Personal Data Protection and Privacy Policy

Gramz for Precious Metals LLC, referred to in this Policy as “Gramz”, is committed to respecting the privacy of users of its electronic application, protecting their personal data, and handling such data in accordance with applicable legal and regulatory requirements and in a manner consistent with the nature of Gramz's services in the precious metals sector.

This Policy explains how personal data is collected, processed, used, stored, protected, and disclosed; the parties with whom it may be shared; the periods for which Gramz may retain it; and the rights that data subjects may exercise under the law.

This Policy applies to personal data collected or processed by Gramz when users visit its website, use the application, create an account, or use services for purchasing or selling precious metals, delivery and collection, and other services actually available through the application's features.

This Policy must be read and interpreted together with the Gramz Application Terms and Conditions and the related policies and declarations, without prejudice to any rights granted to data subjects under applicable law.

For the purposes of this Policy, the following terms have the meanings set out below unless the context requires otherwise:

Gramz:

Gramz for Precious Metals LLC, in its capacity as the entity determining the purposes and means of processing personal data, depending on the nature of each processing activity.

Application:

The electronic application owned, managed, or operated by Gramz for the provision of its services.

User or Customer:

Any natural person who uses the Application, creates an account on it, or requests any service provided through it.

Personal Data:

Any information relating to an identified or identifiable natural person, directly or indirectly, as defined under applicable legislation.

Data Subject:

The natural person to whom the Personal Data being processed relates.

Data Processing:

Any operation performed on Personal Data, electronically or otherwise, including collection, recording, organization, storage, modification, use, retrieval, disclosure, transfer, and erasure.

Data Controller:

The person or entity that determines the purposes and means of processing Personal Data under applicable legislation.

Data Processor:

A person or entity that processes Personal Data on behalf of a Data Controller, in accordance with its instructions and within the limits of the contract concluded with it.

Sensitive Data:

Personal Data classified as sensitive by law, including data requiring special protection, consent, or safeguards under applicable legislation.

Third Parties:

Persons or entities independent of Gramz that may receive or process data, including technology service providers, custodians, shipping companies, banks, and payment and identity-verification service providers.

Applicable Legislation:

The laws, regulations, and regulatory decisions in force in the Arab Republic of Egypt, particularly Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, and other relevant legislation. The principles of the European Union General Data Protection Regulation (GDPR) may be used for guidance on matters not regulated by Egyptian law, to the extent permitted by applicable law and without conflict therewith.

This Policy applies to Personal Data processed by Gramz in operating the Application and providing related services, including data submitted directly by the User and data generated through the User's use of the Application or execution of transactions through it.

Gramz determines the purposes and means of processing Personal Data within its responsibility and complies with its legal obligations as a Data Controller whenever that capacity applies.

Gramz may engage service providers or specialized entities to process data on its behalf, within the stated purposes and the applicable contractual and legal requirements.

Certain processing activities conducted by independent entities, such as banks, payment service providers, or shipping companies, may be subject to those entities' own privacy policies, each within its role and legal responsibility.

This Policy does not, in itself, constitute a license for Gramz or any other party to process, transfer, or store data abroad where such activities require an additional license, permit, consent, or legal procedure.

Gramz collects Personal Data necessary to provide its services, verify User identity, execute transactions, and satisfy its legal obligations, according to the nature and necessity of the requested service. Such data may include, without limitation, the following:

Identity and Personal Identification Data

• Full name.
• Date of birth, where required to verify age or legal capacity.
• National ID card number, passport number, or other legally accepted identification document.
• Images of identity documents, including both sides of the national ID card where necessary.
• Information necessary to verify the User's identity and the authenticity of submitted documents.

Contact Information

• Mobile phone number.
• Email address.
• Residential or delivery address.
• Alternative contact details provided by the User, if any.

Account Information

• Username and account identifier.
• Login details and authentication and verification data.
• Records of account creation, activation, and updates.
• User preferences and account settings.
• Records of consents and electronic acknowledgments associated with the use of the Application.

