Privacy policy.

Gouna Realty is a real-estate property platform operating in El Gouna, Red Sea, Egypt. The platform connects property buyers — primarily international buyers based in Europe and the Gulf — with licensed local real-estate agents.

Data controller

Gouna Realty acts as the data controller for personal data processed through the Platform. The data controller decides why and how personal data is processed.

- Operating brand: Gouna Realty - Operational base: El Gouna, Red Sea Governorate, Egypt - General contact: info@gouna-realty.com - Data protection contact (DPO): dpa@gouna-realty.com

EU representative

For visitors based in the European Economic Area, you can reach our EU representative for GDPR matters via dpa@gouna-realty.com. We will route your request to the appropriate point of contact within one business day.

Response times

We aim to respond to all privacy-related questions within 72 hours and to formal data-subject requests within 30 days, in line with Article 12(3) GDPR. If your request is complex or you submit multiple requests in a short period, we may extend the deadline by up to two further months. We will inform you in writing if that happens, including the reason for the delay.

We collect only the data that is necessary to operate the Platform and route buyer inquiries to the right local agent. We do not sell personal data to third parties. We do not use personal data for advertising profiling. We do not enrich your profile with data bought from data brokers.

2.1 Data you provide directly

When you submit a property inquiry, contact form, partner-agent application, or newsletter sign-up, we may collect:

- Your name (first and last) - Your email address - Your WhatsApp number or phone number (with country code) - Your country of residence (used for currency and timezone defaults) - Your budget range and property preferences (if provided via our intake wizard) - Your message text or inquiry topic - Optional: your preferred viewing dates and arrival information

For partner-agent applications we also collect business name, Egyptian real-estate licence number, agency address, and proof of identity for compliance with anti-money-laundering rules.

2.2 Data collected automatically

When you visit the Platform, we automatically receive:

- Your IP address and approximate geographic location (city-level, derived from IP) - Browser type, language preference, operating system, and device type - Pages visited, time spent, scroll depth, and referral source - Interactions with property listings (saves, clicks, filter selections, map pans) - Diagnostic data when something breaks (error stack-traces, request IDs)

2.3 Cookies and local storage

We use cookies and browser local storage for functional purposes only. See our Cookies Policy for the full table. In summary:

- Functional: consent state (gouna-realty:consent), currency preference (gouna_currency), saved property likes (gouna_likes), accepted-language preference - Analytics: aggregated traffic data via Plausible Analytics (privacy-friendly, no personal identifiers, no cross-site tracking) - No advertising cookies are set. No third-party tracking pixels are loaded.

2.4 WhatsApp interactions

When you click a "Chat on WhatsApp" link on the Platform, you are redirected to WhatsApp (operated by Meta Platforms Ireland Limited). We do not receive or store the content of WhatsApp conversations. We log the click event (timestamp, page, property slug, country, anonymous session ID) for internal analytics. WhatsApp's own privacy policy governs the conversation itself.

2.5 Special categories of data

We do not knowingly collect special categories of data as defined in Article 9 GDPR (race, religion, political opinion, health, sexual orientation, biometric data, genetic data). If you submit such data voluntarily in a free-text message, we will treat it as accidental, redact it from our records, and ask you to communicate it through a more appropriate channel.

2.6 Data we do not collect

To be explicit, we do not collect: payment card details (no in-platform payments), full passport scans (only the data fields required for property registration are exchanged offline by your agent), social-media login tokens, or device fingerprints beyond what your browser sends in standard HTTP headers.

We process personal data on one or more of the following legal bases under Article 6 GDPR. Where Egyptian PDPL applies, we rely on the equivalent lawful grounds in Articles 4-7 of the PDPL.

3.1 Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR)

When you submit an inquiry or contact form, we process your contact information to connect you with a local agent. This is necessary to provide the service you requested. Without this data we cannot route your inquiry.

3.2 Legitimate interests (Art. 6(1)(f) GDPR)

We process technical data (IP addresses, browser data, click events, error logs) based on our legitimate interest in operating a secure, reliable, and continuously improving platform. We have run a balancing test (Legitimate Interest Assessment) and concluded that this processing does not override your interests or fundamental rights, because the data is minimised, retention is short, and we offer you a clear way to object.

You have the right to object to processing based on legitimate interests at any time — see section 8.

3.3 Consent (Art. 6(1)(a) GDPR / Egyptian PDPL Art. 4)

We rely on your consent for the use of analytics cookies and for marketing communications (such as our newsletter). You can withdraw consent at any time via the cookies preferences link in our footer or by clicking unsubscribe in any marketing email. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

3.4 Legal obligation (Art. 6(1)(c) GDPR)

In certain cases we must process personal data to comply with a legal obligation — for example retaining transaction-related records for tax or anti-money-laundering reporting under Egyptian commercial law.

