Data Processing & Protection Policy

1. Data Classification

The Platform classifies data to ensure appropriate protection levels and processing controls.

1.1 Public Data

Public Data includes information intentionally made visible to other users, such as profile details, ratings, and reviews.

1.2 Operational Data

Operational Data includes project records, milestone details, task tracking data, and professional communications required for service delivery.

1.3 Sensitive Data

Sensitive Data includes identity verification documents (KYC), financial information, authentication credentials, and any data requiring enhanced protection.

1.4 AI and Behavioral Data

AI and Behavioral Data includes communication patterns, device fingerprints, usage behavior, and risk analysis outputs generated by automated systems.

2. Processing Principles

All data processing activities are governed by strict operational principles.

2.1 Data Minimization

Only data necessary for specific operational purposes is collected and processed.

2.2 Lawful Processing

Data is processed based on valid legal grounds, including user consent, contractual necessity, and compliance with legal obligations. Identity verification (KYC) processing is a mandatory requirement for enabling payment processing and payout functionality on the Platform, in accordance with the Identity Verification (KYC) Policy.

2.3 Accuracy and Updates

The Platform maintains reasonable measures to ensure that data is accurate, complete, and kept up to date.

2.4 Integrity and Confidentiality

Data is processed securely and not used in a manner inconsistent with user interests, platform policies, or applicable laws.

3. Access Controls

Strict access control mechanisms are enforced to protect data.

3.1 Role-Based Access Control (RBAC)

Access to data is limited based on job function and operational necessity.

3.2 Multi-Factor Authentication (MFA)

Where implemented, administrative access to sensitive systems requires multi-factor authentication to reduce the risk of unauthorized access.

3.3 Access Logging and Monitoring

Where implemented, access to sensitive systems and user data is logged and monitored to support audit and security review.

4. Storage and Encryption

The Platform aims to apply industry-standard encryption and storage practices; the specific technical measures described in this Section reflect the Platform's general security approach and are implemented and maintained on an ongoing basis, subject to change as technology and threats evolve.

4.1 Data in Transit

Data transmitted between Users and the Platform is intended to be encrypted using secure protocols such as TLS/SSL.

4.2 Data at Rest

Where implemented, sensitive data stored in databases and cloud systems is encrypted using industry-standard encryption methods.

4.3 Encryption Key Management

Where implemented, encryption keys are managed using secure key-management practices, which may include hardware security modules (HSM) or cloud-based key management services (KMS), with keys protected and access to them restricted from general application-level access.

4.4 Backup and Recovery

Glancers maintains, or aims to maintain, a data backup practice intended to support availability and recovery in case of system failure or incident.

5. Retention and Deletion

The Platform enforces structured data lifecycle management.

5.1 Retention Standards

Different categories of data are retained based on operational, contractual, and legal requirements. Glancers retains each category of personal data for no longer than is necessary for the purposes for which it is processed, or for any longer period required by applicable law.

5.2 Secure Deletion

When data is no longer required to be retained, Glancers aims to delete it or irreversibly anonymize it using appropriate methods.

5.3 Legal Retention Exceptions

Certain data may be retained beyond standard periods where required for legal, financial, dispute resolution, or regulatory purposes.

6. Data Breach Handling

The Platform maintains a structured incident response framework.

6.1 Incident Response Plan

Immediate technical and operational actions are initiated upon detection of a data breach or security incident.

6.2 Impact Assessment

The Platform evaluates the scope, severity, and type of affected data to determine risk exposure.

6.3 Notification Protocol

Where a data breach affecting personal data is confirmed and notification is required by applicable law, Glancers aims to notify the competent data protection authority and, where required, affected Users within the timeframes set by applicable law, including Egyptian Law No. 151 of 2020 and its Executive Regulations.

6.4 Post-Incident Review

Following any incident, the Platform conducts a full review to identify root causes, implement corrective actions, and strengthen security controls.

6.5 Incident Register

Where implemented, security incidents are recorded in an internal incident register to support auditability, regulatory review, and continuous improvement.

7. Compliance and Auditing

The Platform aims to maintain ongoing compliance with applicable data protection requirements.

7.1 Regulatory Compliance

Data processing aligns with applicable data protection laws and regulatory requirements.

7.2 Internal Audits

Glancers' operational procedures may include internal audits intended to assess adherence to security and data protection standards.

7.3 Continuous Improvement

Security and data protection practices are reviewed and updated as appropriate in response to emerging threats, technological advancements, and operational insights.

7.4 Data Protection Impact Assessment (DPIA)

Where required by applicable law or Glancers' internal risk-assessment process, the Platform aims to conduct a data protection impact assessment for high-risk processing activities, such as AI-based behavioral analysis or automated decision-making, to evaluate risk and support proportionate, fair processing. This Section describes an internal governance practice and is not a representation that a DPIA has been completed for every such activity as of the date of this policy.

8. Cross-Border Data Transfers

Where Glancers or a service provider it uses processes or stores personal data outside Egypt, that transfer is made subject to the safeguards required under applicable Egyptian data protection law and, where relevant, the law of the receiving jurisdiction, as further described in the Privacy Policy. Glancers does not represent in this policy that it holds a specific cross-border transfer permit, authorization, or adequacy determination.

9. Statutory Data Retention & Service Provider Processing

Glancers processes personal data through authorized service providers and technical infrastructure. Where deletion is requested, operational account access is restricted while transaction and financial audit logs are retained in compliance with Egyptian statutory retention obligations.

Version History

• 2026-09 — Updated payment and relationship terminology. Streamlined policy wording. Updated data retention and data protection wording. Updated policy titles and cross-references.
• 2026-09 — Revised selected provisions for accuracy and consistency with related policies.
• 2026-09 — Clarified consistency with related policies and qualified statements about Platform features.
• 2026-09 — Updated payment, compensation, and relationship terminology to reflect that Clients purchase Services from Glancers and that Glancers separately engages and compensates Freelancers.