Last updated: [DATE] · Version 1.0
---
## 1. Who we are
Talaat Moustafa Group ("TMG", "we", "us", "our") operates the VSO mobile application ("VSO", "the App"). TMG is the data controller for the personal data described in this policy.
**Registered address:** [REGISTERED ADDRESS]
**Commercial registration number:** [CR NUMBER]
**Privacy contact / Data Protection Officer:** [DPO EMAIL]
This policy explains what personal data we collect through the App, why we collect it, who we share it with, how long we keep it, and what rights you have.
## 2. Browsing without an account
You can browse projects, unit models, and news as a guest. In guest mode we generate a random guest identifier stored on your device and resolve your country, so we can show relevant content and continue your session. This identifier is not linked to your name unless you later create an account.
You must create an account and verify your identity to meet a sales expert, book an appointment, reserve a unit, or make a payment.
## 3. What we collect
### 3.1 Information you give us
**Account and contact details** — full name, first and last name, mobile number and country code, email address, and password.
**Profile details** — nationality, gender, date of birth, marital status, number of children, education, occupation, and landline.
**Address** — country, governorate, city, district, street, building, floor, apartment, and area.
**Identity documents** — National ID number for Egyptian nationals, or passport number for non-Egyptian nationals, together with an uploaded image of that document. This is required to reserve a unit.
**Profile picture** — if you choose to upload one.
**Payment information** — bank transfer receipts and proof-of-payment files you upload. Card details are entered directly with our payment provider and are **not** collected or stored by TMG or by the App.
**Communications** — appointment details, your preferences and requirements discussed with a sales expert, call ratings and feedback, referral details, and any messages you send through Help & Support.
**Referrals** — the name and contact details of a person you refer. You must have their consent before sharing them with us.
### 3.2 Information collected automatically
**Device and technical data** — device model and operating system, app version, language and locale, and whether the device is physical or an emulator.
**Push notification token** — a Firebase Cloud Messaging (FCM) token used to deliver appointment reminders and meeting-start alerts to your device.
**Security signals** — the App checks for rooted, jailbroken, emulated, or proxied devices in order to protect your account and our systems, and blocks access where such conditions are detected.
**Usage and diagnostics** — screens viewed, features used, saved and compared properties, searches, crash reports, and error diagnostics.
**Connection data** — network status and IP address, processed as an ordinary part of delivering the service.
### 3.3 Camera, microphone, and other device permissions
The App requests the following permissions. You may refuse or withdraw any of them in your device settings, though some features will then not work.
| Permission | Why |
|---|---|
| Camera | Video meetings with a sales expert; capturing ID or profile photos |
| Microphone | Audio during video meetings |
| Photo library / files | Uploading ID images, profile pictures, and payment receipts |
| Notifications | Appointment reminders, meeting-start alerts, offers, payment updates |
| Face ID / Touch ID / fingerprint | Optional biometric sign-in |
| Calendar | Adding appointments to your calendar |
| Contacts | Optional, to help you share referral details |
| Bluetooth | Connecting headsets or audio devices during a call |
**Biometrics.** Biometric sign-in is verified by your device's own operating system. Your fingerprint or face data never leaves your device and is never sent to or stored by TMG.
### 3.4 Video meetings
Meetings with a sales expert take place over Zoom. During a call, your camera and microphone feed is transmitted to connect you with the representative.
Meetings may be recorded for quality, training, compliance, and record-keeping. **Where a meeting is recorded you will be told at the start of the call.** If you do not consent to recording, end the call and contact us at [SUPPORT EMAIL] to arrange an alternative.
## 4. Why we use your data, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Account, contact, password | Performance of a contract |
| Verify your identity before reservation | Identity documents, profile | Legal obligation; contract |
| Verify your phone or email by OTP | Mobile, email | Contract; security |
| Connect you to a sales expert (queue or appointment) | Account, appointment, camera/mic | Contract |
| Process reservations and payments | Profile, identity, payment receipts | Contract; legal obligation |
| Send appointment reminders and meeting alerts | FCM token, appointment | Contract |
| Send offers and marketing | Contact details, preferences | Consent (you may withdraw at any time) |
| Improve the App, fix crashes | Usage, diagnostics, device data | Legitimate interests |
| Protect accounts and prevent fraud | Security signals, device data | Legitimate interests; legal obligation |
| Meet legal, tax, and anti-money-laundering duties | Identity, transaction records | Legal obligation |
Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.
## 5. Who we share your data with
We do **not** sell your personal data.