The collection of authentication data must not be interpreted as authorizing Gramz to view passwords in readable form where they are stored using appropriate technical safeguards.

Bank Account and Payment Information

• Name of the bank account holder.
• Bank name and account details or International Bank Account Number (IBAN).
• Withdrawal requests and bank transfer details.
• Payment details and amounts received or refunded.
• Transfer confirmation documents provided by the User.
• Payment status and verification results confirming that amounts have been received and matched to the relevant orders.

This Policy does not imply that Gramz collects or stores complete payment card numbers or their security codes. Whether such data are handled depends on the payment mechanism and actual payment service provider. If an independent payment service provider processes such data, that processing is subject to the relevant legal and technical requirements.

Transaction and Precious Metals Data

• Metal type, fineness, weight, and quantity.
• Purchase or sale value, execution price, fees, and commissions.
• Precious metals balances and cash balances recorded in the account.
• Orders to purchase or sell precious metals and to collect, ship, or deliver them.
• Requests to withdraw sale proceeds and their execution details.
• Transaction history, timestamps, status, and any information needed to evidence or settle transactions.

Verification and Compliance Data

• Documents and information required for Know Your Customer (KYC) procedures.
• Information about the source of funds, wealth, or precious metals where required by law or compliance procedures.
• Information and documents needed to verify the legality of transactions.
• Identity-verification results and document authenticity checks.
• Indicators of suspected fraud or unlawful use, to the extent permitted by applicable laws and regulations.

Beneficiary Data

Gramz may process certain data concerning other persons, such as gift recipients, beneficiaries of a family account, or persons designated to receive precious metals. This may include information required to identify and contact them and verify the User's status or authority to perform the transaction, depending on the service and legal requirements. A User providing data about another person must ensure that a lawful basis exists for supplying and processing that data and obtain any required consents where applicable.

Technical and Usage Data

• Internet Protocol (IP) address.
• Device type, operating system, and Application version.
• Login and logout information and usage times.
• Crash logs and technical error records.
• Security information necessary to detect unauthorized access attempts.
• Feature and service usage information, to the extent necessary to operate and secure the Application and improve its performance.

Communications and Complaints Data

• Correspondence exchanged with Gramz.
• Complaints, inquiries, and requests.
• Documents submitted by the User in support of a request or complaint.
• Customer service contact records, including call recordings if such recordings are made and after satisfying the relevant legal requirements and notification obligations.

Gramz may obtain Personal Data from the following sources:

• Data and documents provided by the User when registering, updating an account, or requesting a service.
• Data generated through use of the Application and transactions conducted through it.
• Data received from banks and payment or identity-verification service providers, within the limits permitted by relevant laws and contracts.
• Data provided by custodians, shipping and delivery companies, and approved merchants to the extent necessary to provide services and document delivery or collection.
• Data provided by competent judicial, regulatory, or governmental authorities where obtaining it is legally permitted or required.
• Data provided by the User about service beneficiaries, according to the nature of the transaction and applicable legal requirements.

Where Gramz obtains Personal Data from a source other than the Data Subject directly, it takes the steps necessary to provide legally required information and notices, where required and unless a legal exception applies.

Gramz processes Personal Data for the following specified and lawful purposes, depending on the service used and the legal basis applicable to each processing activity:

Account Creation and Management

Registering Users, verifying their details, activating accounts, managing access permissions, and updating contact information.

Identity and Eligibility Verification

Verifying Users' identity, age, and legal capacity and the authenticity of submitted data and documents.

Service Provision and Transaction Execution

Executing requests to purchase and sell precious metals and for delivery and collection, processing requests to withdraw sale proceeds, and managing accounts and transaction records.

Financial and Accounting Obligations

Verifying payments, settling transactions, calculating fees and commissions, processing refunds or withdrawals, and maintaining necessary records.

