Data Processing Agreement

This Data Processing Agreement describes how Perseids processes personal data when you use the Perseids store. Perseids acts as a data controller toward its customers, and engages the service providers described below (sub-processors) to operate the store. This agreement supplements our Privacy Policy and applies to all personal data processed through the website.

We process the categories of personal data described in our Privacy Policy: identity and contact details (name, email, phone), shipping information (address, city, governorate), order and payment information, and — where you have opted in — marketing and analytics data.

Personal data is processed for: fulfilling and delivering orders; processing payments; providing customer support; account management; fraud prevention and security; legal and tax compliance; and — with consent — marketing and analytics.

To operate the store, Perseids works with the following categories of sub-processors, which process data only to perform their service for us: - Payment providers (Paymob, InstaPay, Vodafone Cash) for payment processing. - Cloud hosting and database provider (Supabase) for website and data storage. - Email and messaging providers for transactional messages and support. - Marketing and analytics providers (e.g. Meta) for advertising measurement, where consent has been given.

Personal data is protected using appropriate technical and organizational measures, including encryption in transit (HTTPS), restricted access, hashed credentials, and secure payment processing through PCI-compliant providers. Access to personal data is limited to those who need it to perform their role.

As described in our Privacy Policy, individuals whose data we process have rights to access, correct, delete, and object to the processing of their data, and to withdraw consent where processing relies on it. Requests can be sent to perseids.eg@gmail.com.

Some sub-processors may store or process data outside Egypt (for example on cloud infrastructure in the EU or US). We require our providers to apply appropriate safeguards for international transfers, in line with applicable law.

Personal data is retained only as long as necessary for the purposes described in this agreement and in our Privacy Policy, including legal and tax retention obligations. When no longer needed, data is securely deleted or anonymized.

Questions about this Data Processing Agreement, our Privacy Policy, or the processing of your data can be sent to perseids.eg@gmail.com. We will respond as required by law.