Privacy Policy

Privacy Policy

Effective date: August 2026
Last updated: August 2026

This policy explains what personal data Qboon collects, why we collect and process it, who we share it with, how long we keep it, and the rights you have over it.

The data controller is Qboon for Digital Solutions, trading as Qboon, Commercial Registration No. 255699, with its registered office at Unit D-53, Capital Mall, 5th Settlement, New Cairo, Arab Republic of Egypt.

We process personal data in accordance with Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations issued under Minister of Communications and Information Technology Decree No. 816 of 2025.

Privacy contact: legal@qboon.net

1. What we collect

Account data. Your name, email address, mobile number, password (stored only as a cryptographic hash), preferred language, and — for business accounts — company name, tax registration details and the address used for invoicing.

Order data. What you bought, when, the amount, the currency, the delivery method you chose, delivery scheduling, any gift message you wrote, the status of each gift card in the order, and your order history.

Recipient data. When you send a gift to someone else, we process the recipient's name, email address and/or mobile number so we can deliver it, plus whether and when they opened and claimed the gift. We use recipient details only to deliver the gift and to support that delivery. We do not add recipients to marketing lists merely because they received a gift.

Payment and transaction data. We record the payment method type, the last four digits of a card where our payment processor returns them, the transaction reference, the amount, and whether the payment succeeded. We never receive or store your full card number, expiry date or CVV. Those details are entered directly into Paymob's payment environment.

Egyptian law classifies financial data as sensitive personal data. Where limited payment or transaction information processed by Qboon falls within that classification, we handle it only for the purposes necessary to process transactions, prevent fraud, comply with legal obligations, and provide customer support, subject to the safeguards required by applicable law.

Support data. Messages you send us through the contact form, email, phone or WhatsApp, and our replies.

Technical data. IP address, device and browser type, operating system, language and region, pages viewed, referring page, and timestamps. Some of this comes from cookies and similar technologies (section 6).

Fraud and security data. Signals we or our payment processor use to detect fraudulent orders, such as unusual order patterns, mismatched details and repeated failed payments.

Other than the limited financial information described above, Qboon does not intentionally request sensitive personal data such as health information, religious beliefs, political opinions, biometric or genetic information, or security-status data. You should not send such information to us unless it is specifically required and lawfully requested.

2. Why we process it, and on what basis

We do not sell personal data.

We do not use personal data for automated decision-making that produces a legal effect on you without human review. Automated fraud and security checks may delay or block an order. If that happens, you can ask us to review the decision manually by writing to support@qboon.net.

3. Who we share it with

We share only what is reasonably necessary for the relevant purpose, including with:

• Partner brands — the issuer of a gift card receives the information needed to issue and honour that card. Depending on the brand and redemption method, this may include limited recipient or transaction information.
• Paymob, our payment service provider, and the acquiring banks, card schemes and wallet providers involved in processing the transaction, to take payment and process refunds or reversals.
• Communication providers that send transactional email, SMS or other delivery messages on our behalf.
• Hosting, storage, analytics and infrastructure providers that help operate and secure the Platform.
• Professional advisers — including accountants, auditors and lawyers — where they need the data to provide services and are subject to confidentiality obligations.
• Competent authorities, where disclosure is required by law, a competent authority, or a binding legal process, or where disclosure is necessary to investigate suspected fraud or criminal activity.

Where a service provider acts as a processor on our behalf, we require it to process personal data only for the agreed purposes and to protect it in accordance with applicable contractual and legal requirements.

4. Where data is stored and cross-border transfers

Where personal data is transferred, stored, shared or otherwise made available outside the Arab Republic of Egypt, Qboon applies the requirements of Law No. 151 of 2020 and its Executive Regulations. This may include obtaining the applicable licence or permit from the Personal Data Protection Centre, identifying the relevant destination country or countries, obtaining the data subject's consent where required, and ensuring that the destination provides the level of protection required by Egyptian law or that an applicable lawful exception is satisfied.

We maintain records of cross-border transfers as required by applicable law.

5. How long we keep it

We keep personal data only for as long as it is needed for the purpose for which it was collected, or for a longer period where required by law.

• Account data — while your account is open, and normally for 12 months after you close it, unless a longer period is needed for a legal claim, fraud investigation or another lawful purpose.
• Order, payment and invoicing records — generally for 5 years in line with applicable Egyptian tax and commercial record-keeping requirements.
• Gift card records — until the card expires or is fully redeemed, plus any applicable accounting, dispute or legal retention period.
• Support correspondence — normally for 24 months from the last message, unless it relates to an unresolved dispute or legal requirement.
• Technical and analytics data — normally for up to 12 months, subject to the settings of the relevant analytics service.
• Fraud and security records — up to 5 years where reasonably necessary to detect and defend against repeated fraud, abuse or legal claims.