Legal and Regulatory Compliance

Meeting requirements imposed by applicable laws, regulations, decisions, and instructions, including anti-money-laundering and counter-terrorist-financing requirements where applicable.

Fraud Prevention and Account Protection

Detecting unusual transactions, reviewing suspicious activity, preventing unauthorized access, and investigating Application misuse or suspected fraud.

User Communications

Sending account and transaction notices, informing Users about order statuses, responding to inquiries and complaints, and notifying Users of material changes to services, terms, or policies.

Additional Service Management

Operating services actually available within the Gramz Application according to each service's nature and terms, and processing the data necessary for their use.

Application Improvement and Development

Analyzing crashes, performance indicators, and usage patterns; developing Application functionality; and enhancing User experience while observing data minimization and anonymization principles where appropriate and feasible.

Protection of Rights and Dispute Resolution

Preserving evidence and records, investigating complaints, exercising or defending Gramz's legal rights, and implementing judgments and decisions of competent authorities.

Electronic Marketing

Sending promotional or marketing messages and offers where prior consent or another valid legal basis exists under applicable legislation, while enabling Users to unsubscribe or withdraw consent where required by law.

Personal Data must not be used for a new purpose incompatible with the original purpose without meeting the related legal requirements, including obtaining any necessary consent or providing additional notice where required.

Gramz undertakes not to process Personal Data without a valid legal basis under applicable Egyptian law, taking guidance from Article 6 of the European Union GDPR where appropriate and without contravening Egyptian laws and legislation. Depending on the processing activity, one or more of the following bases may apply:

• Consent: Where the law requires the Data Subject's consent, such consent must be explicit, specific, informed, demonstrable, and collected in a legally compliant manner.
• Performance of a Contract or Pre-Contractual Steps: Where processing is necessary to create an account, perform a service requested by the User, or meet obligations arising under the agreement.
• Legal Obligation: Where processing is necessary to comply with an obligation imposed on Gramz by a law, regulation, or decision of a competent authority.
• Protection of Rights and Legal Claims: Where processing is necessary to establish, exercise, or defend rights within the limits permitted by law.
• Other Recognized Legal Bases: Any other basis permitted by applicable Egyptian legislation, or by GDPR where it applies to the processing in question.

A User's acceptance of this Policy must not be regarded as blanket or unspecified consent to all processing activities. Contractual acceptance is not a substitute for separate consents required by law for certain data categories or processing purposes.

Withdrawal of consent does not affect the lawfulness of processing completed before withdrawal, nor prevent Gramz from continuing processing based on a separate lawful basis where legally permitted.

Gramz obtains the Data Subject's consent whenever required by law, using a method that satisfies applicable legal conditions.

Where processing relies on consent, the Data Subject may withdraw it at any time using the channels made available by Gramz or by contacting the designated privacy contact, subject to identity checks necessary to protect data.

Withdrawal of consent does not invalidate prior lawful processing, nor affect processing that Gramz may continue under another legal basis, including the fulfillment of existing legal or contractual obligations.

The User may refuse to provide certain optional data or withdraw consent for specific uses where legally permitted. However, failure to provide data necessary for identity verification, transaction execution, or legal compliance may prevent an account from being created or the requested service from being provided or continued.

Where consent is required for processing sensitive data, data relating to a minor, or any other special processing, Gramz meets the applicable requirements for consent, legal authority, and additional safeguards before commencing processing.

A service must not be conditional upon consenting to processing that is unnecessary to provide that service where such conditioning is prohibited by applicable legislation.

Gramz may share Personal Data with the following parties only to the extent necessary and legally permitted and for a specific, lawful purpose:

Technology Service Providers

Entities providing systems hosting, Application operation, maintenance, information security, database management, notification delivery, or technical support.

Banks and Payment Service Providers

To the extent necessary to verify payments, execute bank transfers, settle financial transactions, or process refunds.

Custodians and Storage Partners

To the extent necessary to deposit and safeguard precious metals, determine quantities and balances, fulfill collection or delivery requests, or verify records.

