What the Port Said desk records about readers and dispute notifiers, and the rights you retain.
Last reviewed 9 June 2026. Cartouche Loan Watch — published by Cartouche Loan Watch Press — Nile Repatriation Notes S.A.E. of Port Said — collects personal information through three channels: the contact form, the subscription system and the data-service request channel. This notice describes what we collect, how long we keep it, who else sees it, and the rights you retain. The data officer named at the foot of this page answers questions.
1. The data controller.
Cartouche Loan Watch Press — Nile Repatriation Notes S.A.E., an Egyptian joint-stock company registered at the Port Said Commercial Registry under number 73/2015, with Egyptian Tax Authority VAT identifier 316-948-072, at 22 Sharia Mohammed Ali, El-Manakh district, Port Said 42511. The company trades under the editorial title Cartouche Loan Watch. The legal representative is Hossam el-Bedawi, founder and majority shareholder.
2. The data officer.
Marwan Saidy, data and customs specialist, holds the data officer role at the watch since 2020 when the role was formalised. Reach him on [email protected] with subject line "data request" or by telephone during office hours. He handles access, correction, deletion and portability requests personally; the role is not delegated to an external processor.
3. What we collect.
From the contact form: name, email, optional affiliation, optional subscription tier choice, topic of message, loan identifier where applicable, message body. Lawful basis: consent (consent box required) and pre-contractual interest for subscription and data-service enquiries. Used only to reply.
From subscriptions: name, email, optional institutional affiliation, postal address for institutional subscribers and for the printed-digest option, country, and a record of annual payments. Lawful basis: contract.
From data-service requests: the requester's name, contact details, institutional affiliation, the specific loan or extract requested, the eventual certificate or extract delivered, and a copy of the source-stream citations supporting it. Lawful basis: contract.
From correction submissions: the submitter's name and email, the loan identifier, the specific reading challenged, the source citation supporting the corrected reading, and the desk's eventual disposition. Correction submissions are retained for the lifetime of the corrections log because they are part of the cooperative's editorial record.
From the website itself: standard request logs at the hosting provider — IP address, timestamp, requested URL, referring page, user agent. Lawful basis: legitimate interest in server security. No cookies, no analytics scripts, no tracking pixels, no third-party measurement code. There is no cookie consent banner because there is no cookie to consent to.
4. What we do not collect.
We do not collect payment instruments. Subscription payments arrive by bank transfer or PayPal; payment details remain with the reader's bank or PayPal account, not with us. We do not collect health data, religious affiliation, political views or any other special-category data. We do not collect location data beyond the country the reader tells us. We do not buy mailing lists. We do not enrich your record with third-party data. We do not track which catalogue entries a reader opens; the editorial position is that reader behaviour is not the watch's business to observe.
5. Who else sees this information.
Contact-form messages, subscription records and data-service files are visible to the four editors and the administrator named on the about page. The mail server is hosted in Frankfurt by a German provider under a written processor agreement; the provider's name is available on request. Subscription payment records are visible to the cooperative's bank (Banque du Caire, Port Said branch) and, where applicable, to PayPal under their published terms. The Ahmed Lutfi al-Sayyid Foundation sees aggregate annual subscriber numbers in our grant reports, not individual subscriber identities. The Egyptian Tax Authority sees aggregate VAT filings, not individual reader records.
6. International transfers.
Because the mail server is in Germany, email passes through the European Union. The processor agreement reflects standard EU contractual clauses. Subscription records and the corrections log are held in Port Said on encrypted local storage with an off-site mirror in Cairo. There is no transfer outside Egypt for storage purposes.
7. How long we keep your information.
Contact-form messages that do not lead to a subscription or data-service request are retained for twelve months and then deleted from the editorial mailbox at the next quarterly cycle. Earlier deletion on request within thirty days.
Subscription records are retained for the duration of the subscription and seven years thereafter — the retention period required by Egyptian commercial law for accounting documentation. After seven years the personal name and postal address are erased; the anonymised payment-flow record is retained for statistical purposes only.
