Employee Privacy Notice

Last updated: 30 October 2026

This notice explains how we collect, use and protect your personal data as an employee when you use the Waly HR portal at hr.walygroup.com and the Waly HR Android app (Google Play), and when you record your attendance on biometric devices. We do so in line with the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations issued by Ministerial Decree No. 816 of 2025.

1. Who we are

The party responsible for your data (the controller) is your employer, that is, the company you work for as named in your employment contract. It is one of the following companies:

Dr.Baker, an Egyptian limited liability company, Commercial Registry No. 4535 (Gamasa Investment Commercial Registry Office), Unified Registry No. 11090 02000 04535, Tax Registration No. 753-611-961, head office: Al-Sananiya, Old Ras El Bar Road, opposite the power station, Damietta Markaz, Damietta.
Hunters, an Egyptian limited liability company, Commercial Registry No. 2578 (Gamasa Investment Commercial Registry Office), Unified Registry No. 11090 01000 02578, Tax Registration No. 648-530-116, head office: Plot No. (17), Block (C), Phase 3, Industrial Zone, Gamasa City, Dakahlia.
Mkinah for Machinery and Equipment, an Egyptian limited liability company, Commercial Registry No. 3175 (Gamasa Investment Commercial Registry Office), Unified Registry No. 11090 01000 03175, Tax Registration No. 684-218-518, head office: Plot No. (8), Block (W), Phase 3, Industrial Zone, Gamasa City, Dakahlia.
WalyMart, an Egyptian limited liability company, Commercial Registry No. 3675 (Gamasa Investment Commercial Registry Office), Unified Registry No. 11090 09000 03675, Tax Registration No. 699-603-633, head office: Salah Salem St. and Dr. Abdel Azim Wazir St., opposite the Spinning and Weaving Factory, Damietta 1st District, Damietta City, Damietta.
Waly Group for Investment and Project Management, an Egyptian limited liability company, Commercial Registry No. 4652 (Gamasa Investment Commercial Registry Office), Unified Registry No. 11090 09000 04652, Tax Registration No. 754-531-694, head office: Salah Salem St., opposite the Spinning and Weaving Factory, Damietta 1st District, Damietta City, Damietta.

CloudPastry staff are employed by Hunters. The HR portal and its app are a shared HR system for these companies, operated on behalf of your employer and on its instructions. You can reach our data-protection contact about anything related to your data at: Email info@walygroup.com and phone +20 110 075 7356.

2. Data we collect and where it comes from

Identity and contact data: name, national ID number, date of birth, address, phone number and personal email.
Employment data: company, department, job, direct manager, employment contract and appraisals.
Personal documents: copy of your ID card, birth certificate, educational certificate, military-status certificate, health certificate, criminal-record certificate and other documents your employer requires.
Attendance: biometric attendance logs, leave and absence, missions and attendance-correction requests.
Biometric data: your fingerprint or face template registered on biometric devices (BioStar and ZKTeco) at work sites.
Location data: your geographic location from the browser or app when you open certain portal pages, if location checking is enabled, and the country derived from your IP address at sign-in.
Pay and entitlements: payslips, bank account number, loans, penalties and bonuses.
Requests and complaints: leave requests, complaints, IT support requests and applications for internal vacancies.
Sign-in and usage data: username, sign-in history, IP address, device and browser type.

We receive this data from you directly, from your file with your employer, from the biometric devices, and from your direct manager and the HR department when they approve requests and appraisals.

3. Why we use your data

To manage the employment relationship and your personnel file.
To record attendance and calculate pay, leave and absence.
To pay salaries and loans and deduct instalments, and to apply the penalties and bonuses rules.
To approve requests and missions and to carry out performance appraisals.
To meet the employer's obligations under labour, tax and social-insurance law.
To protect our systems and check that sign-in happens from permitted places.
To answer IT support requests and complaints.

4. Legal basis for processing

We process your data on one of the following bases:

Performance of the employment contract: to manage the employment relationship and pay you.
Legal obligation: what labour, tax and social-insurance law requires.
Legitimate interest: to protect our systems and control attendance, without overriding your rights.
Explicit written consent: required by law for sensitive data, including biometric data; we are collecting it now.

