1. Who we are and scope
Bayex is a platform for building online stores and business websites, operated by Innovation Imprint (Basmat Ibtikar), Unified Commercial Registration No. 105300000302319, El Mahalla El Kubra, Gharbia, Arab Republic of Egypt. This policy explains how we collect, use and protect personal data.
It applies to bayex.net, bayexapp.com (the Bayex app marketplace), our dashboards and mobile apps, and every store and website hosted on the platform.
We process data in line with Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, and with the data protection laws of every country we operate in.
Bayex's role depends on the type of data:
| Type of data | Bayex's role | Responsible to the data subject |
|---|---|---|
| Merchant and team accounts | Controller | Bayex |
| Unified shopper account (name, mobile number, addresses) | Controller | Bayex |
| Visitors to bayex.net and Bayex app | Controller | Bayex |
| Store customers, their orders and merchant messages to them | Processor on the merchant's behalf | The merchant who owns the store |
When you buy from a store on Bayex, the merchant is responsible for how your order data is used. We recommend reviewing that store's own privacy policy.
2. Data we collect
We collect only the data needed to run the platform and deliver its services.
| Category | Data | Source |
|---|---|---|
| Merchants and their team | Name, email, mobile number, password (encrypted), Google account details when signing up with Google, store name, business type and country, user permissions | The merchant, at sign-up and during use |
| Merchant subscription | Plan, billing history, card type and last digits | The merchant and the payment gateway |
| Merchant WhatsApp connection | Meta business ID, WhatsApp account ID, phone number, display name, template status and number quality | Meta, when connecting through Embedded Signup |
| Contact lists uploaded by merchants | Phone numbers, contact names and the groups the merchant defines | The merchant |
| Shoppers | Name, mobile number, email (optional), delivery addresses, followed stores | The shopper |
| Shopper orders | Products, cart, abandoned carts, orders, returns, payment method and result | The shopper, the store and the payment gateway |
| Messages and support | Support conversations on WhatsApp or email, and opt-out requests | The sender |
| Technical data | IP address, device and browser type, language, approximate country, pages visited, sign-in and security logs | Automatically, during use |
Payment data: we never store full card numbers or CVV codes. Certified payment gateways process and store this data under PCI DSS standards.
Data we do not request: we do not request health, religious, ethnic or other sensitive data, and merchants may not collect it through the platform except as the law allows.
3. How we use data
We use data only for the following purposes, each with a legal basis:
| Purpose | Legal basis |
|---|---|
| Creating accounts, signing in and verifying identity with one-time passwords (OTP) | Performance of contract |
| Running stores, receiving orders, and connecting payments and shipping | Performance of contract |
| Unified shopper account: saving addresses for use in any store on Bayex | Performance of contract, at the shopper's request |
| Collecting plan subscriptions, auto-renewal, invoices and renewal reminders | Performance of contract and legal obligation |
| Technical support and answering enquiries | Performance of contract |
| Preventing fraud and abuse, including repeat use of the 1 EGP offer | Legitimate interest |
| Improving the platform and measuring performance with aggregated statistics | Legitimate interest |
| Marketing messages from Bayex | Prior consent |
| Complying with laws, tax rules and requests from competent authorities | Legal obligation |
We do not sell personal data to anyone, and we never use one merchant's customer data to market another store or Bayex itself.
We make no fully automated decisions with legal effects on you, except for fraud-prevention systems, and you may request human review of any such decision.
4. OTP, WhatsApp and marketing messages
One-time passwords (OTP):
- Merchants receive verification codes by email only.
- Shoppers receive codes on WhatsApp first. If the code does not arrive in time, it is sent by SMS through an external provider.
- We use your mobile number for verification codes only, and never for marketing without separate consent.
Marketing messages from Bayex:
- Sent only to people who have opted in, from a dedicated marketing number separate from our OTP and support number.
- You can stop them at any time by replying «إيقاف» or STOP, or with the opt-out button. Your request is recorded automatically and no further marketing messages are sent.
- Our support team may reply from the same number, and we link the conversation to the campaign you replied to in order to improve our service.
Merchant messages to their customers:
- When a merchant connects their WhatsApp number, they send messages (order confirmations, abandoned-cart reminders, campaigns) from their own number and Meta account.
- The merchant is responsible for obtaining customer consent before sending marketing messages, and for the accuracy of any contact list they upload.
- Bayex gives merchants opt-out tools and honours recorded opt-out requests.
- If you receive unwanted messages from a store, you can opt out from the message itself or contact us to report it.
