Privacy policy

How Daleenda handles personal data, on this website and in the work we do for clients. It applies to everyone who contacts us or uses a system we run.

Data controller

Daleenda For IT Developments, 7 El Geish Road, Ismailia 41511, Egypt. Write to info@daleenda.com with anything about this policy or your data. Daleenda has no establishment in the European Union. Its representative in the Union under Article 27 GDPR is Nawfal Saleh Hadi Al-Safi (Handyland), Hertzstraße 1, 69126 Heidelberg, Germany, germany@daleenda.com. You can address anything in this policy to the representative instead of, or as well as, to us. For engagements contracted in Germany, Handyland is the controller for the client relationship, and Daleenda processes that data on its behalf. Daleenda has not appointed a data protection officer under Article 37 GDPR, because its core activities involve neither large scale, regular and systematic monitoring of individuals nor large scale processing of special categories of data.

Data we collect

From browsing this website, very little: there is no account to create, and your cookie choice and your language and theme preferences stay in your browser. We do count page views, which is described under “Counting visits” below and keeps one token, dln_vid, in your browser so that a return visit is recognised. The site is served by Firebase Hosting, a Google service, whose server logs record the IP address of each request; Google retains those logs for a few months for security and abuse prevention. The contact page offers a Google map that loads only after you choose to load it; when you do, Google receives your IP address and learns you viewed that page. The cookie policy lists everything the site keeps in your browser. Beyond that, what we hold is what you send us. If you send a brief through the contact form, we store your name, your email address, what you write and any other details you choose to give, and the visit it came from. The chat, bookings, and messages by email, SMS, WhatsApp and phone each have a section of their own below, and so do the careers pages. Where data about you reaches us from someone other than you, “Where data comes from” says how.

Counting visits

We measure how this site is read with our own software rather than a third party’s, and it counts every visitor. It records the page you opened, its title and language, the site that linked you here, any campaign tag in the address, the width of your window, your device type and browser, your country, how long you spent on the page and how far down it you read. To recognise your browser when it comes back on a later day, it keeps one value in your browser’s local storage, named dln_vid: a random token that means nothing outside this site and is sent, with each page view, only to our own collector. It is written on your first visit, before you make any cookie choice, and has no expiry date: it stays until you clear this site’s data in your browser. Its purpose is to tell new visitors from returning ones and to follow a visit that spans several days, so that we can see which pages bring people back. Your IP address is used for two things and then discarded: working out the country, which happens on our own server, and producing a one-way fingerprint by combining it with a secret that is destroyed every night. The lawful basis is our legitimate interest in knowing how the site is used and which pages are worth writing (Article 6(1)(f) GDPR). This counting does not change in response to Global Privacy Control or Do Not Track: a browser that sends either signal is counted like any other. You can object at any time by writing to legal@daleenda.com, as described under “Your right to object”. Clearing your browser’s site data removes the token, but a new one is written on your next visit; to prevent that, block site storage for daleenda.com in your browser’s settings. Records are kept for ninety days and then reduced to daily totals. Separately, and only if you switch analytics on, Google Analytics and Metricool perform their own measurement. Google Analytics uses cookies and Metricool does not; both are described in the cookie policy. When you send us a brief, an application or a booking, the submission records which visit it came from, so the pages you read before writing to us can be connected to the details you gave. If you arrived through an ad on Facebook or Instagram, it also records the click identifier Meta adds to the address (fbclid), and an application you send keeps it for the report to Meta described under “Applying for a job”. It is deleted with the visit records after ninety days, and with the application when the application is deleted.

Live chat

If you start a chat, we store your name, the email address and phone number you give, your language, your agreement to this policy, every message, and any voice recording or file you send, together with a random visitor id and conversation id that your browser keeps, and the visit the chat started from. We use it to answer you. Our staff read and reply in our Desk, and a conversation can be copied into a Desk ticket so it can be followed up. If you ask for a transcript, we first email a confirmation link to the address you gave and send the transcript, through Amazon SES, only after you press the button on the page that link opens.

Booking a call

To book a call, we take your name, your email address, the brief you write, your language and the time you choose. The booking is written into the chosen consultant’s Google Calendar with your name, email address and brief, and the confirmation, reminder, change and cancellation emails go out through Amazon SES.

