Privacy policy

This Privacy Policy explains how we collect, use, keep and protect personal data, with whom we share it, and the rights of the people it concerns, in accordance with the Personal Data Protection Law promulgated by Law No. 151 of 2020 and its Executive Regulations. It is issued in the name of Kenooz and the shops operating under that brand, referred to in it as "we". It applies to the website kenooz.co, the customers' app, the staff app "Kenooz Control" and the shops' web dashboard, the drivers' app "Yalla Box", and the data recorded in Kenooz shops.

Last updated: 16 October 2026

Please read this policy carefully. By using any of our services you acknowledge that you have read it. Any processing whose lawfulness depends on your consent is carried out only after that consent has been obtained in the manner the law requires.

011. Who we are and the scope of this policy

Jewellery shops operate in the Arab Republic of Egypt under the Kenooz trademark. They are independent businesses, each with its own books and accounts, joined by one electronic system operated by Kenooz, which in this policy means the entity that owns the brand and operates the online store and the apps.

The website kenooz.co and the customers' app are the brand's shared online store. They show, in one catalogue, the pieces held by its shops. Each piece is sold by the shop that holds it, and that shop issues the invoice in its own name.

The role of each party in processing data

• Kenooz, as operator of the online store, the apps and the shared system: the controller of the data of customers' accounts, online orders, chat, notifications, and operation and security logs.
• The Selling Shop: the controller of the data of the sales, purchases and invoices it issues in its own name, whether made in the shop or through the online store.
• The employer (the shop or entity employing the staff member or driver): the controller of the employment data, which Kenooz processes on its behalf as operator of the system.

Where Kenooz processes data on the system on behalf of the shops or employers, it acts as a processor and follows their instructions. Each party complies with the law within its role. The legal details of the Selling Shop are printed on each invoice, and the details of any of the parties above are available on request through the contact means in section 19.

What this policy does not cover

This policy does not apply to websites and services run by third parties, even when you reach them through our services, such as the payment page of the payment gateway, the Google and Apple sign-in pages, and WhatsApp. Each is governed by its provider's own privacy policy.

022. Definitions

Wherever used in this policy, the following words and expressions have the meanings set against them unless the context requires otherwise. Terms not defined here have the meanings given in the Law:

• Kenooz: the entity that owns the trademark and operates the online store, the apps and the shared system.
• Shop and Selling Shop: a Shop is any shop operating under the Kenooz brand; the Selling Shop is the shop that holds the piece sold and issues its invoice in its own name.
• Services: the website kenooz.co, the customers' app, the "Kenooz Control" app and the related shops' web dashboard, the "Yalla Box" app, and dealings in the shops.
• Personal data: any data relating to an identified natural person, or one who can be identified directly or indirectly by linking it with any other data.
• Processing: any electronic or technical operation to collect, record, keep, store, merge, display, send, receive, circulate, publish, erase, change, modify, retrieve or analyse personal data, in whole or in part.
• Data subject ("you"): the natural person to whom personal data relates, whether a customer, visitor, staff member or driver.
• Controller and processor: as defined in the Law; the controller determines the purposes and means of processing, and the processor processes data on the controller's behalf and under its instructions.
• The Centre: the Personal Data Protection Centre established under the Law.
• The Law: the Personal Data Protection Law promulgated by Law No. 151 of 2020 and its Executive Regulations.

033. The data we process

We limit ourselves to the data needed for the purpose for which it was collected. It varies with your relationship with us, as follows.

a. Online store customers

• Identity and contact data: name, mobile number, e-mail address, and a profile photo if you choose to add one.
• Sign-in data: your password, stored hashed with a one-way function that cannot be reversed, so that no one, including us, can read it; the verification codes sent to you; and, when you sign in with Google or Apple, the identifier the provider sends and your name and e-mail address to the extent the provider shares them with us.
• Addresses: delivery addresses, and a map point for each address if you choose to set one.
• Orders: the pieces ordered and their prices, discounts and coupons, shipping fees, the Selling Shop of each part of the order, the order's stages, cancellation and return requests and their reasons, and the invoices issued.
• Payment data: the payment method, its status, the transaction reference and the amount. We neither see nor store the full card number, as card details are entered directly with the payment gateway.
• Delivery data: the time and outcome of delivery, confirmation that the handover code was given, a proof-of-delivery photo if the driver takes one, and the amount collected on delivery, if any.
• Other account data: favourites, the shopping bag, loyalty points, coupons, and the virtual balance of the Bag Game with the moves you make in it.
• Chat: the text messages and photos you exchange with staff through the chat, the name of the staff member you chose to chat with, and your rating of the chat, if any.
• Notifications: the log of notifications and messages sent to you, your choices of channels, and your device's notification token.
• Device and technical data: the devices you signed in from, your IP address, browser or device type, sign-in times, and the system logs needed for operation and security.