5. Sensitive data

Some of your data is sensitive under the law: biometric data (fingerprint or face), health data (such as the health certificate and sick-leave documents), financial data (such as salary, bank account and loans) and the criminal-record certificate. We use biometric attendance at our sites. Your fingerprint or face template is registered on the biometric devices and their system; the HR portal receives from that system only the movement log: biometric ID, date, time and device. Only people who need sensitive data for their work can see it. The law requires your explicit written consent, and a licence from the Personal Data Protection Center, for processing this sensitive data. We are collecting employees' consents now, and we have applied or are applying for the licence. If you object to the use of biometrics, tell the HR department of your company. Until an alternative method is agreed, biometric attendance remains the method in use.

6. Sharing your data

We do not sell your personal data. We share it only as needed with:

The HR department, the finance department and your direct manager in your company, each as far as their work requires.
Government bodies where the law requires it, such as the National Organization for Social Insurance and the Egyptian Tax Authority.

We also share it with service providers that process data on our behalf, under confidentiality obligations:

Hetzner: hosting of our servers, databases, email and backups (Germany and Finland).
Backblaze: storage of encrypted backup copies of our data (United States).
Google (Google Fonts): loading the website fonts; your device's IP address reaches Google when a page opens (United States).
Google (Google Play): distributing and updating the Android app (United States).
Anthropic (Claude): an artificial-intelligence model that helps the IT team handle support requests (United States).
Telegram: internal alerts to the support team about IT support requests.
ip-api.com and ipapi.co: finding the country of an IP address to check that sign-in happens from inside Egypt.

7. Transfers outside Egypt

Your data is stored on servers outside the Arab Republic of Egypt and is transferred to the following countries:

Germany and Finland: the Hetzner servers that run our systems, and their backups.
United States: encrypted backup copies at Backblaze, and the services of Google and Anthropic.

Some of the service providers listed may also process data in other countries where their servers are located. The Personal Data Protection Law and its Executive Regulations require a licence or permit from the Personal Data Protection Center for these transfers. We have applied for it, and until it is issued we transfer only what is needed to provide the service.

8. How long we keep your data

We keep your data for as long as needed for the purpose we collected it for, and then for the periods required by law, such as tax and commercial law and labour and social-insurance law. After that we delete the data or remove what identifies you.

9. Security

We take technical and organisational measures to protect your data against loss, misuse and unauthorised access, including:

Encryption of the connection between your device and our websites over HTTPS.
Administrative access to our servers over SSH is by key only.
Encrypted backups.
Access rights set for each user according to their work.

10. Your rights

The law gives you the following rights:

To know what data we hold about you, to see it and to obtain it.
To withdraw your consent to processing at any time.
To have your data corrected, changed, added to or updated.
To have your data erased.
To restrict processing to a specific scope.
To object to processing or its results where it conflicts with your fundamental rights and freedoms.
To be informed of any breach of your personal data.

Withdrawing consent does not affect processing carried out before it. We may keep some data after an erasure request where the law requires us to.

11. How to exercise your rights

Send your request to the HR department of your company, or to our data-protection contact at: Email info@walygroup.com and phone +20 110 075 7356. We may ask you for proof of identity before we act on a request, so that we do not give your data to someone else. We answer your request within six (6) working days of receiving it.

12. Complaints

If you believe our processing of your data breaks the law, you have the right to complain to the Personal Data Protection Center in Egypt. We ask you to contact us first so that we can try to solve the problem.

13. Data breach notification

If a breach of your personal data occurs, we notify the Personal Data Protection Center within seventy-two (72) hours of becoming aware of it, and we also notify you if you are affected, as the law requires, explaining what happened and what we have done.

14. Cookies and measurement tools

The portal uses only essential cookies, to keep you signed in and protect your session. It uses no analytics or advertising tools. The portal loads Google Fonts from Google's servers, so your device's IP address reaches Google when a page opens.

15. Changes to this notice

We may change this notice from time to time. We publish the updated version on this page with its "Last updated" date. If a change is material, we tell you about it in a suitable way before it takes effect.

16. Contact

For any question about this notice: the HR department of your company, or our data-protection contact at: Email info@walygroup.com and phone +20 110 075 7356.