Email, SMS, WhatsApp and phone

Messages you send to our addresses and numbers arrive in our Desk as tickets, with your address or number, the content and our replies. Incoming email is received by Amazon SES and placed in Amazon S3, from where Desk files it as a ticket; the raw message is deleted from Amazon S3 after 30 days. SMS we send go out through AWS End User Messaging and Amazon SNS. WhatsApp messages pass through WhatsApp, a Meta service, and reach Desk through a gateway we run ourselves on a server in the EU. Some SMS and calls go through a company Android phone with its own SIM card, located in Egypt, which reports to Desk the number, the text of an SMS, and the time, duration and outcome of a call. Google Firebase Cloud Messaging is used only to wake that phone and carries nothing about you.

Email preferences and marketing

Every optional email, such as the daily brief, alerts and client updates, carries an unsubscribe link and a one click unsubscribe header, and we keep a record of which of these an address has switched off, so that we keep to it. Marketing emails go only to people who have confirmed their address through a link in a confirmation email; as proof of that consent we keep when it was given, from which IP address and browser, and which wording was shown. Contacts recorded as having agreed before this confirmation existed receive one email asking them to confirm, and are removed from marketing if they do not confirm within 30 days.

Applying for a job

Applying for a role means sending us your name, email address, phone number and CV, and whatever else you choose to add: a message, a portfolio link, when you could start, and any further documents you attach. It is stored in our own database and a private file store with Supabase in Frankfurt, Germany: the key this website runs on can write an application and cannot read one back, so nothing you send is readable from the public site. Access is limited to the people at Daleenda who review applications. No automated decision is made about you: a person reads every application. To fill in your candidate profile, your CV is read by Anthropic’s Claude model on Amazon Bedrock, which Amazon Web Services runs for us inside the European Union. The model copies out what your CV says, such as your work history, education, skills and profile links, and our team can correct anything it got wrong. It does not score, rank or reject anyone, and a person still reads every application. Amazon does not keep your CV after reading it or use it to train models, and Anthropic does not receive it. Apart from that, your CV, answers and documents are not sent to anyone outside Daleenda. The legal basis is our legitimate interest in handling applications efficiently (Article 6(1)(f) GDPR). You can object by writing to legal@daleenda.com, and we will read your CV by hand instead. One report does leave: when an application is stored, our server sends Meta Platforms Ireland, through Meta’s Conversions API, an event named SubmitApplication with the time, the address of the careers page you applied from, a reference made from the application’s internal id, and your email address and phone number, each first turned into a SHA-256 hash. This happens whatever you chose in the cookie banner. Meta matches the hashes against its own users to measure and improve our job advertising on Facebook and Instagram; it does not receive your name, CV, answers or documents. If you arrived through one of our ads on Facebook or Instagram, the report also carries the click identifier Meta added to the link you followed (fbc), so that Meta can tell which ad you came from; it is not hashed, because it identifies a click rather than you. By default, only applications from people Meta sent us are reported: those that arrived through our Meta ad links, from Facebook or Instagram, or with a Meta click identifier. The legal basis for this report is our legitimate interest in measuring and improving our job advertising (Article 6(1)(f) GDPR). If your browser sends the Global Privacy Control signal when you apply, your application is marked accordingly and no report is sent. You can also object to the report at any time by writing to legal@daleenda.com. You may ask us to delete your application at any time, including in the middle of a process, by writing to the same address. Otherwise we keep your application in our talent pool, so that we can consider you for future roles, and delete it 24 months after its last activity (the latest of its arrival, our decision on it and any later step in it), or on a later date you agreed to by email. We do not ask for your consent to this; it rests on our legitimate interest in filling future roles with people who have already applied to us (Article 6(1)(f) GDPR). You can object at any time by writing to legal@daleenda.com: we then delete your application as soon as it is no longer being considered for a role, and do not contact you about future roles. A profile we added ourselves is kept on the same terms. If you are hired, your application becomes part of your employment records.

Where data comes from

Most of what we hold, you gave us. Some reaches us from others. When someone copies you into an email to us, we receive your name, address and whatever the email says about you. When a client invites a member of their staff to our client portal, the client gives us that person’s name and work email address. When a partner registers a lead with us, the partner gives us the contact details of the person at that company and what they know about the enquiry. When we approach a candidate we found on a professional network such as LinkedIn, or one who was recommended to us, we take the name, contact details and professional profile from that source or from the person who recommended them, and we tell the candidate at our first contact, and at the latest within one month. When a business gives us a VAT identification number, we check it against the European Commission’s VIES service. Giving us personal data is neither a legal nor a contractual requirement, and nothing happens to you if you do not: the exceptions are the fields a form marks as required, without which we cannot answer that form, and the invoicing details an engagement needs, without which we cannot invoice it.