b. In-shop customers

When you deal with one of our shops, we may record your name and mobile number, sale and purchase invoices, data on old gold we buy from you such as its weight, karat and price, and deposits and holds with their related balances. We may ask to see an identity document and record its details or keep a copy of it where the law requires, including the Anti-Money Laundering Law promulgated by Law No. 80 of 2002 and the customer identification duties it places on dealers in precious metals and precious stones, in particular when buying old gold. This data is kept in the same system that runs the online store, and your invoices and balances may appear in your online store account.

c. Visitors to the website and the app

If you browse the store without signing in, we process only the cookies needed to run it (section 9), the contents of the shopping bag linked to your device, and the usual technical logs such as your IP address, browser type and the time of the request.

d. Shop staff (users of the "Kenooz Control" app and the dashboard)

The "Kenooz Control" app and the shops' web dashboard are for shop staff and owners only. Their accounts are created by the employer; there is no self sign-up. For their users, the system processes:

• name, mobile number, e-mail address, photo, job title, role and permissions, and the branches they work in;
• the devices used to sign in, including the device model and an identifier;
• attendance data: check-in and check-out times, the location at the moment of each, and the result of matching it against the branch's geographic fence; and, where applicable, automatic attendance data and location points during the shift (section 6);
• HR requests such as leave, overtime and salary advances, payslips, and announcements addressed to staff;
• the work done on the system, such as sales and documents, recorded in an audit log for security and accountability;
• the device's notification token, photos of pieces taken with the camera, and the data of Bluetooth barcode scanners to the extent needed to operate them.

e. Drivers (users of the "Yalla Box" app)

• name, mobile number, and account and device data;
• geographic location while carrying out deliveries;
• proof-of-delivery photos and the outcomes of delivery attempts;
• amounts collected from customers on delivery (custody) and what is handed over from them.

f. Sensitive data

The Law treats financial data and children's data as sensitive personal data. We process financial data, such as payments, balances, salaries and advances, to the extent needed to perform contracts and meet legal obligations, with the measures the Law requires, and we obtain explicit consent where the Law requires it. We do not ask for data revealing religious beliefs, political opinions or health. If a request made by a staff member, such as sick leave, contains health information, it is processed only to the extent needed to decide the request, and access to it is limited to those responsible for that decision.

044. Sources of data

• Directly from you: when you create your account, place an order, add an address, message us through the chat, or deal with one of the shops.
• Automatically from your device: technical data and the cookies needed for operation, and geographic location where you allow it in the cases set out in section 6.
• From shop staff: what they enter on the system while serving you in the shop or handling your order.
• From the employer: the data of staff and drivers entered when creating their accounts and managing the employment relationship.
• From drivers: the delivery outcome, the proof-of-delivery photo and the amount collected.
• From third parties: the sign-in provider (Google or Apple) when you use it, the payment gateway as to the payment status and reference, and the messaging providers as to the delivery status of messages.

055. Purposes of processing and their legal bases

We process personal data only for legitimate, specified and declared purposes, to the extent needed to achieve them, and we do not further process it in a way incompatible with those purposes. Each processing rests on one or more of the bases the Law allows:

1. Performance of a contract: the processing is needed to perform a contract to which you are a party, or to take steps at your request before entering into it.
2. Legal obligation: it is needed to meet an obligation imposed by law, or to carry out a court order or a request from a legally competent authority.
3. Legitimate rights: it is needed to enable us or other concerned parties to exercise legitimate rights, unless this conflicts with your fundamental rights and freedoms.
4. Consent: you have consented to it for a specific purpose. You may withdraw your consent at any time, without affecting the lawfulness of what was done before the withdrawal.

The purposes and their bases are as follows:

• Creating and managing the account, verifying the mobile number or e-mail address, and enabling sign-in with Google or Apple. Basis: performance of a contract.
• Carrying out online orders: pricing them and holding their price, presenting them to the Selling Shop for acceptance, issuing invoices, collecting payment, delivery or collection from the branch, cancellation, returns and refunds. Basis: performance of a contract.
• Sales and purchases in the shops, buying old gold, and deposits and holds. Basis: performance of a contract and legal obligation.
• Keeping books, invoices and accounting records, in accordance with the Unified Tax Procedures Law promulgated by Law No. 206 of 2020 and other commercial and tax laws. Basis: legal obligation.
• Identity checks where the law requires them, including the Anti-Money Laundering Law promulgated by Law No. 80 of 2002. Basis: legal obligation.
• Customer service and the chat, and answering enquiries and complaints. Basis: performance of a contract and legitimate rights.
• Service notifications such as verification codes, order status, the handover code and security alerts. Basis: performance of a contract.
• Marketing messages and offers. Basis: consent (section 8).
• The loyalty points programme, coupons and the Bag Game, under the terms of each. Basis: performance of a contract.
• Security, prevention of fraud and misuse, the audit log of staff work, and establishing and defending rights. Basis: legitimate rights and legal obligation.
• Managing the employment relationship: accounts and permissions, attendance, HR requests, payroll and announcements. Basis: performance of the employment contract and legal obligation. Automatic attendance in the background works only if you turn it on. Basis: consent.
• Managing deliveries: following shipments, proving delivery and settling custody. Basis: performance of a contract and legitimate rights.
• Improving the services and preparing internal statistical reports on sales and orders, using aggregated data that does not identify individuals as far as possible. Basis: legitimate rights.
• Complying with requests from competent judicial and regulatory authorities. Basis: legal obligation.

If you decline to provide data needed to perform a contract or meet a legal obligation, we may be unable to provide the service requested or complete the transaction.

066. Location data

a. Customers

We do not track customers' location. We keep only the map point you choose yourself when adding an address, and use it to make it easier to reach your address on delivery. The website or the app may let you set this point from your device's current location, and only with your permission. Maps are shown through OpenStreetMap, so when a map is displayed its servers receive your device's IP address and the map area shown.

b. Shop staff

• Check-in and check-out: when you check in or out from the app, your location at that moment is recorded and matched against the branch's geographic fence, to confirm that the record was made at the workplace.
• Automatic attendance in the background, which is optional: this feature is off by default. It works only if you turn it on yourself and give the app permission to use location in the background in your phone's settings. Once on, the phone's system notices when you enter or leave the branch's fence, even when the app is closed, and this is recorded as a check-in or check-out. You may turn it off at any time from the app or by withdrawing the permission in the phone's settings, and manual check-in remains available to you.
• Location points during the shift: during the shift the app may send points of your location at intervals, to confirm presence at the workplace during working hours.
• Who sees it: the employer's authorised managers, according to their permissions. This may include showing the attendance status and the locations of staff on shift on the attendance board and its map during the working day.
• Limits of use: staff location data is used only for attendance and the related calculation of working hours under the employer's policies. It is not sold and is not used for advertising or marketing.

c. Drivers

A driver's location is processed while carrying out deliveries, to follow shipments, organise distribution, prove delivery, and keep shipments and custody safe. The customer who placed the order may be shown the status and progress of the shipment during delivery. This data is not sold and is not used for advertising.

077. Camera, photos and devices

• Device permissions: our apps reach the camera, location, Bluetooth or notifications only after your permission through the device's operating system. You may withdraw any permission at any time in the device's settings, in which case the related feature may stop working.
• The camera in "Kenooz Control": used only to read barcodes and photograph pieces, and active only when a staff member uses one of these two features. Photos of pieces should not include people.
• Bluetooth barcode scanners: used only to enter piece codes.
• Proof-of-delivery photos: the driver may take a photo proving the delivery, which may show the parcel, the place of delivery or the person who received it. It is used only to prove the delivery and to resolve any dispute about it.
• Photos you send: such as your profile photo or photos you send in the chat. They are kept in your account and seen only by those serving you.
• Device identifiers: we record the devices used to sign in to protect accounts and to let the account holder or the employer end the session of any device. Customers can see in their account the devices they signed in from and end the session of any of them.

088. Notifications and marketing messages

a. Service messages

We send you messages needed to provide the service, such as verification codes, order confirmation and stages, the handover code, requests to approve a re-pricing, and security alerts. They are sent by push notification, SMS, WhatsApp or e-mail, depending on what is available and the channels you choose. These messages are not marketing, and it may not be possible to stop them entirely while you have an account or an open order, as they are part of providing the service.

b. Marketing messages

We send you electronic offers or marketing messages only with your consent, and in them we follow what the Law requires: identifying the sender, disclosing the marketing purpose of the message, and providing an easy way to withdraw consent. You may stop these messages at any time:

• from the notifications page in your account on the website or the app, by changing your choices for each channel;
• or by turning off notifications in your device's settings;
• or by writing to us at https://kenooz.co/contact or on WhatsApp at https://kenooz.co/contact.