Approved Merchants and Shipping or Delivery Companies

To the extent necessary to deliver, ship, or hand over precious metals, verify recipient identity, and document completion.

Identity Verification and Compliance Providers

To validate identity and documents, assess fraud indicators, or perform legally required compliance procedures.

Subsidiaries or Affiliates

If any exist, to the extent necessary for a specified, lawful purpose, subject to legal requirements for data sharing and disclosure.

Competent Judicial, Regulatory, and Governmental Authorities

Where disclosure is required by law, ordered by a competent authority, or necessary to fulfill an applicable legal obligation.

Professional Advisers

Such as lawyers, auditors, and accountants, where disclosure is necessary for professional services or protection of legal rights, subject to confidentiality duties and relevant legal requirements.

Other Parties

Where the Data Subject consents to sharing or another lawful basis permits it.

To the extent required by law, Gramz takes necessary measures to ensure that parties processing data on its behalf follow contractual instructions and confidentiality, security, and data protection requirements.

Users' Personal Data is not sold to third parties for their own independent marketing purposes. Data is shared only to the extent necessary for the stated purpose or otherwise permitted by law.

Certain technical or operational services may require using hosting, storage, or processing systems located outside the Arab Republic of Egypt or engaging a foreign service provider.

Gramz must not transfer, make available, store, or process Personal Data outside the Arab Republic of Egypt unless the conditions, licenses, permits, consents, and procedures required under Egyptian Personal Data Protection Law No. 151 of 2020, its Executive Regulations, and related decisions have been met, according to the type of transfer, receiving party, and destination country.

Where required, Gramz verifies the level of legal and technical protection available in the receiving country, meets cross-border transfer conditions, obtains the Data Subject's consent or other legally required approvals or permits, and applies appropriate technical and organizational safeguards.

Where the GDPR applies to a particular transfer, its requirements for transfers to third countries, including suitable transfer mechanisms and safeguards where necessary, are also observed.

A User's general acceptance of this Policy does not, by itself, satisfy all requirements for cross-border data transfers or constitute a legally required license or permit.

Gramz limits transfers to data necessary for the stated purpose and takes suitable measures to protect such data during transfer, storage, and processing.

The Application or website may use cookies or similar technologies, such as local storage, usage analytics tools, or session-management technologies, depending on the tools actually used.

These technologies may be used for the following purposes:

• Operating the Application and maintaining sessions and logins.
• Supporting security functions and detecting unauthorized use.
• Remembering User preferences and settings.
• Analyzing performance and failures and improving User experience.
• Measuring marketing campaign effectiveness if such tools are actually used and legally permitted.

Some cookies may be necessary to operate or secure the Application, while other types may require prior consent depending on their purpose and applicable law.

If the Application uses third-party analytics, advertising, or similar technologies, their categories, purposes, and beneficiaries must be disclosed in the relevant cookie notice or privacy settings.

The User may manage cookies through Application or website settings, where available, or through browser or device settings. Disabling certain essential cookies may affect Application functions or services.

The Application must not be presumed to use marketing cookies or third-party tracking tools unless such tools have actually been installed and enabled; Gramz updates the relevant disclosures when new technologies are introduced.

Gramz may send notices necessary to provide services, secure accounts, inform Users of transaction statuses, or meet its legal obligations. Depending on their nature, these are operational service notices and are not necessarily marketing messages.

Electronic messages or notifications intended for direct marketing are sent only after prior consent has been obtained or other requirements under applicable law have been fulfilled.

Marketing messages include, according to the communication method and legal requirements, the sender's identity, the nature of the message, and a clear, accessible means to unsubscribe or object to further marketing messages.

The User may withdraw marketing consent or unsubscribe through an unsubscribe link, if provided, account settings, or the relevant Gramz contact channels.

Unsubscribing from marketing messages does not prevent essential notices about account security, transaction execution, or legal obligations where such notices are legally permitted or required.