3.5 Vital interests and public interest

We do not currently rely on Article 6(1)(d) (vital interests) or Article 6(1)(e) (public interest). If that changes, we will update this policy.

We use your personal data for the following purposes only:

- Lead routing: forwarding your inquiry and contact information to the relevant licensed agent in El Gouna - Platform operation: displaying properties, processing filter preferences, maintaining saved lists, currency conversion - Analytics: understanding how users navigate the Platform in aggregate, in order to improve it (Plausible Analytics — no individual profiling) - Security: detecting and preventing fraudulent or abusive activity, defending against scraping bots, mitigating denial-of-service attacks - Service communications: transactional emails such as inquiry confirmations and account notices (these are not marketing) - Marketing communications: newsletter and property alerts, only if you have opted in - Legal compliance: retaining records as required by Egyptian tax, real-estate, and anti-money-laundering regulation - Partner-agent onboarding: if you apply to become a partner agent, we process your application details to assess eligibility and onboard you

4.1 No automated individual decisions

We do not use your personal data for automated individual decision-making or profiling that produces legal effects or similarly significant effects within the meaning of Article 22 GDPR. Property recommendations on the Platform are based on filter criteria you set yourself; they are not personalised predictions about you.

4.2 No sale or "share" of personal data

We do not sell personal data. We do not "share" personal data for cross-context behavioural advertising under any US-state privacy law. Article 13(1)(e) GDPR transparency: the only recipients of your personal data are listed in section 6.

We share personal data with the following categories of third parties, only to the extent necessary, and only under written data-processing agreements where required by Article 28 GDPR. Each sub-processor below is named, with the country where data is processed, the purpose of the processing, and the public DPA reference where available.

5.1 Partner agents (data recipients, not processors)

When you inquire about a property, your name, WhatsApp number, and inquiry details are forwarded to the licensed agent responsible for that listing. The agent acts as an independent controller for the lead they receive and is contractually instructed to handle your data in line with applicable law.

5.2 Infrastructure and platform sub-processors

| Sub-processor | Country / region | Purpose | DPA | |---------------|------------------|---------|-----| | Supabase | EU (Frankfurt) | Postgres database, authentication, file storage | supabase.com/legal/dpa | | Vercel | EU edge + United States | Hosting, edge functions, CDN | vercel.com/legal/dpa | | Cloudflare | Global (EU traffic via EU points-of-presence) | DNS, WAF, DDoS mitigation, R2 image storage | cloudflare.com/cloudflare-customer-dpa | | Plausible Analytics | EU (Germany) | Privacy-friendly traffic analytics, no personal identifiers | plausible.io/data-policy | | Brevo | EU (France) | Transactional email and opted-in newsletter delivery | brevo.com/legal/dpa | | Sentry | EU (Frankfurt) | Error monitoring, stack traces, performance metrics | sentry.io/legal/dpa | | Axiom | EU + United States | Application log retention and search | axiom.co/dpa | | BetterStack | EU + United States | Uptime monitoring, status page, on-call alerting | betterstack.com/dpa |

We maintain a current sub-processor list at /privacy/subprocessors. We will give you 30 days' notice before adding a new sub-processor that processes personal data, by updating this page and emailing newsletter subscribers.

5.3 WhatsApp / Meta

When you click a WhatsApp link, you are transferred to WhatsApp (Meta Platforms Ireland Limited). We do not transmit your data to Meta; your device establishes a direct connection with WhatsApp. Meta's own privacy policy governs the conversation itself.

5.4 Law enforcement and regulators

We may disclose personal data when we are legally required to do so by a competent authority (Egyptian regulator, Dutch supervisory authority, court order, valid subpoena). We push back on overly broad requests and will inform you of any disclosure unless we are legally prohibited from doing so.

5.5 Business transfers

If Gouna Realty is acquired or merges with another entity, your personal data may be transferred to the successor. We will notify you in advance via this page and via email if you are subscribed, and you will have an opportunity to exercise your data-subject rights before the transfer takes effect.

5.6 No data sales

We do not sell personal data to any third party, under any circumstances.

Gouna Realty operates from Egypt and serves buyers primarily from the EU/EEA. Some of our sub-processors are based outside the EU/EEA or replicate data across regions. When we transfer EU personal data to a country outside the EU/EEA, we rely on one or more of the safeguards in Chapter V GDPR.

6.1 Standard Contractual Clauses (SCCs)

For transfers to countries without an EU adequacy decision (including transfers to United States sub-processors and to Egypt), we use the European Commission's 2021 Standard Contractual Clauses, Module 2 (controller-to-processor) or Module 3 (processor-to-processor), supplemented where appropriate by additional technical and organisational measures such as encryption-at-rest and EU-only processing keys.