Stopping marketing messages does not affect service messages.

c. Messaging providers

Push notifications are sent through Google's Firebase Cloud Messaging and Apple's Push Notification service; SMS and WhatsApp messages through Twilio and Meta's WhatsApp Business; and e-mail through Zepto Mail. We give them only what is needed to deliver the message, such as the phone number, e-mail address or device token and the text of the message. The same applies to staff and drivers' notifications.

099. Cookies and similar technologies

Cookies are small files your browser keeps on your device. At present we use only the cookies needed to run the website:

• Session cookie: keeps you signed in while browsing and keeps the state of pages.
• Security token: protects forms against forged requests.
• Shopping bag token: links the shopping bag to your device, even when you are not signed in.
• Language: remembers the language you chose.

We do not currently use advertising cookies, or tracking cookies for analytics or advertising. If we add analytics or advertising tools in the future, we will update this policy before using them and ask for your consent where the law requires it. The mobile apps keep a sign-in token on your device to keep you signed in; it becomes invalid when you sign out or when you end that device's session from your account. You can set your browser to block or delete cookies, but blocking the necessary ones may prevent signing in, keeping the shopping bag or completing an order.

1010. Sharing and disclosure of data

We do not sell or rent your personal data, and we do not make it available to third parties for their own advertising or marketing. We disclose it only to the following, and only to the extent each needs.

a. Kenooz shops, the delivery service and the employer

• The Selling Shop: receives the order data needed to accept, prepare, invoice and deliver it, such as your name, mobile number, address and the pieces ordered.
• Other Kenooz shops: since a customer's account is one across the brand, authorised staff in its shops may see your basic data, and what is needed of your dealings, to serve you in any of them, to carry out an order that includes pieces from more than one shop, or to apply the loyalty points programme.
• The "Yalla Box" delivery service and its drivers: receive the recipient's name, mobile number, address and map point if any, the shipment details, and the amount to be collected on delivery, if any.
• The employer: the employer and its authorised managers see the data of their staff and drivers according to their permissions.

b. Service providers

We use the following service providers, and give each only what is needed to perform its service:

• hosting and data storage providers;
• the licensed payment gateway, currently Fawaterk;
• SMS and WhatsApp providers: Twilio and Meta's WhatsApp Business;
• the transactional e-mail provider: Zepto Mail;
• push notification providers: Google Firebase Cloud Messaging and Apple Push Notification service;
• sign-in providers, Google and Apple, when you choose to use them;
• the map service OpenStreetMap.

Those who process data on our behalf must act on our instructions, keep it confidential and apply appropriate protection measures, and may not use it for their own purposes. Some of them act as independent controllers for their own services, such as the sign-in providers, the payment gateway and the map service, and their processing is governed by their own policies. The gold-price feed we use receives no personal data.

c. Competent authorities and others

• Competent authorities: such as the judicial authorities and the Public Prosecution, the Egyptian Tax Authority, the Money Laundering and Terrorist Financing Combating Unit, the Centre, the Consumer Protection Agency and law enforcement, where the law requires us to or under a court order.
• Professional advisers: such as lawyers and auditors, to the extent needed for their work, bound by professional confidentiality.
• Transfer of business: if ownership of a shop or a business, or the brand, is transferred or merged into another, the related data may pass to the successor, which must comply with this policy and the Law.

1111. Transfers outside the Arab Republic of Egypt

Some of the providers above are located outside the Arab Republic of Egypt or process data on servers outside it, including the messaging, e-mail, push notification, sign-in and map providers, and possibly hosting providers. We do not transfer personal data abroad, or make it accessible from abroad, except under the controls and conditions set by the Law. These include that the receiving country offers a level of protection not lower than that set by the Law, and obtaining the licence or permit of the Centre where the Law requires it, or that one of the cases in which the Law allows the transfer by way of exception applies. We transfer only the data needed to perform the service concerned.

1212. Data security

We take technical and organisational measures appropriate to the nature of the data and the risks of processing it, including:

• encrypting data in transit using HTTPS;
• storing passwords hashed with a one-way function that cannot be reversed;
• temporarily locking sign-in after repeated failed attempts, and limiting how often verification codes can be requested;
• limiting access to data to authorised people under defined roles and permissions;
• recording staff work on the system in an audit log, and requiring the shop owner's PIN for sensitive operations;
• neither seeing nor storing full card numbers, which are processed by the licensed payment gateway;
• letting account holders end the sessions of their devices.

However, no method of electronic transmission or storage is absolutely secure. You are responsible for keeping your password, verification codes and handover code confidential, and for telling us at once of any unauthorised use of your account.

Breach notification

If a personal data breach occurs, we take the steps needed to contain it and limit its effects, and we notify the Centre and the affected data subjects within the time limits and in the manner set by the Law.