For accounts opened by Users for themselves, Gramz requires compliance with the age and legal-capacity requirements set out in its Terms and Conditions, subject to any specific rules applicable to family account services.

If Gramz makes a family account service available, or permits purchases or balances to be recorded in the names of children, grandchildren, or other beneficiaries, it may process the information needed to identify the beneficiary and verify the User's relationship, legal capacity, and authority to submit data or request services on the beneficiary's behalf.

Processing beneficiaries' data is limited to what is necessary to manage the service, verify identity and eligibility, document rights, and meet legal obligations. Such data must not be used for incompatible purposes without a valid legal basis.

The User must provide documents establishing their legal authority and relationship to the beneficiary, as well as any consents or additional documents required by law, depending on the beneficiary's age and the nature of the service.

If the law requires consent from a parent, legal representative, or beneficiary, Gramz obtains it before processing. Merely creating a family account does not sufficiently establish legal authority over all data or rights relating to a beneficiary.

Recording information, purchases, or balances in a beneficiary's name does not imply that Gramz has determined legal ownership, guardianship, custodianship, or disposal rights. These matters are determined by the nature of the service, the documents, and applicable legal provisions.

If Gramz finds that the required data or documents are incomplete or inaccurate, or that processing may occur without the required consents, it may suspend processing, restrict the service, or request further documents within the limits of the law and with due regard for beneficiaries' rights.

Gramz retains Personal Data for as long as necessary to fulfill the purposes for which it was collected, taking into account legal and regulatory obligations, transaction-evidence requirements, dispute resolution, and protection of rights.

Retention periods vary according to the category of data and its processing purpose. The criteria Gramz may consider when determining these periods include:

• The duration of the User's account and contractual relationship with Gramz.
• The nature of the transaction and its records, and accounting and auditing requirements.
• Identity verification and anti-money-laundering and counter-terrorist-financing requirements, where applicable.
• Statutory periods for retaining documents and records.
• The existence of a complaint, dispute, investigation, or actual or reasonably anticipated legal claim.
• The need to evidence transaction performance or defend legal rights.

This Policy does not prescribe a single retention period for all data, because retention depends on the nature of each record and its applicable legal obligations. Gramz commits to maintaining an internal retention schedule specifying data categories and the periods or criteria applicable to each.

When the retention purpose has ended and no legal obligation or legitimate ground requires continued retention, Gramz takes appropriate steps to erase, destroy, or anonymize Personal Data, depending on the data and available technical means.

Some data may remain in backups or security logs for a limited period under the approved operational cycle, subject to safeguards against unauthorized use and deletion or replacement in accordance with the approved retention schedule.

Closing a User account does not automatically erase all data where retention is required by law, needed to settle outstanding transactions, or necessary to protect legal rights.

Gramz implements appropriate technical, organizational, and administrative measures to protect Personal Data against loss, destruction, alteration, disclosure, unauthorized access, or unauthorized use, taking into account its nature and volume and the risks associated with processing.

Depending on the systems used and the risk assessment, security measures may include:

• Restricting data access on a need-to-know basis.
• Using appropriate authentication and verification controls.
• Protecting systems and databases from unauthorized access.
• Applying security updates and managing vulnerabilities.
• Protecting data in transit and at rest by appropriate means, including encryption where suitable.
• Maintaining access and activity logs required for security monitoring and incident investigations.
• Training authorized personnel in confidentiality and data protection requirements.
• Assessing service providers that handle data and binding them to necessary contractual and security safeguards.
• Establishing procedures for handling security incidents and restoring systems and data when necessary.

The measures actually adopted by Gramz are determined by risk assessments and legal and technical requirements. Mentioning a measure in this Policy does not establish that it has been implemented unless it is in place within Gramz's systems and approved procedures.

The User must keep login credentials and verification codes confidential, refrain from sharing them, and notify Gramz immediately upon learning of a loss of control over the account or suspected unauthorized use.