6.2 Transfer Impact Assessments (Schrems II)

We have performed a Transfer Impact Assessment for each non-EU sub-processor, taking into account the laws of the destination country, the type of personal data transferred, the technical safeguards in place, and the practical likelihood of government access. Where the assessment identified residual risk, we have applied additional safeguards (for example: end-to-end encryption, pseudonymisation, EU-only processing flags, vendor commitments not to comply with overbroad government requests).

6.3 Egypt — adequacy and PDPL safeguards

Egypt does not currently have an EU adequacy decision under Article 45 GDPR. However, the Egyptian PDPL (Law No. 151 of 2020) provides a comparable framework: it requires a lawful basis for processing, mandates data-subject rights, restricts cross-border transfer, and is supervised by the Personal Data Protection Center. For transfers from the EU into Egypt we layer SCCs on top of PDPL compliance and we keep our Egyptian operations under the same internal data-handling rules that apply in the EU.

6.4 Onward transfers

Our sub-processors are contractually prohibited from making onward transfers of your personal data without an equivalent legal basis. If you would like a copy of the safeguards applicable to a specific transfer, contact dpa@gouna-realty.com and we will provide them subject to commercial-confidentiality redactions where necessary.

We retain personal data only for as long as is necessary for the purposes set out in this policy, or longer if required by law. We review retention schedules annually.

7.1 Retention schedule

| Category | Retention period | Trigger to delete | |----------|------------------|-------------------| | Inquiry and lead data | 36 months from last interaction | No interaction for 36 months | | Scraped property listings (public source data) | 5 years | Property removed from source + 5 years | | Account data (registered buyers / partner agents) | Indefinite while active | 12 months after account is closed | | Analytics data (Plausible) | 12 months in identifiable form, aggregated indefinitely | Rolling window | | Server access logs (IP, request paths) | 90 days | Automated rotation | | Cookie-consent records | 12 months from last update | Re-consent requested | | Newsletter subscriptions | Until unsubscribe + 30 days for proof-of-consent | Unsubscribe | | Partner-agent onboarding documents | 5 years post-termination | Anti-money-laundering minimum hold | | Tax-related transactional records | 5 years | Egyptian commercial law minimum | | Security incident logs | 24 months | Closed-investigation + 24 months |

When the retention period ends, data is securely deleted or irreversibly anonymised (statistical aggregates only, no re-identification possible).

7.2 Backups

Encrypted backups of our database are retained for 30 days as part of our disaster-recovery plan. When you exercise your right to erasure, your data is removed from the live database immediately and from the backup chain within 30 days as backups roll over.

7.3 Legal hold

If we receive a valid legal hold (litigation, regulatory investigation), we may retain specific records beyond the schedule above until the hold is lifted. We will inform you of any legal hold that affects your data, unless we are legally prohibited from doing so.

Depending on your jurisdiction, you have the following rights regarding your personal data. We honour these rights free of charge unless your request is manifestly unfounded or excessive.

8.1 Rights under GDPR (EU/EEA residents)

- Right of access (Art. 15): request a copy of the personal data we hold about you, together with the purposes of processing, categories of data, recipients, retention period, and the source of any data we did not collect directly from you. - Right to rectification (Art. 16): request correction of inaccurate or incomplete data. We respond within one month and notify any recipients to whom the data was disclosed. - Right to erasure / "right to be forgotten" (Art. 17): request deletion of your data, subject to legal-retention obligations (tax, anti-money-laundering, ongoing contracts). - Right to restriction of processing (Art. 18): request that we pause processing while a dispute is resolved, instead of deleting the data outright. - Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format (JSON or CSV), and transmit it to another controller. - Right to object (Art. 21): object to processing based on legitimate interests (section 3.2) or to direct marketing. Once you object to direct marketing, we stop immediately. - Right not to be subject to automated decisions (Art. 22): we do not make legally significant automated decisions about you, so this right is rarely engaged — but if that ever changes, you can request human review. - Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is based on consent. Withdrawal does not affect lawful processing prior to withdrawal. - Right to lodge a complaint with a supervisory authority (Art. 77): see section 13.

8.2 Rights under Egyptian PDPL (Egyptian residents)

- Right to know the purpose of processing - Right to access your personal data - Right to correct inaccurate data - Right to delete data (subject to legal-hold requirements) - Right to withdraw consent at any time - Right to object to processing for direct marketing - Right to lodge a complaint with the Personal Data Protection Center

8.3 Rights under other regimes

If you are based in the United Kingdom, Switzerland, or any other jurisdiction with comparable privacy law, we apply the equivalent rights under your local law on a best-effort basis. Contact dpa@gouna-realty.com to discuss.