5. Sharing data
We share data only with parties that need it to deliver the service, only to the extent necessary, and under agreements that oblige them to protect it.
| Party | What they receive | Why |
|---|---|---|
| Meta (WhatsApp Business Platform) | Recipient number, message content, and merchant connection details | Sending verification codes and messages on WhatsApp |
| SMS provider | Mobile number and verification code | Backup code for shoppers |
| Zoho ZeptoMail | Email address and the content of verification and billing emails | Sending service emails |
| Payment gateways | The transaction data required | Collecting subscriptions and store payments |
| Shipping carriers enabled by the merchant | Recipient name, number, address and shipment details | Delivering orders |
| The sign-in details you approve | Signing up and signing in with Google | |
| Hosting provider (Hostinger) | Data stored on the platform's servers | Hosting and running the platform |
| Apps a merchant installs from the app store (such as tracking pixels) | What the merchant allows the app to access | The service the merchant chose |
| Government and judicial authorities | Only what the law requires | Legal obligation |
Bayex app marketplace: products a merchant publishes, their store name and public page are shown to visitors in that merchant's country. No shopper personal data appears in the marketplace, and purchases from the marketplace are completed inside the merchant's store.
Change of ownership: if the company merges or is sold, data may transfer to the new entity, which must honour this policy. We will notify you in advance.
6. Cookies and international transfers
Cookies:
- Essential: for sign-in, saving your cart and language, and security. These cannot be disabled.
- Analytics: for measuring platform use in aggregate. Enabled only with your consent.
- Marketing: advertising pixels (such as Meta, Google, TikTok and Snapchat) that merchants add to their stores. Enabled only with your consent.
You can change your choices at any time from the cookie settings at the bottom of every page, or in your browser settings.
International transfers: some data may be processed on our service providers' servers outside your country, such as Meta, Zoho and Google. We transfer data only to countries with an adequate level of protection, or under contractual safeguards, and subject to the licences required by Egyptian law and the laws of other countries.
7. Retention and security
We keep data for as long as it is needed, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Merchant account and store | For the duration of the subscription. An inactive store is temporarily closed after 60 days, archived after 90 days and deleted after 180 days, with advance warnings from day 35 |
| Shopper account | Until the shopper asks for deletion |
| Invoices and financial records | As long as tax and accounting laws require |
| Verification codes | Minutes, until they expire; send logs kept for a limited period for security |
| Opt-out requests | As long as needed to make sure you are not contacted again |
| Technical and security logs | A limited period, for security and fraud prevention |
Data security:
- Encrypted connections between your device and the platform (HTTPS), and passwords hashed with irreversible algorithms.
- Each merchant's data is isolated from others, with defined access permissions for every team member.
- Two-factor authentication on administrative accounts, and monitoring of suspicious sign-in attempts.
- Regular backups.
If a personal data breach occurs, we notify the competent authority and affected individuals within the periods set by law.
8. Your rights and contact
Your rights: at any time, you may:
- Know what data we hold about you and obtain a copy.
- Correct or update your data.
- Request deletion of your data, unless the law requires us to keep it.
- Withdraw consent to marketing messages or non-essential cookies.
- Object to, or request restriction of, the processing of your data.
- File a complaint with Egypt's Personal Data Protection Center, or the competent authority in your country.
You can edit most of your data from your account settings. We respond to other requests within the period set by law, and may ask you to verify your identity first. If your data is held by a specific store, we will forward your request to the merchant who owns it.
How to request deletion of your data:
You can ask Bayex to delete your personal data at any time by following these steps:
- Email privacy@bayex.net with the subject "Data deletion request", from the email address or phone number registered to your account.
- Tell us your account type (merchant or shopper) and, if you are a merchant, your store name.
- We will verify your identity, delete your data within 30 days of your request, and send you a confirmation.
- Deletion covers your account data, your phone number, and the WhatsApp message and verification-code records we hold.
What we keep: Records we are legally required to retain, such as invoices and accounting records, kept only for the period the law requires.
Data held by stores: Your orders and messages with a specific store belong to that store's owner, so requests to delete them should be sent to the store directly. If you need help reaching the store, email us at privacy@bayex.net.
Children: the platform is not intended for anyone under 18, and we do not knowingly collect their data. If we learn of it, we delete it.
Changes to this policy: we may update this policy from time to time and show the last-updated date at the top. We will notify you by email or within the platform before any material change.
Contact us:
- Company: Innovation Imprint (Basmat Ibtikar), owner and operator of Bayex
- Address: El Mahalla El Kubra, Gharbia, Arab Republic of Egypt
- Email: privacy@bayex.net
- Phone: +20 105 544 0507
If the Arabic and English versions differ, the Arabic version prevails.