Although appropriate security measures are taken, the security of any electronic system cannot be guaranteed absolutely. Nevertheless, a security incident does not relieve Gramz of any legal obligation concerning data protection, notification, remediation, or compensation.

Gramz maintains appropriate procedures to detect, investigate, assess, and mitigate information-security incidents that may affect Personal Data.

Upon discovering a Personal Data breach, Gramz takes necessary steps to contain the incident, mitigate its effects, address its causes, and protect the affected data and systems in light of the incident's nature.

Gramz notifies the Personal Data Protection Center, relevant authorities, and Data Subjects where required by Personal Data Protection Law No. 151 of 2020, its Executive Regulations issued under Minister of Communications and Information Technology Decision No. 816 of 2025, and related decisions, in the manner and within the periods prescribed by law.

Where the GDPR applies to a particular processing activity, its data-breach notification requirements are also observed, including notification of the supervisory authority within the statutory period where the notification conditions are met and notification of Data Subjects where legally required.

Incident-response procedures may include documenting the incident and its causes, affected data categories, measures taken, notifications issued, and corrective actions aimed at preventing recurrence.

Subject to Egyptian Personal Data Protection Law No. 151 of 2020, its Executive Regulations issued under Ministerial Decision No. 816 of 2025, and any additional rights applicable under the GDPR, Data Subjects may exercise the following rights in accordance with legally prescribed conditions, exceptions, and procedures:

Right to Information and Notice

To know which Personal Data Gramz processes, the principal purposes of processing, categories of recipients, and other information that must be disclosed by law.

Right of Access

To request access to Personal Data relating to them and obtain information to which they are legally entitled.

Right to Rectification and Updating

To request correction of inaccurate data, completion of incomplete data, or updates, with supporting documents to verify the change where appropriate.

Right to Erasure or Deletion

To request erasure or deletion of Personal Data where permitted by law, subject to obligations that may require certain data or records to be retained.

Right to Withdraw Consent

To withdraw consent for consent-based processing through available procedures, without affecting prior lawful processing or processing supported by an independent legal basis.

Right to Object or Restrict Processing

To object to certain forms of processing or request their restriction where provided by law, including in situations covered by the GDPR.

Right to Data Portability

To request receipt of Personal Data or its transfer to another entity when this right is established by law and its technical and legal conditions are met, especially where GDPR data-portability provisions apply.

Rights Concerning Automated Decisions

Where Gramz uses decisions made solely by automated means that produce legal or similarly significant effects on a Data Subject, the legally prescribed safeguards and rights for such processing apply where relevant.

Right to Complain and Seek Redress

To submit a complaint to Gramz about data processing or refer the matter to the Personal Data Protection Center or the competent regulatory or judicial authority, in accordance with applicable laws and procedures.

Other Rights

To exercise any other rights provided by Egyptian law or by the GDPR where applicable to the processing concerned.

These rights are not absolute or unlimited; they remain subject to identity-verification requirements, the rights of others, legal and regulatory obligations, and statutory exceptions.

A Data Subject may submit a request concerning their Personal Data through any of the following channels:

• Privacy requests email: privacy@gramz.app; general email: info@gramz.app.
• Gramz correspondence address: Almaza Avenue Complex, Almaza, Heliopolis, Cairo, Arab Republic of Egypt.
• Any other channel approved and announced by Gramz through the Application or its website.

Depending on its nature, the request must contain the information needed to identify the requester, specify the right being exercised, describe the data or processing concerned, and provide documents establishing legal authority or representation where a request is made on another person's behalf.

Gramz may request reasonable additional information to verify a requester's identity or authority where substantial grounds justify it, limited to what is necessary for verification.

Gramz reviews each request to determine whether it satisfies legal conditions and then responds, implements it, or explains the reasons for rejecting it in whole or in part, within the periods and procedures prescribed by applicable law.

If a request cannot be fulfilled because of a legal retention obligation, third-party rights, failure to meet the conditions for exercising the right, or another legal reason, Gramz explains the reasons it is legally allowed to disclose, subject to any restrictions on disclosure.

