resolved. If a temporary fault prevents the compact reporting entry being saved, we retain the recovery copy until that fault is repaired and the entry is safely preserved. Where a submission has both your receipt email and our internal notification, that period begins at the later completion time. Submissions still awaiting resolution remain available for review. The separate retention periods for business records and correspondence are listed below.
Submission monitoring and monthly reports
We keep a compact operational register of receipt references, submission times, form types, website languages and the delivery states of business notifications and customer acknowledgements. We use it to check requests are handled reliably and send monthly reports to the relevant country’s business inbox. It excludes names, contact details and client messages, but a reference can be linked to the original submission. This operational monitoring covers all recorded submissions, whether or not you allow optional review statistics.
The register and private report copies on our OVHcloud hosting account in France cover the current month and three completed months. Older copies are cleared at the next maintenance or report-processing run. Unresolved recovery records follow the retention described above; emailed report copies may remain in our business mailboxes under the correspondence policy.
We also use the email address and IP address supplied with a request to limit repeated submissions and automated emails. The security counters use protected identifiers and expire within a day; the next scheduled maintenance run removes expired counters.
- Enquiries that do not become contracts: 12 months
- Client records and correspondence: 5 years after the contract ends
- Financial records and books: 5 years, under the Unified Tax Procedures Law No. 206 of 2020
- Guest correspondence and booking records: 12 months from the checkout date, or longer while a claim or dispute is open
- Copies of guest identity documents: deleted within 30 days of checkout at the latest, and sooner once the purpose has been served
- Licensing and safety documents: for as long as we manage the property, then 5 years afterwards
Guest notice
This notice is for property owners. Guests have a separate notice setting out what we hold about them and how we use it: Guest privacy notice.
Data protection officer
We will appoint a data protection officer and register them with the Personal Data Protection Centre wherever the law requires it, and will publish their contact details on this page once registration is complete. In the meantime all data protection matters go to dpo@hivestewards.com.
Your rights
The Personal Data Protection Law gives you rights over your data, including: knowing what we hold about you, seeing it and obtaining a copy, correcting, amending or updating it, asking for it to be erased, limiting its processing to a defined scope, objecting to the processing or its results, and withdrawing your consent.
To exercise any of these, email us at dpo@hivestewards.com setting out what you would like. We answer within six working days of receiving the request, the period the law allows. We may ask you to prove who you are before acting, so that we do not hand your data to someone else.
Complaining about how we use your data
If you think we have not handled your data properly, tell us first at dpo@hivestewards.com. We acknowledge quickly, look into it, and come back to you with the outcome.
You may in any case complain to the Personal Data Protection Centre, which enforces the law in Egypt. You are not required to come to us first.
Changes to this policy
If we change how we use personal data we will update this page and the date at the top, and we will tell existing clients about any material change by email.
Optional website statistics
With your consent, we record limited activity to improve the readiness review: a review starting, results being shown, a review being attached and an enquiry containing a review being saved. Reports contain monthly totals by country and website language, without your name, contact details, property details or answers. Normal submissions and emails remain covered by the rest of this notice.
Statistics are off by default. Decline or withdraw consent at any time through Statistics choices, without affecting use of the forms. A preference cookie remembers your choice for 180 days separately for each country. Withdrawal stops future activity and does not affect earlier lawful processing. Previous aggregate totals cannot isolate one person’s events.
Our OVHcloud hosting account in France processes statistics requests. We use no external analytics service. A temporary random token and derived keys prevent duplicates and excessive use; raw IP addresses are not saved in the statistics store. Browser-event keys last up to 24 hours, IP-derived protection keys up to one hour, and enquiry duplicate-prevention records until the report is prepared or 35 days at most. Expired entries are cleared on the next request or hourly maintenance run. Separate hosting security logs follow the retention described above.
We keep the current month’s totals and 13 completed months and email reports to the relevant country’s business inbox. Copies of these aggregate reports may remain in our business mailboxes. Consent is the basis for this optional use; abuse-prevention data protects the service. See our cookies page for details and controls.