Purposes and legal basis

We use personal data for the purposes below, each on the legal basis named. Answering an enquiry, a chat, a message or a call, arranging and managing the calls you book, emailing a chat transcript you ask for, and preparing and delivering work you have asked for rest on the contract, or on steps taken at your request before entering one (Article 6(1)(b) GDPR). Considering an application, including a speculative one, rests on the same basis, and for applicants in Germany also on § 26(1) of the Federal Data Protection Act (BDSG). Marketing emails rest on your consent, given through the confirmation link. Optional cookies and tags, Google Analytics, Metricool and the Meta and TikTok pixels among them, rest on your consent (Article 6(1)(a) GDPR, and § 25(1) TDDDG for what they store on or read from your device). Loading the Google map on the contact page rests on your consent too, given by the click that loads it; that choice is not remembered, so the map is not loaded again until you click again. The following rest on our legitimate interests (Article 6(1)(f) GDPR), and you can object to each of them as described under “Your right to object”: counting visits with our own software, including the dln_vid token, so that we know how the site is used and which pages are worth writing; reporting job applications to Meta through the Conversions API, so that we can measure and improve our job advertising; our staff’s use of Insights Ask, so that we understand our own business from our own records; reading the CVs sent with job applications with Claude on Amazon Bedrock, so that candidate profiles are filled in without retyping them; keeping applications in our talent pool for 24 months after their last activity, so that we can consider earlier applicants for future roles; keeping a list of the addresses that have switched an email off or cannot receive mail, so that we keep to it; and keeping the systems we run secure. Keeping the records that tax and commercial law require rests on legal obligation (Article 6(1)(c) GDPR).

Who we share it with

We do not sell personal data, and no advertising is shown on this site. Your CV is not sent to a recruitment network or to any client. The providers below process personal data for us or receive it, for the purposes stated and only to the extent the work needs. Processors, acting on our instructions: Google’s Firebase Hosting serves this site. Supabase stores content pages, applications, chat conversations, bookings, Desk tickets, contacts and our own visit counts on servers in Frankfurt, Germany. Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg), in its Frankfurt region (eu-central-1), sends our emails through Amazon SES; receives the email sent to us through Amazon SES, Amazon S3 and Amazon SNS; sends SMS through AWS End User Messaging and Amazon SNS; and, on Amazon Bedrock with Anthropic’s Claude model, which may process requests in another AWS region inside the European Union, reads the CVs sent with job applications to fill in candidate profiles and runs Insights Ask, an internal assistant our staff use to ask questions about our own records. The question and the records read to answer it can include client names, contact details and the content of Desk tickets and deals. Google Calendar holds the bookings you make, with your name, email address and brief. Google Firebase Cloud Messaging carries only a wake signal and a device token to our company phone, and nothing about you. Our WhatsApp gateway runs on our own server in the EU. Recipients acting on their own account: WhatsApp, a Meta service, carries the WhatsApp messages you exchange with us and processes them under its own terms, as a separate controller; for people in the European Region the service is provided by WhatsApp Ireland Limited. Mobile network operators carry SMS and calls. Google Ireland Limited receives, through Google Maps, your IP address and the page you are on if you load the map on the contact page, and handles them under Google’s own terms. Google Analytics, only once you switch analytics on, receives the pages you open here and handles them under Google’s own terms. Metricool Software, S.L. in Madrid, Spain, also only once you switch analytics on, receives the address of each page you open here, the site that linked you here, the size of your window and your IP address, and reports them to us as visit counts beside our social media statistics. Metricool says it does not store the IP address. Meta Platforms Ireland receives data in two ways. Through the Meta Pixel, only once you switch marketing on, it receives the pages you open here and when you send a form or get in touch. Through the Conversions API, whatever you chose in the cookie banner, it receives a report of each job application with your email address and phone number in hashed form, as described under “Applying for a job”. Both serve our advertising on Facebook and Instagram. For collecting that data and passing it to Meta, we and Meta are joint controllers under Meta’s controller addendum; what Meta does with it afterwards is governed by Meta’s own privacy policy. TikTok Technology Limited in Ireland, only once you switch marketing on, receives through the TikTok Pixel the same as the Meta Pixel, so that our advertising on TikTok can reach, and be measured against, people who visited. For that, we and TikTok are joint controllers under TikTok’s joint controller addendum, and what TikTok does with it afterwards is governed by TikTok’s own privacy policy. Our own visit counts are shared with nobody. For engagements contracted in Germany, Handyland shares with Daleenda the data the work needs, under a data processing agreement between the two.