When a retention period ends, we delete the data or irreversibly anonymise it unless continued retention is required or permitted by law.

6. Cookies

We use cookies and similar technologies for the following purposes:

• Strictly necessary — signing you in, keeping your cart, securing the checkout, and remembering essential settings. These are necessary for the Platform to operate.
• Preference — remembering settings such as language, region or other user preferences.
• Analytics — understanding how the Platform is used and where users encounter problems so we can improve it. These are used only where the required consent has been obtained.

The cookie banner shown on your first visit lets you accept or decline non-essential categories. Your choice is stored so that we can respect it on later visits.

You can change your cookie choices using the cookie settings made available on the Platform, where available, or through your browser settings. You may also write to legal@qboon.net. Blocking strictly necessary cookies may prevent account sign-in, checkout or other essential functions from working correctly.

7. Security and personal data breaches

We use technical and organisational measures designed to protect personal data, including encryption in transit (TLS), appropriate encryption or protection at rest where applicable, role-based access controls, hashed passwords, audit logging of administrative activity, and separation between production and test environments.

Payment card credentials are processed within Paymob's payment environment. Paymob describes its card-data handling as PCI-compliant, and Qboon does not receive or store the full card number, expiry date or CVV.

No system is completely secure.

Where a personal data breach or violation is subject to the notification requirements of Egyptian law, Qboon will notify the Personal Data Protection Centre within the legally required period, including within 72 hours where applicable, and will notify affected data subjects within the period required by law. The Executive Regulations require data subjects to be informed within three working days from the report to the Centre, with additional immediate notification requirements applying in certain serious cases.

8. Your rights

Under Law No. 151 of 2020, subject to the conditions and exceptions provided by law, you have rights including the right to:

• be informed about the personal data held about you and how it is used;
• access your personal data and obtain it;
• withdraw consent where the processing is based on your consent;
• rectify, modify, erase, supplement or update personal data;
• restrict processing to a specified scope;
• be informed of a breach or violation affecting your personal data;
• object to processing or its results where it conflicts with your fundamental rights and freedoms; and
• complain to the Personal Data Protection Centre.

To exercise your rights, write to legal@qboon.net. Under Article 32 of Law No. 151 of 2020, requests concerning the exercise of data-subject rights must be responded to within six working days from the date of submission.

We may ask you to verify your identity before acting on a request. This is to protect your personal data from unauthorised disclosure or alteration.

Any fee connected with exercising a statutory data-subject right will be limited to what is permitted or determined under applicable Egyptian law or by the Personal Data Protection Centre, and we will tell you in advance if a fee applies.

You can also correct certain account information yourself from your account settings, where that functionality is available, and you can unsubscribe from marketing using the unsubscribe mechanism in any marketing email or message.

If you are a recipient, not a purchaser: your details were provided to us by the person who sent you a gift for the purpose of delivering that gift. You may exercise the same applicable rights over your personal data by writing to legal@qboon.net.

9. Children

Qboon is not intended for anyone under 18 and we do not knowingly permit children to create purchasing accounts.

Egyptian law treats children's personal data as sensitive personal data and imposes additional requirements on its processing. If you believe a child has provided personal data to us directly or that we have processed children's data in circumstances not permitted by law, write to legal@qboon.net so we can investigate and take the appropriate action.

10. Other websites and services

The Platform may link to partner-brand websites, payment pages and other third-party services. When you use a third-party service, that third party may process personal data under its own privacy notice and legal responsibilities. Qboon is not responsible for a third party's independent processing activities.

11. Changes to this policy

We may update this policy from time to time. We will publish the updated version on the Platform with a new effective or last-updated date.

Where a change materially affects how we process personal data or requires new consent under applicable law, we will provide the required notice and obtain consent where necessary before applying the new processing.

12. Contact and complaints

Data protection contact: legal@qboon.net

Qboon for Digital Solutions (trading as Qboon)
Unit D-53, Capital Mall, 5th Settlement, New Cairo
Phone: +201055550646
Commercial Registration No.: 255699

If you are not satisfied with our response, you may submit a complaint to Egypt's Personal Data Protection Centre (PDPC), the supervisory authority established under Law No. 151 of 2020.