Fees are not charged for exercising rights except to the extent permitted by law and in accordance with the nature of the request and applicable requirements.

Submitting a privacy request does not automatically suspend existing contractual or legal obligations unless suspension or restriction of processing is required by law or Gramz decides to apply it on a valid legal basis.

The User must provide truthful, complete, accurate, and current Personal Data and promptly update them whenever a change affects their accuracy, Gramz's ability to contact the User, or performance of requested services.

The User is responsible for the accuracy of data and documents personally provided, without prejudice to Gramz's independent legal obligations to verify, process, and protect the data.

If Gramz finds that particular data are inaccurate, incomplete, or inconsistent with submitted documents, it may request correction, completion, or renewed verification and may temporarily suspend the affected service if necessary and proportionate to the risks or legally required.

The User must not submit Personal Data concerning another person without a lawful basis and must not impersonate others or use their data or documents in violation of the law.

Gramz may use technical tools to analyze transactions and detect fraud, unusual activity, or unauthorized access attempts, within the stated purposes and applicable legal basis.

The results may assist in reviewing transactions, requesting additional documents, referring a case to a qualified employee, or taking legally permissible precautionary measures.

Using analytics or verification tools does not mean that all account- or transaction-related decisions are made automatically without human involvement.

If Gramz subsequently relies on decisions made solely by automated means that have legal or similarly significant effects on Data Subjects, it will provide the information, safeguards, and rights to object or seek review required by applicable law, including GDPR provisions where applicable.

Gramz does not use Personal Data to create profiles or assessments extending beyond its declared lawful purposes without verifying that a valid legal basis exists and meeting transparency and safeguarding requirements.

The Application may contain links to third-party websites, applications, or services or rely on external services for functions such as payments, identity verification, shipping, or technical support.

Data processing performed by such parties may be subject to their own privacy policies and terms, according to their actual processing roles.

Providing a link or using an external service does not mean Gramz controls all processing independently performed by that party. Nevertheless, Gramz remains responsible for its own obligations concerning data it controls or processes on another party's behalf, as required by law.

Users are advised to review the third party's privacy policy before supplying data directly to it where that party will collect or process the data itself.

Gramz limits access to Personal Data to employees and authorized persons whose duties require it, within the permissions granted to them.

Gramz adopts contractual and organizational measures necessary to bind authorized employees and service providers handling data to confidentiality and protection obligations under the law.

When engaging Data Processors on its behalf, Gramz specifies processing scope, purposes, instructions, security requirements, and related obligations in appropriate contracts or legal arrangements.

A service provider must not use Personal Data processed on Gramz's behalf for independent purposes contrary to instructions or the processing's legal basis, in accordance with applicable contractual and legal obligations.

Confidentiality and data protection duties continue after employment or contractual relationships end to the extent required by applicable laws and agreements.

Gramz may process Personal Data as necessary to receive, investigate, and respond to complaints and resolve disputes relating to accounts, transactions, or services.

Correspondence, documents, and transaction records relevant to a dispute may be retained for as long as necessary to resolve it, meet a legal obligation, or protect a legitimate right, subject to data minimization and retention requirements.

Data may be disclosed to competent judicial, regulatory, or governmental authorities where required by law or by an order or decision of a competent authority.

This Article does not grant Gramz an unrestricted right to disclose all User data; disclosure is limited to what is legally required and justified by the relevant purpose.

Acceptance of this Policy does not constitute a waiver of any rights granted to Data Subjects under applicable law.

No provision of this Policy may be interpreted to exclude or limit any legal liability that cannot lawfully be excluded or limited.

If any provision of this Policy is found invalid or unenforceable, the remaining provisions remain valid and enforceable to the extent permitted by law.

If a provision of this Policy conflicts with a mandatory provision of applicable law, the law prevails to the extent of the conflict.