8.4 How to exercise your rights

Send a request to dpa@gouna-realty.com with the subject line "Data rights request" and tell us which right you wish to exercise. We may ask you to verify your identity before we process the request, to prevent unauthorised disclosure. We respond within 30 days (Article 12(3) GDPR). For complex or multiple requests we may extend the deadline by up to two further months and will inform you in writing.

You can also delegate a representative (such as a privacy NGO or lawyer) to act on your behalf — please provide written authorisation.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or unauthorised disclosure (Article 32 GDPR).

9.1 Technical measures

- Encryption in transit: TLS 1.3 with modern cipher suites; HSTS preload; HTTP Strict Transport Security across all subdomains - Encryption at rest: AES-256 encryption for the database (Supabase) and for object storage (Cloudflare R2) - Row-level security: multi-tenant data isolation via Supabase row-level security policies, audited per release - Two-factor authentication: mandatory for all administrative accounts; phishing-resistant WebAuthn supported - Secrets management: API keys and credentials stored in encrypted environment variables, rotated quarterly - Network controls: Cloudflare WAF, rate-limiting, bot protection; restricted database network access via private networking only

9.2 Organisational measures

- Need-to-know access: only staff members with a documented business need can view personal data - Background checks for staff with administrative access - Security training for all staff on intake and annually thereafter - Vendor risk assessments for every sub-processor before onboarding - Annual external security review and penetration test

9.3 Breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Article 34 GDPR), with clear information about what happened, what data was affected, what we are doing, and what you can do.

We document every breach in our internal incident register, including the facts, effects, and remedial action taken (Article 33(5) GDPR).

9.4 Reporting a concern

No system is completely secure. If you believe your data has been compromised, or you have spotted a vulnerability, contact security@gouna-realty.com or dpa@gouna-realty.com immediately. We operate a responsible-disclosure programme and do not pursue legal action against good-faith security researchers.

We use a small number of strictly functional and analytics cookies. We do not use advertising, retargeting, or cross-site tracking cookies. For the full table — name, purpose, retention, third party — see our Cookies Policy at /cookies.

Quick summary

- Functional: required for the Platform to work (consent state, currency preference, saved likes). No consent required because they are strictly necessary. - Analytics: Plausible Analytics, aggregated and anonymised. Loaded only after you opt in via the consent banner. - No advertising or third-party tracking.

You can withdraw your analytics consent at any time via the "Cookies" link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We honour the Global Privacy Control (GPC) browser signal as a request to opt out of any analytics that would otherwise require your consent.

The Platform is not directed at children under the age of 16, in line with Article 8 GDPR. We do not knowingly collect personal data from children under 16. We do not run age-gates, but we also do not market the Platform to minors and we do not feature children in our marketing imagery.

If we discover that we have inadvertently collected personal data from a child under 16, we will delete that data without undue delay. If you are a parent or guardian and you believe your child has provided us with personal data, contact dpa@gouna-realty.com and we will erase it.

We may update this privacy policy from time to time, for example to reflect changes in our sub-processors, our retention schedules, or applicable law. The current version is identified by the "last updated" date at the top of this page. Older versions are archived at /privacy/changelog with a short note explaining what changed and why.

When we make material changes — for example adding a new processing purpose, a new sub-processor in a non-adequate country, or a meaningful change to your rights — we will notify you in advance through one or more of the following channels: a banner on the Platform, an email to newsletter subscribers, or a notification at next sign-in for account holders.

Continued use of the Platform after a material change becomes effective constitutes acceptance of the updated policy. If you disagree with a material change, you can exercise your rights under section 8 or stop using the Platform.

For any privacy-related question, request, or complaint:

- Data protection contact (DPO): dpa@gouna-realty.com - General contact: info@gouna-realty.com - Security disclosures: security@gouna-realty.com - Postal address: Gouna Realty, El Gouna, Red Sea Governorate, Egypt

13.1 Supervisory authority — Netherlands (EU)

If you are an EU/EEA resident and you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in the Netherlands or in your own EU country of residence:

- Autoriteit Persoonsgegevens (Dutch DPA) - Postal: Postbus 93374, 2509 AJ Den Haag, Netherlands - Web: autoriteitpersoonsgegevens.nl

A list of all EU supervisory authorities is available at edpb.europa.eu.

13.2 Supervisory authority — Egypt

If you are a resident of Egypt, you have the right to lodge a complaint with:

- Personal Data Protection Center (PDPC) - Ministry of Communications and Information Technology - Smart Village, Building B121, 6th of October, Egypt

You always have the right to a judicial remedy under Article 79 GDPR. None of the steps in this policy displaces that right.