International transfers

We work across Egypt, Germany and the Gulf, so data may be processed outside the country it was collected in. What you send us is stored with Supabase in Frankfurt, Germany, inside the European Economic Area. Email, SMS and incoming mail run in Amazon Web Services’ Frankfurt region. Insights Ask and CV reading on Amazon Bedrock are sent from Frankfurt and may be processed in another AWS region inside the European Union. All of it stays inside the EEA. Our WhatsApp gateway runs on a server in the EU. The site itself is served by Google’s Firebase Hosting from a global network, under Google’s data-processing terms, which include the EU standard contractual clauses for what leaves the EEA; Firebase Cloud Messaging runs under the same terms. Bookings are written to Google Calendar, which Google may process in the United States and elsewhere, under Google’s data processing terms, which rely on the EU–US Data Privacy Framework and the EU standard contractual clauses. If you load the Google map, Google Ireland Limited may share what it receives with Google LLC in the United States, which is certified under the EU–US Data Privacy Framework, and otherwise relies on the EU standard contractual clauses. If you switch analytics on, Google Analytics sends what it collects to Google, which processes it in the United States among other places, under Google’s data-processing terms and the EU standard contractual clauses. Metricool keeps what it collects on servers inside the European Union and does not transfer it outside. The Meta Pixel, if you switch marketing on, and the Conversions API, for job applications, send what they collect to Meta Platforms Ireland, which may transfer it to Meta Platforms, Inc. in the United States under the EU–US Data Privacy Framework and the EU standard contractual clauses. WhatsApp messages are handled by Meta under its own terms and may be transferred the same way. The TikTok Pixel sends what it collects to TikTok Technology Limited in Ireland, which may transfer it to other TikTok companies outside the EEA, including in the United States, Singapore and Malaysia, under the EU standard contractual clauses. People at Daleenda work from Egypt, so reading and answering what you send is itself access from outside the EEA, and the company phone that handles some SMS and calls is in Egypt. When you send something to Daleenda directly, through this site, an email, a message or a call, we collect it ourselves as the controller in Egypt; that is not a transfer within the meaning of Chapter V GDPR, but the GDPR applies to that processing all the same, and so do the rights in this policy. Where our providers in the EEA, Supabase and Amazon Web Services among them, return data to us in Egypt, that transfer rests on the EU standard contractual clauses (processor to controller) in their data processing terms. Egypt holds no EU adequacy decision, and the Egyptian Personal Data Protection Law (Law No. 151 of 2020) applies to our processing there as well. Where Handyland is the controller, its transfer of that data to Daleenda in Egypt rests on the EU standard contractual clauses (controller to processor) signed between the two companies, with the technical and organisational measures set out there.

How long we keep it

Each kind of record is kept for the period below, and then deleted or stripped of what identifies you. Records of an engagement are kept for as long as it runs, and afterwards for as long as the tax and commercial law of the country concerned requires. A brief sent through the contact form, and an email from someone who is not a client, are deleted 36 months after they arrive. A chat conversation, with its voice recordings and files, is deleted 365 days after its last message, whether or not it was closed. A booking is deleted 36 months after the latest of the day it was made, the end of the call and its cancellation. A Desk ticket, including one made from an email, an SMS, a WhatsApp message, a call or a chat, is deleted 36 months after its last activity once it is resolved or closed; an open ticket is kept while it is open, and a resolved one closes by itself after 14 days. The fingerprints we keep to stop abuse of the booking and chat forms are deleted with the booking or conversation they belong to. The entry a booking creates in the consultant’s Google Calendar is not deleted automatically; we delete it when you ask. A raw incoming email is deleted from Amazon S3 30 days after it arrives. In a lead registered by a partner, the details of the person are removed 12 months after the lead’s protection period, and any commission period after it, has ended. The contact details in a partner application we declined are removed 6 months after the decision. The address an automatic email was sent to, such as an application acknowledgement or a booking receipt, is removed from our sending records 3 months after sending. A job application, including a speculative one and a candidate profile we added ourselves, is kept in our talent pool and deleted 24 months after its last activity (or on a later date you agreed to by email), or sooner if you object and it is no longer being considered for a role; and if you are hired, your application becomes part of your employment records. Marketing contacts who do not answer the email asking them to confirm are removed from marketing after 30 days. The record that an address has switched an email off is kept for as long as we might otherwise write to that address, so that we keep to it; reports of bounced or rejected mail, and records of a lifted block, are deleted after 36 months. Visit records, with any Meta click identifier in them, are kept for 90 days and then reduced to daily totals; the dln_vid token stays in your browser until you clear this site’s data. Where no legal retention period applies, asking for deletion sooner always wins.