To the extent relevant legislation applies to its activities and processing operations, Gramz complies with Egyptian Personal Data Protection Law No. 151 of 2020, its Executive Regulations issued under Minister of Communications and Information Technology Decision No. 816 of 2025, and related regulatory decisions and instructions.

Gramz obtains the licenses, permits, consents, and procedures required by law for the collection, processing, storage, transfer, and sharing of Personal Data, according to the activity, data, and entities involved.

Gramz observes other relevant Egyptian legislation according to the nature of processing, including laws on anti-money-laundering and counter-terrorist-financing, e-commerce, electronic signatures, consumer protection, telecommunications, accounting and tax obligations, and other applicable laws and regulations.

No provision of this Policy exempts Gramz from duties imposed by law or authorizes it to process Personal Data beyond legally permitted limits.

In preparing this Policy and developing its data protection practices, Gramz adopts the principles of privacy, transparency, data minimization, purpose limitation, information security, and accountability under Egyptian laws, taking guidance from the EU General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR) on matters not regulated by Egyptian law and to the extent that this does not conflict with applicable Egyptian legislation.

Reference to the GDPR does not mean that all its provisions automatically apply to Gramz or all Application Users. Its scope is determined by its legal criteria, including the nature of processing activities, establishment location, and the persons targeted by the services, as applicable.

If the GDPR applies to a particular processing activity, Gramz complies, in accordance with its role and the scope of applicability, with relevant requirements, including:

• Principles of lawful, fair, and transparent processing.
• Purpose limitation, data minimization, accuracy, and storage limitation.
• Providing required information to Data Subjects.
• Enabling Data Subjects to exercise their legal rights.
• Adopting security measures appropriate to the risks.
• Regulating relationships with Data Processors.
• Meeting requirements for transfers to third countries where applicable.
• Conducting data protection impact assessments where required.
• Appointing a Data Protection Officer or representative in the European Union where legally required.
• Complying with data-breach notification and automated decision-making requirements where applicable.

Where a contractual provision of this Policy conflicts with a mandatory provision of applicable law, the applicable law prevails. Likewise, in the event of a conflict between Egyptian law and GDPR provisions, Egyptian laws and regulations govern. This Policy must not be used to diminish Data Subjects' rights or circumvent legally mandated safeguards.

Gramz reserves the right to review, amend, or update this Policy as necessary, including when services, processing technologies, or legal and regulatory requirements change.

The updated Policy is published on the Application or official website, stating the date of the latest update and the effective date of the amendments.

Where an amendment materially changes processing purposes, the categories of data collected, recipients of data, or any other matter requiring further notice or consent, Gramz takes legally required steps before commencing processing affected by the amendment.

Continued use of the Application does not replace explicit consent where legally required, and amendments must not apply retroactively in a way that diminishes vested legal rights or contravenes applicable legislation.

For inquiries, complaints, or requests concerning Personal Data, Data Subjects may contact Gramz through the following channels:

Requests must contain information necessary to identify the requester and the nature of the request. Gramz may request additional documents to verify identity or legal authority where necessary and proportionate.

Gramz reviews and responds to requests in accordance with legally prescribed procedures and time limits. If a requester is dissatisfied with how a request was handled, they may refer the matter to the Personal Data Protection Center or the competent judicial or regulatory authority in accordance with applicable legislation and procedures.

This Policy is governed by and interpreted in accordance with the laws of the Arab Republic of Egypt, particularly Personal Data Protection Law No. 151 of 2020 and its Executive Regulations under Minister of Communications and Information Technology Decision No. 816 of 2025 and related decisions, Anti-Money Laundering and Counter-Terrorist Financing Law No. 80 of 2002, and any other legislation applicable to the relevant processing activities.

Where the GDPR applies to a particular processing activity, its provisions are observed within their scope of applicability, without prejudice to mandatory rules of applicable law.

The competent judicial and regulatory authorities have jurisdiction over disputes and complaints relating to this Policy in accordance with the jurisdictional rules and procedures applicable within the relevant Egyptian courts and under Egyptian law.