myMayz · THE MK LLC — mymayz.com
How we collect, use, protect and retain your personal data

Document ID MK-PRIV-001 · Version 1.0 · Effective date 23 September 2026 · Review cycle Annual · Owner Ahmed Kardous, Co-Founder & Director · Classification Public

1. Who we are

myMayz is a premium Egyptian lifestyle brand operated by THE MK LLC, a limited liability company registered in Dokki, Giza, Egypt (“myMayz”, “we”, “us”, “our”). We sell fashion, ceramics, kitchenware, tableware and gourmet food through our online store at mymayz.com, our retail store at Mall of Egypt, and our customer-service channels.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, store, share and protect it, how long we keep it, and the rights you have over it. It applies to our website, our retail operations, and every messaging or support channel we operate, including WhatsApp, Instagram, Facebook Messenger, TikTok direct messages, email and telephone.

We process personal data in accordance with the Egyptian Personal Data Protection Law No. 151 of 2020 and, where applicable to our customers abroad, with the principles of the EU General Data Protection Regulation (GDPR).

2. Data we collect

Category Examples Source
Identity & contact Name, email address, phone number, shipping and billing address Provided by you at checkout, registration, or in conversation
Order & transaction Items purchased, order value, delivery status, returns and refunds, payment method type and payment confirmation (we never store full card numbers — payments are processed by licensed payment providers) Generated when you shop with us
Customer-service messages The content of conversations you have with our support team over WhatsApp, Instagram, Facebook Messenger, TikTok direct messages, email or phone, together with your public profile name/handle on that platform Provided by you when you contact us, delivered through the official APIs of each platform
Technical & usage IP address, device and browser type, pages viewed, cookie identifiers Collected automatically when you browse mymayz.com
Marketing preferences Newsletter subscription status, campaign interactions Provided by you; collected from campaign tools

3. Why we collect it and our legal grounds

Purpose Legal ground
Fulfilling your orders: processing payment, delivery, returns and exchanges Performance of a contract
Customer support: answering your questions and resolving complaints on the channel you contacted us on Performance of a contract / legitimate interest
Order notifications: order confirmation and delivery updates (e.g. via WhatsApp) Performance of a contract
Marketing: newsletters and offers, only where you have opted in; you can unsubscribe at any time Consent
Fraud prevention, security and abuse monitoring Legitimate interest / legal obligation
Legal and tax compliance, including retention of invoices and transaction records Legal obligation
Service improvement: aggregated, de-identified analytics of sales and support performance Legitimate interest

We collect the minimum data necessary for each purpose, and we do not sell personal data to anyone.

4. Messaging channels (WhatsApp, Instagram, Facebook, TikTok, email, phone)

When you message us on a social or messaging platform, we receive your message and profile name through that platform’s official business API (for example the Meta Cloud API for WhatsApp, or the TikTok Business Messaging API for TikTok direct messages) and manage the conversation in our internal customer-service inbox so that our support team can reply to you.

  • We only access conversations you initiate with our business accounts, or that we are authorized to manage on behalf of the connected business account.
  • Messages are used solely to provide customer service, handle orders, returns and complaints, and are handled under this policy and each platform’s terms.
  • Parts of a conversation may receive an AI-assisted draft reply or automated routing; a human support agent supervises the service and you can always ask to speak with a person.
  • We do not use the content of your private messages for advertising, and we do not share it with third parties except the service providers listed in Section 5 who host and process it for us.

5. Who we share data with

We share personal data only with service providers who process it on our instructions under contractual safeguards, and only what each provider needs:

Provider category Examples What they process
E-commerce & ERP platforms Shopify (online store), Odoo (orders, inventory, invoicing) Identity, contact, order data
Cloud hosting & infrastructure Supabase, Railway, Vercel, Cloudflare Customer-service inbox data, order-related records, website delivery
Messaging platforms Meta Platforms (WhatsApp, Instagram, Messenger), TikTok, Google (email), Twilio (voice) Message delivery between you and our support team
AI-assistance provider Anthropic (Claude) Conversation excerpts, to draft support replies under our control
Payment providers PayTabs, Paymob, acquiring banks Payment processing; card data is handled by them, not stored by us
Delivery & logistics partners Courier companies serving your address Name, address, phone number, shipment details

We may also disclose data where required by Egyptian law, a court order, or a competent authority, and in connection with fraud prevention. Within our group, data may be shared with THE MK LLC’s affiliates under the same safeguards as this policy.

6. International transfers

Some of our service providers store data on secure cloud infrastructure located outside Egypt. Where data leaves Egypt, we transfer it only to providers offering appropriate technical and contractual protections (encryption in transit and at rest, data-processing agreements), consistent with Law No. 151 of 2020 and, where applicable, GDPR transfer requirements.

7. How long we keep data

Data Retention period Reason
Customer account & contact data Life of the account, then deleted or anonymized within 24 months of last activity Serving returning customers
Orders, invoices & transaction records 5 years from the end of the financial year Egyptian tax and accounting law
Customer-service conversations (all channels) 24 months from the last message in the conversation, then deleted Complaint handling and service quality
Platform-messaging data of a business account that disconnects our service Deleted within 30 days of de-authorization Platform requirements (e.g. TikTok, Meta)
Technical logs Up to 12 months Security monitoring
Marketing lists Until you unsubscribe or after 24 months of inactivity Consent-based marketing

Backups are retained on a rolling schedule and overwritten within 35 days. Our full schedule is set out in our internal Data Retention & Deletion Policy.

8. How we protect data

  • Encryption in transit (TLS 1.2 or above) on all our sites and APIs, and encryption at rest (AES-256) on our cloud databases.
  • Access on a need-to-know, least-privilege basis: support agents see only the conversations and orders they need to do their job; administrative access requires multi-factor authentication.
  • Access logging and periodic review of who can access which systems.
  • Vetted service providers bound by data-processing terms.
  • A documented incident-response procedure; if a breach is likely to affect your rights, we will notify you and the competent authorities as required by law.

9. Your rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you and receive a copy;
  • Correct inaccurate or incomplete data;
  • Delete your data (“right to be forgotten”), except records we must keep by law;
  • Object to or restrict certain processing, including direct marketing at any time;
  • Withdraw consent where processing is based on consent, without affecting prior processing;
  • Data portability — receive data you provided in a machine-readable format.

To exercise any right, contact us using the details in Section 12. We will verify your identity and respond within 30 days. If you are unsatisfied, you may lodge a complaint with the Egyptian Personal Data Protection Center or your local supervisory authority.

10. Cookies

mymayz.com uses cookies and similar technologies to keep your cart working, remember your preferences, measure site performance and — with your consent where required — support our advertising. You can control cookies through your browser settings; essential cookies are required for the store to function.

11. Children

Our products and services are directed at adults. We do not knowingly collect personal data from children under 18; if you believe a child has provided us data, contact us and we will delete it.

12. Contact us

Data controller: THE MK LLC, Dokki, Giza, Egypt.

Our Data Protection Lead oversees compliance with this policy and is reachable at the privacy address above.

13. Changes to this policy

We may update this policy from time to time. The latest version, with its effective date, will always be available at mymayz.com. Material changes will be announced on our website or through our channels.