Privacy Policy

This policy explains what Brands' Lab collects when you use brandslabeg.com, why, who sees it, how long we keep it, and the rights you have under Egypt's Personal Data Protection Law (Law 151 of 2020). It is written for customers and visitors. Employees have their own notice, shown at onboarding.

1. Who we are

Brands' Lab is a garment factory in New Cairo, Egypt. For the data described here, Brands' Lab is the controller. The website and its systems are built and operated on our behalf by The Agentic Lab, which acts as our processor under a written agreement. Questions about your data go to privacy@brandslabeg.com.

2. What we collect, and when

• When you request a quote: your name, your brand or company if you give it, your email address, and the brief you write: the services you need, the model, the fabric and who sources it, sizes, colours, print or embroidery, packaging, quantity, timing, references, your Instagram or website, and any notes. You may attach up to five files (artwork, tech packs, cutting papers, photos), each up to 100 MB. They are stored on our file storage in the European Union, are never public, and are opened only by Omar and by you through your own link.
• When you book a session: the same contact details, the time you pick, whether you chose Google Meet or a visit to the factory, and anything you add about the meeting.
• When you write to us: your name, your email address and your message.
• When you simply visit: the pages you open, the language you chose, the referring page, and a short-lived technical record used to protect the forms from abuse. We do not build a profile of you.
• When you report a found staff card: where you found it, what you write, and a way to reach you if you choose to leave one, a phone number or an email address. It is stored encrypted, reaches only the owner's mailbox, and is deleted after 30 days.

We never ask a customer for a phone number on the website. Contact is by email end to end.

3. What we do not collect

No payment card data is entered on the website. No national identity data is requested from customers. There are no advertising cookies, no tracking pixels and no fingerprinting.

4. Why, and on what legal basis

• To answer your request and prepare a quote: the steps you ask for before a contract.
• To hold and run the session you booked: your consent and the steps before a contract.
• To keep records of requests, quotes and orders: our legal obligations as a business.
• To keep the website and the forms safe from abuse: our legitimate interest in security.

You may withdraw consent at any time by writing to us; this does not affect what was lawfully done before.

5. Cookies and on-device storage

Essential storage only, unless you say otherwise: your language choice, your reading position, the draft of a form you have not sent yet, the session that keeps the factory's own people signed in on their pages, and the anti-abuse check on the forms. One thing is optional and off until you allow it: an anonymous page count. The sheet that asks, and the full list of every item, are in the Cookie and Storage Notice, where you may also change your answer at any time.

6. Who else sees your data

• Cloudflare, which hosts the website, its database and its file storage in the European Union, and runs the anti-abuse check.
• Google, for our mailboxes, for the Google Meet session when you choose it, and, when you allow it on the notice, for our page counts: our own server forwards each page view to Google Analytics with a daily code that cannot be traced back to you, your browser type and your network address, which Google uses only for the country reading. No Google cookie is set on your device.
• Resend, which delivers our transactional email.
• The Agentic Lab, as our processor, for building and supporting the system.

No one else receives your data unless the law requires it.

7. International transfers

Because our systems run on Cloudflare and Google, your data is stored and processed outside Egypt. We rely on the contractual safeguards those providers offer. The Egyptian Data Protection Centre's licensing procedure for transfers of this kind is open; we are preparing our application and we hold no licence today. We will update this section the moment that changes.

8. How long we keep it

• Quote requests, the files attached to them, and session bookings: for as long as we need them to answer you and to keep the record of what was asked and offered; we delete them when you ask us to.
• Requests that become an order: as part of the order file, 5 years.
• The text of the messages you send us: 6 months; the record that a message arrived stays.
• Technical logs: 90 days.
• The company ledger, which records that an event happened and never a name, an address or your words: kept permanently.

9. Your rights

You have the right to know what we hold about you and to access it, to withdraw your consent, to correct your data, to erase it, to restrict its processing, and to be told if a breach affects you. Write to privacy@brandslabeg.com. We answer within six working days, as the law requires. You may also complain to the Personal Data Protection Centre.

10. Security

Data travels encrypted. Sensitive fields are encrypted at rest. Access is limited by role. Our records are kept in a tamper-evident ledger. If a breach affects your data, we notify the Centre within 72 hours of becoming aware of it and you within three working days after that.

11. Children

Our services are for businesses. We do not knowingly collect data from anyone under 18.

12. Changes

Each version of this policy carries a date and a version number. A new version replaces the old one as a new document; we never edit a published version in place.

13. Contact

privacy@brandslabeg.com. Brands' Lab, New Cairo, Egypt.