Data-service files (certificates, custom extracts, consultation transcripts) are retained for the duration of the cooperative's editorial archive because they are part of the watch's documentary record. The requester's identity is removed from the published version unless they have consented to identification; the full record (including identity) is retained in encrypted local storage and is available only to the editorial board.
Correction submissions are retained indefinitely as part of the corrections log because the cooperative's published corrections record is a permanent reference. The submitter's identity is published openly in the log entry unless the submitter has requested anonymity.
Email correspondence with subscribers is retained for the duration of the subscription year and the following two years, then archived offline; offline archives are erased after seven years.
Server logs are kept by the hosting provider for fourteen days. Aggregate access counts are kept indefinitely with no identifying information.
8. Your rights.
Under Egyptian Personal Data Protection Law (Law 151/2020) and the EU General Data Protection Regulation where it applies, you have at any time the rights of access, portability, rectification, erasure, restriction, objection and withdrawal of consent. The data officer handles requests within thirty days, in writing, free of charge.
9. Security measures.
The editorial server and the subscription archive run on encrypted disks at the Port Said office, with the off-site Cairo mirror on similar encrypted storage. The mail server uses TLS for all client connections. Backups are encrypted at rest and access-controlled to the chair and the data officer. The office is locked outside opening hours and shares the building's security arrangements with the upstairs maritime-insurance brokerage and the back-yard archive room.
10. Source data versus personal data.
The watch's public roster contains inventory identifiers, lender and receiving institution names, dispatch and return dates, and dispute-watch status. None of this is personal data in the regulatory sense; the roster identifies artefacts and institutions, not individuals. Where receiving-museum staff names appear in our editorial content, they are always the staff members' published institutional roles (registrar, curator, director). We do not publish private contact details of any individual associated with any loan.
11. Photographic policy.
The watch's photographic plates show artefacts at exhibition, dispatch crates at customs, or loading-dock scenes at the Tahrir Egyptian Museum. Photographs that include identifiable individuals are framed or processed to remove identifying detail before publication. We do not retain personal-identifying images beyond ninety days of their original use.
12. Subscriber telemetry.
We do not embed read-receipt pixels in the monthly bulletin. We do not track which loans a subscriber opens. We do not maintain a subscriber-engagement score. The only behavioural measure is the aggregate open-rate of the monthly mailing, calculated by the mail-server provider as a single percentage with no identifying information.
13. Data breaches.
If a breach occurs and is likely to result in a risk to your rights, we notify you by email within seventy-two hours of becoming aware and notify the Egyptian Personal Data Protection Centre in the same window. Two minor incidents have been logged since 2015, both involving misaddressed bulletins (a single subscriber's name and country sent to another subscriber by mistake); both are summarised in the corresponding year's transparency note.
14. Cookies.
This website sets no cookies. There is no analytics cookie, no consent cookie, no preference cookie. The browser's session storage and local storage are not used. Standard HTTP cache headers are the only client-side state involved.
15. Children's data.
The watch is not addressed to children and is not knowingly subscribed by any reader under sixteen. The student half-price subscription is available to readers identified as university students through their student identifier; we do not knowingly accept correspondence from a child without a parent or guardian's involvement.
16. Profiling and automated decisions.
We do not run profiling. We do not run automated decisioning. Every reply is composed by a human; every subscription action and every data-service dispatch is taken by a human. The roster is curated by people.
17. Reader-mail and bulletin attributions.
The monthly bulletin's reader-mail section attributes letters by first name and institutional affiliation, or by first name and country where the writer has no institutional affiliation. Surnames, postal addresses and email addresses are never published. A subscriber who prefers not to be quoted should say so in the original message.
18. Changes to this notice.
This notice is reviewed every June. Material changes are notified to active subscribers by email at least thirty days before they take effect. The full history of changes since 2015 is held by the data officer and available on request.
19. Contact for any data question.
Marwan Saidy, data officer, Cartouche Loan Watch Press — Nile Repatriation Notes S.A.E.
Email: [email protected] · subject "data request"
Telephone: +20 66 3215 740 · Tuesday, Wednesday, Saturday 10:00–14:00 Cairo time
Postal: 22 Sharia Mohammed Ali, El-Manakh district, Port Said 42511, Egypt — mark "data officer".