Your rights

You have the right to know whether we process data about you and to receive a copy of it with the information Article 15 GDPR lists (access); to have inaccurate data corrected and incomplete data completed (Article 16); to have data erased where there is no longer a reason to keep it (Article 17); to have its use restricted while a dispute about it is resolved (Article 18); and to receive data you gave us on the basis of consent or a contract in a structured, machine readable format, or have it sent to someone else (Article 20). Where processing rests on consent, you can withdraw it at any time, without affecting what was lawful before (Article 7(3)). Any optional or marketing email can be switched off with the unsubscribe link it carries. No decision that has legal or similarly significant effects on you is made by automated means alone (Article 22): a person makes every decision about an enquiry or an application. Write to info@daleenda.com, or to our representative in the Union; we answer within one month, and if a request is complex we may extend that by up to two more months, telling you why within the first month.

Your right to object

Where we rely on our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation, under Article 21(1) GDPR. That covers counting visits with our own software, including the dln_vid token; the report of job applications to Meta through the Conversions API; our staff’s use of Insights Ask; the reading of CVs with Claude on Amazon Bedrock; keeping your application in our talent pool; the list of addresses that have switched an email off; and security measures. We then stop, unless we can show compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. You can object to the use of your data for direct marketing at any time and without giving reasons (Article 21(2) and (3)), and we then stop using it for that purpose. To object, write to legal@daleenda.com. Our own visit counting does not change in response to Global Privacy Control or Do Not Track, so an email is the way to object to it. Global Privacy Control is honoured in one place: if your browser sends it when you apply for a job, your application is not reported to Meta.

Complaints

If our answer does not satisfy you, you have the right to complain to a data protection supervisory authority, in particular in the country of the European Union where you live or work or where you believe the infringement took place. Because our representative in the Union is in Baden-Württemberg, the authority we name is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, poststelle@lfdi.bwl.de. In Egypt, the competent authority is the Personal Data Protection Center established by the Personal Data Protection Law (Law No. 151 of 2020).

Residents of US states

If you live in a US state with a consumer privacy law, such as California, this section adds to the rest of this policy. The categories of personal information we collect are those described above: identifiers and contact details, professional information from applications and engagements, internet activity on this site, coarse location (your country), and what you write to us. We do not sell personal information. The Meta and TikTok pixels, if you switch marketing on, and the report of job applications to Meta through the Conversions API may count as “sharing” for cross-context behavioural advertising under California law. You can opt out by leaving marketing switched off in the cookie banner, which keeps the pixels from loading; by sending the Global Privacy Control signal from your browser when you apply, which stops the report to Meta; or by writing to legal@daleenda.com, which opts you out of both. Our own visit counting does not change in response to Global Privacy Control. You have the right to know what personal information we collect, use and disclose, to have it corrected, and to have it deleted, and we will not treat you differently for exercising any of these rights. We do not use sensitive personal information to infer characteristics about you. Write to legal@daleenda.com; we confirm receipt within 10 business days and answer within 45 days.

Changes to this policy

This page states the date it was last updated. Where a change affects how your data is used rather than how the policy is worded, we say so plainly rather than relying on you to re-read it. On 30 September 2026 this policy was extended to cover live chat, bookings, email, SMS, WhatsApp and phone messages, email preferences and marketing confirmation, and every provider that processes your data, and to describe the reporting of job applications to Meta through the Conversions API, which had started before this policy described it. On 2 October 2026 the report of job applications to Meta was extended: it now covers applications that arrive from Facebook or Instagram without one of our ad links, and it carries the click identifier of the Meta ad you followed, when there was one. On 2 October 2026 this policy was also restructured: it now gives chat, bookings, messages and email preferences sections of their own, pairs each purpose with its legal basis, states a retention period for each kind of record, sets out your right to object and where data comes from, names the supervisory authorities you can complain to, adds a section for residents of US states, and records that Global Privacy Control is honoured for the report of job applications to Meta. On 4 October 2026 this policy was extended to describe the reading of CVs sent with job applications by Anthropic’s Claude model on Amazon Bedrock, which fills in candidate profiles and had started before this policy described it, and to say that requests to Amazon Bedrock may be processed in another AWS region inside the European Union. On 4 October 2026 it was also decided that job applications are kept in our talent pool for 24 months after their last activity without asking for consent, on our legitimate interest and with the right to object; until then they were deleted six months after a rejection unless you agreed by email to a longer period.