1. Who is responsible for your data
Nilex Digital Systems ("Nilex", "we"), a software company based in Cairo, Arab Republic of Egypt, is responsible (the "controller") for the personal data collected through nilexdigitalsystems.com, the website assistant, the contact form and the client and staff portals.
We process personal data in accordance with the Personal Data Protection Law No. 151 of 2020 and its executive regulations. For any privacy question or request, write to info@nilexdigitalsystems.com with the subject "Personal data".
When we build or host a system for a client, the client decides what data its own system holds, and we process that data only on the client's behalf and instructions (see our Terms of Service).
2. What we collect
| Where | What we collect |
|---|---|
| Contact form | Your name, email, phone number (optional), company (optional), the service you are interested in and your message. For security we also record the IP address and browser type of the request. |
| Website assistant (chat) | The messages you write and the page you started from. Your IP address is not stored in readable form: it is turned into a one-way code used only to stop abuse. If you choose to leave your details, we also collect your name, phone number (and whether it is on WhatsApp), and optionally your email, company and what you need. |
| Client and staff portals | Account details (name, email, phone, photo), your password (stored only as a secure one-way hash, never readable), and a record of sign-ins and actions (date and time, IP address, device and browser) to protect the accounts. |
| Projects and payments | Project details, agreements, messages, and payment records (amounts, dates, method and reference). We do not collect or store card numbers. |
| Business contacts | Contact details of businesses that ask us about our services or are introduced to us, kept in our customer management system. |
| Technical data | Like every website, our servers record technical data of each request (IP address, date and time, page requested, browser) to run and protect the service. |
We do not ask for sensitive personal data (such as health, religious, biometric or financial account data). Please do not send it to us through the website assistant or the forms. The website assistant automatically removes card numbers, national ID numbers, bank account numbers and passwords from messages before they are processed.
3. Why we use your data and on what basis
| Purpose | Legal basis |
|---|---|
| Answering your questions and requests, and contacting you about them | Your consent, and steps you ask us to take before a contract |
| Preparing quotations, carrying out projects, delivering and supporting them | Performing the contract with you |
| Issuing invoices and receipts and keeping financial records | Obligations imposed on us by law, including tax law |
| Protecting accounts, preventing fraud and attacks, and investigating misuse | Our legitimate interest in keeping the services secure, and legal obligations |
| Improving our website and the answers of the website assistant | Our legitimate interest, using the minimum data needed |
We do not send marketing messages or newsletters unless you have given your explicit consent, and you can withdraw that consent at any time. We do not make decisions about you based only on automated processing.
4. The website assistant (artificial intelligence)
- The assistant is an artificial-intelligence program. It answers from information published on our website and can make mistakes. It is not a person, and it does not have access to client accounts or private data.
- To answer you, the text of your messages (after removing private numbers as explained above) is sent to our AI provider, OpenAI. We have configured the service so that OpenAI does not store the answers for later retrieval. Your name and phone number from the contact details form are not sent to the AI provider.
- Conversations are deleted automatically after 90 days. You can delete your conversation yourself at any time from the assistant's menu.
- Our team may read conversations to follow up requests, handle reported answers and improve the service.
5. Cookies and browser storage
We use only the cookies needed for the website to work. We do not use advertising or tracking cookies, and we do not use analytics services that follow you across websites.
| Name | Purpose | Duration |
|---|---|---|
| nx_rt | Keeps you signed in to the client or staff portal. It cannot be read by scripts and is sent only to our sign-in service. | Up to 30 days, or until you sign out |
| nx_chat | Links your browser to your conversation with the website assistant. It cannot be read by scripts and is sent only to the assistant service. | 7 days |
| Browser storage | Remembers display preferences inside the portals and helps the website reload correctly after an update. | Until you clear it |
Our pages load fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address. You can block cookies in your browser settings, but signing in to the portals will then not work.
6. Who we share data with
We never sell personal data. We share it only when needed, with:
- service providers that work for us under confidentiality obligations: our hosting and server providers, our email-sending provider, and our AI provider (OpenAI) for the website assistant;
- the members of our team who need it for their work, with access limited by role and recorded;
- courts, the Public Prosecution or other competent authorities, when the law or a judicial order requires it;
- professional advisers (such as lawyers and auditors) bound by confidentiality, when needed to protect our rights.
7. Transfers outside Egypt
Some of our providers (such as OpenAI and Google) process data outside the Arab Republic of Egypt. Such transfers are made only to the extent permitted by Law No. 151 of 2020 and its executive regulations, to providers that offer an adequate level of protection, and only with the minimum data needed for the service.
8. How long we keep data
| Data | How long |
|---|---|
| Website assistant conversations | 90 days, then deleted automatically |
| Contact requests and business contacts | As long as needed to follow up your request and our business relationship; you can ask us to delete them at any time |
| Portal accounts | While the account is active, then deleted or anonymised, except what the law requires us to keep |
| Sign-in and activity records | As long as needed to protect the accounts and meet legal obligations; they cannot be edited |
| Invoices, receipts and financial records | For the period required by Egyptian tax and commercial law |
| Sign-in sessions | Deleted automatically after they expire |
9. How we protect data
- All connections to the website are encrypted (HTTPS).
- Passwords are stored only as secure one-way hashes. Sessions use short-lived access tokens and sign-in cookies that scripts cannot read, and a stolen session is ended automatically.
- Access to data is limited by role, and every important action is recorded in an activity log that cannot be edited or deleted.
- Repeated failed sign-ins lock the account temporarily, and requests are rate-limited against attacks.
- If a personal data breach happens, we notify the Personal Data Protection Center within 72 hours of discovering it, and inform the people affected where the law requires.
No system connected to the internet can be guaranteed 100% secure, but we apply these measures continuously and review them regularly.
10. Your rights
Under Law No. 151 of 2020 you have the right to:
- know what personal data we hold about you and get a copy of it;
- withdraw your consent at any time (this does not affect what was done before);
- correct, update or complete your data;
- ask us to delete your data, or to limit how we use it, when it is no longer needed or the law allows it;
- object to the processing of your data where it conflicts with your fundamental rights;
- be informed of a breach affecting your data.
To use these rights, write to info@nilexdigitalsystems.com. We may ask you to confirm your identity before answering, and we reply within the periods set by the law and its executive regulations. If you are not satisfied with our answer, you may file a complaint with the Personal Data Protection Center.
11. Children
Our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services or the law change. The new version is published on this page with its date, and important changes are also announced on the website or by email to account holders.
This policy is published in Arabic and English. If the two versions differ, the Arabic version prevails.
13. Contact us
For any question or request about your personal data:
- Phone / WhatsApp
- +20 102 466 1159
- Address
- Cairo, Arab Republic of Egypt
- Contact form
- nilexdigitalsystems.com/contact