Privacy Policy

El Hawag sells natural oils, herbal products, cosmetics, spices and related goods through this website. In this policy, “we” means El Hawag, which decides how the personal data described here is used. You can reach us on our hotline 16703 or on WhatsApp through the links on this page and in the site footer.

This policy covers the website and what it offers: browsing, accounts, sign-in, cart, wishlist, reviews, checkout, payment, delivery and customer support. Services we link to, such as Facebook, Google, WhatsApp or Paymob's payment page, have their own privacy policies.

We collect what we need to run the store. Depending on how you use it, this includes:

• Account details: your name, email address, mobile number and preferred language. If you register with a password, we store it only as a salted one-way hash (Argon2id), never in readable form.
• Delivery addresses: recipient name, mobile number, governorate, area and district (or country, city, region and postal code outside Egypt), street, building, floor, apartment and a nearby landmark. The address you give when registering becomes your default address.
• Orders: products, sizes, quantities, prices, discounts or coupon codes, delivery fee and total; a copy of the contact and delivery details used for that order; any note you add; and the order's status history, including confirmations made with you by phone or WhatsApp.
• Payments: the payment method, amount, status and the payment provider's transaction reference. Card details are entered on Paymob's protected page; we never receive or store card numbers or security codes (CVV).
• Delivery: the courier's shipment and tracking numbers, delivery status and cash-on-delivery amounts.
• Your activity in the store: cart contents, wishlist items and product reviews (rating, title and text). Reviews are shown publicly with your first name and last initial only.
• Security and technical data: your IP address, browser and device type, sign-in times, active sessions, and security events such as sign-ins, password changes and refused sign-in attempts.
• Messages: what you tell us when you call our hotline or write to us on WhatsApp.

You can create an account or sign in with Google or Facebook instead of a password. We never receive your Google or Facebook password.

• Google Sign-In: we receive your Google account ID, your email address (which Google must have verified), your name and your profile picture link. The Google account ID is how we recognise you when you sign in again.
• Facebook Login: we request only two permissions, email and public_profile. Through them we receive your Facebook app-scoped user ID (an ID Facebook issues for our app only), your name, your email address and your profile picture link. We store the app-scoped user ID as the identity of your Facebook sign-in, and the access token Facebook issues in encrypted form. We do not post to Facebook or access your friends, messages or other Facebook data.
• If Facebook does not provide an email address, we cannot create an account from it. A Google or Facebook sign-in is never linked automatically to an existing store account with the same email address; linking a Google account requires that account's password. Staff accounts cannot sign in with Google or Facebook.
• You can remove El Hawag from the apps connected to your Facebook account in Facebook's settings (Settings & privacy › Settings › Apps and websites). This stops future access. To delete the data we already hold, follow our data deletion instructions.

We use personal data only for these purposes:

• To create and secure your account, sign you in and keep you signed in.
• To process your orders: check stock, calculate prices and delivery fees, take payment, prepare and deliver your parcel, and handle cancellations, returns and refunds.
• To contact you about your orders by phone, WhatsApp or email, including order confirmation, status updates, delivery questions and cash-on-delivery confirmation.
• To send account emails you ask for, such as a password reset link.
• To keep the store secure: limiting abuse and repeated failed sign-ins, preventing fraudulent orders and investigating security incidents.
• To meet legal, accounting and tax obligations and to handle complaints and disputes.
• To understand how the site is used and measure our advertising (see “Cookies, analytics and similar technologies”).

We share personal data with service providers that help us run the store, and only what each one needs for its task:

• Paymob (online payments): for card, wallet and instalment payments, your name, email address, mobile number, billing address, the order items and the amount, so that Paymob can process and secure the payment.
• Bosta (delivery within Egypt): the recipient's name, mobile number and delivery address, any delivery note and the cash-on-delivery amount. Your email address is not shared with the courier.
• Carriers for orders delivered outside Egypt: the delivery details needed for that shipment.
• Google: delivers our emails (order and account emails pass through Google's email service), provides Google Sign-In if you choose it, and provides Google Analytics and Google Ads measurement through Google Tag Manager.
• Meta: provides Facebook Login if you choose it, and WhatsApp carries our conversation when you message us or we confirm an order with you there.
• Cloudflare: stores the site's images and our encrypted database backups.
• Hostinger: hosts the server that runs the store and its database.

We may disclose information when the law or a competent authority requires it, or where necessary to protect our legal rights or the safety of our customers.

Some of the providers above process data on servers outside Egypt. We use them only for the purposes described in this policy.

The store uses a small number of its own cookies that it needs to work:

• Sign-in session: keeps you signed in for 7 days, or 30 days if you tick “Remember me”, extended while you use the site. It is sent only over secure connections and cannot be read by page scripts.
• Guest cart: a random identifier that keeps your cart for up to 30 days before you sign in.
• Sign-in protection: short-lived cookies that protect Google and Facebook sign-in against forgery and expire within minutes, and, for staff, the second sign-in step.
• Language: remembers the language you chose.

Store pages load Google Tag Manager, which runs Google Analytics 4 and Google Ads conversion measurement and remarketing. These Google services set their own cookies (such as _ga) and receive information about your visit, such as the pages you view, your device and browser, an approximate location derived from your IP address, and how you interact with the site. Staff administration pages do not load these tags.

You can block or delete cookies in your browser settings and manage ad personalisation in your Google account's ad settings. The store keeps working without analytics cookies.

We keep personal data only as long as we need it for the purposes above:

• Account and address data: while your account exists, until you ask us to delete it.
• Sign-in sessions: they end after 7 or 30 days without use (staff sessions after 12 hours), or immediately when you sign out.
• Orders, payments, deliveries and refunds: as long as accounting, tax and consumer-protection laws require, even after you delete your account. After deletion they are kept only for those purposes and are no longer available for normal account use.
• Security records and server logs: for a limited period, to protect the store and investigate incidents.
• Backups: the database is backed up weekly in encrypted form and only the three most recent backups are kept, so deleted data leaves our backups as they are replaced. Occasional extra backups taken before system updates are kept on our server with restricted access and deleted when no longer needed.

We protect personal data with technical and organisational measures, including:

• Encrypted connections (HTTPS) for the whole site.
• Passwords stored only as Argon2id hashes, and Google/Facebook tokens stored encrypted.
• Sign-in cookies that are secure and inaccessible to page scripts, with rate limits on sign-in and other sensitive actions.
• Staff access limited by role, with a second sign-in step by emailed code; the database is not reachable from the internet.
• Encrypted backups, and card details handled only by Paymob.

No online service can guarantee absolute security. If we learn of a breach affecting your personal data, we will act to contain it and notify you and the competent authorities where the law requires.

Subject to applicable law, including Egypt's Personal Data Protection Law (Law No. 151 of 2020), you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is inaccurate or incomplete;
• delete your account and personal data;
• stop using your data for a purpose you object to, where the law allows.

In your account you can update your saved addresses, change your password and sign out other devices yourself. For anything else, including changing your name, email address or mobile number, or getting a copy of your data, call 16703 or message us on WhatsApp. To delete your account and data, follow our data deletion instructions; you do not need to sign in to ask. We may verify your identity before acting on a request.

We update this policy when our practices change. The date at the top of this page shows the version in force.