1313. Data retention

We do not keep personal data longer than needed for the purpose for which it was collected or than the law requires, as follows:

• Account data: for as long as the account is active. If the account is deleted, we delete its data or make it non-identifying, except what must be kept as set out below.
• Invoices and accounting and tax records: for the periods required by tax and commercial laws, including the Unified Tax Procedures Law promulgated by Law No. 206 of 2020, even after the account is deleted.
• Identity check records: for the periods required by the Anti-Money Laundering Law and its Executive Regulations.
• Staff attendance and location data: for the duration of the employment relationship, then for the period required by the relevant laws or needed to resolve related claims.
• Delivery data, proof-of-delivery photos and custody records: for the period needed to prove delivery, settle custody and resolve any related claims.
• Chats and notification and message logs: for a limited period during which they may need to be consulted to serve you or to prove what took place.
• Security and audit logs: for the period needed for security, accountability and establishing rights.

Certain data may need to be kept longer for a pending dispute or an investigation, or at the request of a competent authority. Copies of deleted data may remain in backups for a limited period until they are replaced in the backup cycle.

1414. Your rights and how to exercise them

The Law grants you the following rights:

1. to know of the personal data about you held by any holder, controller or processor, and to view, access and obtain it;
2. to withdraw your prior consent to the keeping or processing of your personal data;
3. to have your data corrected, amended, erased, added to or updated;
4. to have processing limited to a specific scope;
5. to know of any breach of your personal data;
6. to object to the processing of your data or its results where it conflicts with your fundamental rights and freedoms.

How to exercise your rights

• You can change your name, photo, addresses, mobile number, e-mail address, password and notification choices directly in your account. Changing the mobile number or e-mail address requires a code sent to it.
• For other requests, write to us at https://kenooz.co/contact or on WhatsApp at https://kenooz.co/contact, stating the right you wish to exercise.
• We verify your identity before acting on a request, to protect your data, and may ask for reasonable proof for this, such as a code sent to the mobile number or e-mail address registered in your account.
• We answer your request within the period set by the Law. If we refuse it in whole or in part, we tell you why.
• Requests are handled free of charge, except where the Law allows a fee, which we will tell you of in advance.
• We may be unable to erase data, or limit its processing, where the law requires us to keep it, such as invoices and accounting records, or where it must be kept to establish or defend a right.
• Staff and drivers exercise their rights over work data through their employer, and may also write to us at the same address.

Complaints

If you believe your data has been processed in breach of the Law, you may first contact us so that we can address the matter. In all cases, you may file a complaint with the Personal Data Protection Centre under the procedures set by law.

1515. Deleting your account

• From your account: you can delete your account at any time from the profile page on the website or from the app.
• By request: you can also ask for deletion by writing to us at https://kenooz.co/contact; we act on it after verifying your identity.
• Effect of deletion: deletion signs you out of all devices, and may mean losing the loyalty points, coupons, Bag Game balance and favourites in the account, and no longer being able to reach your order and chat history through it.
• What deletion does not cover: after deletion we keep what the law requires us to keep, such as invoices, accounting records and identity check records, and what is needed to complete an open order, a return or a refund or to resolve a dispute, and only for the periods set out in section 13.
• Deletion may not be possible at once while you have an order in progress or unsettled amounts; it is then completed once they end.
• Staff and drivers: their accounts are deleted or disabled through their employer, and work records are kept for the periods set out in section 13.

1616. Children and persons lacking capacity

The online store is intended for adults with full legal capacity. Under the Egyptian Civil Code, majority is twenty-one full Gregorian years. Our services are not directed at children. The Law treats children's data as sensitive personal data, and we do not knowingly collect it. If we learn that a child's data has been given to us without the guardian's consent, we will delete it unless the law requires us to keep it. A person lacking full capacity may buy only through their guardian or custodian.

1717. Changes to this policy

We may change this policy to reflect changes in our services or in the law, and we will publish the amended version on this page with an updated "Last updated" date. If a change is material, we will notify you before it takes effect by a suitable means, such as a notice in your account or a message to your e-mail address or phone. We will not use your data for a new purpose that requires your consent without first obtaining it.

1818. Governing language

This policy is written in Arabic, and its English translation is provided for convenience. In case of any difference between the two texts, the Arabic text prevails.

1919. Contact us

For any enquiry, request or complaint about this policy or your personal data, including requests addressed to our data protection officer, you can contact us through:

• E-mail: https://kenooz.co/contact
• WhatsApp: https://kenooz.co/contact
• The contact page: kenooz.co/contact

The legal details of the Selling Shop are printed on each invoice, and the details of Kenooz as operator of the store are available on request.