Privacy Policy — PDPL Compliant

Privacy Policy — ICD

Effective date: April 21, 2026 · Last updated: April 21, 2026

ICD (“we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit icd3s.com or icloudist.com, submit a Request for Quote (RFQ), purchase products or services, or otherwise interact with us.

This policy is drafted to comply with Egyptian Personal Data Protection Law No. 151 of 2020 and aligns with international standards including the EU General Data Protection Regulation (GDPR) to protect customers in cross-border transactions.

1. Data Controller

2. Personal Data We Collect

We collect the following categories of personal data:

• Identification data — full name, company name, job title
• Contact data — email address, phone number, postal address, country
• Transaction data — products requested, quotation history, purchase orders, invoice records, payment method metadata (we do not store card numbers — see Section 9)
• Technical data — IP address, browser type and version, device type, operating system, referring URL, pages visited, timestamps, cookies (see our Cookie Policy)
• Communications data — email correspondence, WhatsApp messages, RFQ form submissions, support tickets
• Marketing preferences — newsletter subscription status, consent records

3. Lawful Bases for Processing

Under PDPL Law 151/2020 Article 3, we process personal data on the following lawful bases:

• Consent — for marketing emails, non-essential cookies, and optional form fields
• Performance of a contract — for quotation preparation, order fulfilment, delivery, after-sales support
• Legal obligation — tax invoicing per Egyptian Tax Law, customs declarations, commercial record retention
• Legitimate interests — fraud prevention, site security, service improvement, defending legal claims

4. How We Use Your Data

• Prepare and send quotations, invoices, shipping documents
• Process orders and deliver products via DHL Express, Aramex, FedEx, or pickup
• Provide customer support, warranty service, RMA processing
• Send transactional emails (order confirmations, shipping notices, payment receipts)
• Send marketing emails only where you have opted in (you may unsubscribe at any time)
• Comply with legal obligations including tax, customs, sanctions screening, anti-money laundering
• Prevent fraud, detect unauthorized access, protect our infrastructure
• Analyse traffic and improve our website (aggregated, anonymised where possible)

5. Data Sharing

We share personal data only with:

• Shipping carriers — DHL Express, Aramex, FedEx (delivery address only)
• Payment processors — card processors authorised by the Central Bank of Egypt (tokenised card data only, we never see raw card numbers)
• Customs brokers — for import/export declarations (HS codes, shipment value)
• Cloud infrastructure providers — hosting, email, CRM (under contract with confidentiality obligations)
• Professional advisors — auditors, lawyers, tax consultants, only where necessary
• Law enforcement and regulators — only when legally compelled

We do not sell personal data to third parties. We do not transfer data for advertising targeting.

6. Cross-Border Transfers

ICD operates from Egypt and ships to 100+ countries. Personal data may be transferred to carriers, cloud providers, and customers in other jurisdictions. Such transfers are subject to appropriate safeguards including contractual data-protection clauses, adequacy decisions where applicable, and PDPL Article 14 compliance.

7. Retention Periods

• Quotations and RFQ submissions — 3 years from issue date
• Orders, invoices, tax records — 5 years (Egyptian Tax Law minimum)
• Customer support communications — 3 years
• Marketing consent records — until withdrawn + 1 year audit trail
• Website analytics — 14 months (Google Analytics default)
• Server logs — 14 days rolling

8. Your Rights Under PDPL

You have the following rights under Law 151/2020:

• Right of access — request a copy of your data
• Right of rectification — correct inaccurate data
• Right of erasure — delete data no longer required
• Right of restriction — limit processing in specific circumstances
• Right to withdraw consent — without affecting prior lawful processing
• Right to data portability — receive data in structured, machine-readable format
• Right to object — to processing based on legitimate interests or direct marketing
• Right to lodge a complaint — with the Personal Data Protection Centre (PDPC), Egypt

To exercise any right, email [email protected]. We respond within 30 days.

9. Payment Card Security

We do not store raw payment card data on our servers. Card transactions are processed through PCI-DSS-certified acquirers authorised by the Central Bank of Egypt. Only transaction identifiers (tokens) are retained for refund and dispute processing. See our Security page for details.

10. Cookies and Tracking

We use strictly necessary cookies (login, cart, security) without consent. Analytics and marketing cookies require your consent. See our Cookie Policy for full list and opt-out controls.

11. Children

Our services target business customers. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided us data, contact us immediately and we will delete it.

12. Security

We apply commercially reasonable technical and organisational safeguards: SSL/TLS encryption site-wide, encrypted data at rest for sensitive fields, role-based access control, Wordfence web application firewall, Limit Login Attempts, regular security audits, and certified data destruction procedures (ICD Data Shield).

13. Data Breach Notification

In the event of a personal data breach likely to result in high risk to data subjects, we will notify the Personal Data Protection Centre within 72 hours as required by PDPL Article 35 and will notify affected individuals without undue delay.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via a banner on icd3s.com for at least 30 days. The “Last updated” date at the top reflects the current version.

15. Contact

For privacy enquiries, requests, or complaints:

• Email: [email protected]
• Post: Data Protection Officer, ICD, 22 Street 299, Maadi, Cairo, Egypt
• Phone: +202 27052005 (business hours, GMT+2)

You may also lodge a complaint directly with Egypt’s Personal Data Protection Centre (PDPC).