We share it with:
- **TMG sales representatives and staff** — to serve you, hold your meeting, and process your reservation.
- **Zoom Video Communications** — video meeting infrastructure.
- **Google Firebase** — push notifications, remote configuration, and crash reporting.
- **Sentry** — error and performance diagnostics.
- **[PAYMENT GATEWAY]** — card payment processing. Card details go directly to the provider.
- **[CLOUD HOSTING PROVIDER — e.g. IBM Cloud]** — hosting of our servers and stored files.
- **Professional advisers, auditors, and authorities** — where required by law, court order, or regulation, or to establish or defend legal claims.
- **A purchaser or successor** — in the event of a merger, acquisition, or restructuring of TMG.
Each provider is bound to process the data only on our instructions and to keep it secure.
## 6. International transfers
Our servers are hosted in [HOSTING REGION — e.g. the European Union]. Some providers named above process data outside your country of residence. Where data leaves [JURISDICTION], we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision. You may request a copy of those safeguards at [DPO EMAIL].
## 7. How long we keep your data
| Data | Retention |
|---|---|
| Account and profile | While your account is active |
| Identity documents | Duration of the customer relationship, then as required by anti-money-laundering law — [X YEARS] |
| Reservation, contract, and payment records | [X YEARS] after the transaction, per tax and commercial law |
| Meeting recordings | [X MONTHS/YEARS] |
| Call ratings and feedback | [X YEARS] |
| Crash and diagnostic logs | [X MONTHS] |
| Guest identifier | Until the App is uninstalled or its data cleared |
| Marketing preferences | Until you withdraw consent |
After the applicable period we delete the data or anonymise it irreversibly.
## 8. Data stored on your device
The App stores the following locally on your device: your session token (in encrypted secure storage), the guest identifier and resolved country, language preference, biometric sign-in preference, cached profile and property content for offline viewing, and the push notification token.
Uninstalling the App removes this local data. It does not delete data held on our servers — for that, see section 10.
## 9. Security
We protect your data with encryption in transit (HTTPS), encrypted secure storage for session tokens on your device, access controls limiting staff access to what their role requires, and device integrity checks that block rooted, jailbroken, or emulated devices.
No system is completely secure. If a breach affects your rights, we will notify you and the competent authority as required by law. Tell us immediately at [SUPPORT EMAIL] if you suspect unauthorised access to your account.
## 10. Your rights
Subject to applicable law, you have the right to:
- **Access** — obtain a copy of the personal data we hold about you.
- **Rectify** — correct inaccurate or incomplete data. Most profile fields can be edited in the App. Note that identity details are locked after a payment is made and can only be changed by contacting us.
- **Erase** — request deletion of your data. You can delete your account from within the App, subject to OTP verification.
- **Restrict or object** — including objecting to processing based on our legitimate interests.
- **Portability** — receive your data in a structured, machine-readable format.
- **Withdraw consent** — at any time, for anything based on consent, including marketing.
- **Complain** — to [SUPERVISORY AUTHORITY — e.g. the Egyptian Data Protection Centre].
To exercise any right, contact [DPO EMAIL]. We respond within [30] days. We may ask you to verify your identity first.
**Important about deletion.** Deleting your account permanently removes your saved properties, searches, and personal information from the App. It does **not** cancel an active reservation, a payment obligation, or a signed contract, and we will retain records we are legally required to keep. Contact us before deleting if you have an active reservation.
## 11. Marketing
With your consent we send offers, project launches, and promotional messages by push notification, email, or SMS. You can opt out at any time by disabling notifications in your device settings, using the unsubscribe link in an email, or contacting [SUPPORT EMAIL]. Opting out of marketing does not stop service messages such as appointment reminders, meeting alerts, and payment confirmations.
## 12. Children
The App is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact [DPO EMAIL] and we will delete it.
## 13. Automated decision-making
Property comparison results and match scores are indicative tools that help you shortlist units. They are not automated decisions producing legal or similarly significant effects, and a human sales representative is always involved in any reservation.
## 14. Changes to this policy
We may update this policy. Material changes will be notified in the App or by email, and the "Last updated" date above will change. Continued use after an update means you accept the revised policy.
## 15. Contact
**Talaat Moustafa Group**
[REGISTERED ADDRESS]
Privacy enquiries: [DPO EMAIL]
General support: [SUPPORT EMAIL]
Phone: [SUPPORT PHONE]
You can also reach us through **Help & Support** in the App.
---