MIDYAN privacy policy

1. Who is responsible for your data

Midyan Developments S.A.E., trading as MIDYAN, is the controller of personal data collected for the purposes described in this policy through midyan.com. Our registered address is Majarrah Business Complex, 26 of July Corridor, Building No. 3, Fifth Floor, Sheikh Zayed, Giza, Egypt. For privacy enquiries or requests, contact [PRIVACY_CONTACT_EMAIL]. Our data protection officer can be contacted at [DPO_CONTACT].

This policy covers our corporate website, enquiries initiated through its Contact or Media Centre pages, and job or graduate applications submitted through its careers channels, including related email correspondence. General and media enquiries can be sent to info@midyan.com; recruitment enquiries and applications can be sent to careers@midyan.com. Our head office is at Majarrah Business Complex, 26 of July Corridor, Building No. 3, Fifth Floor, Sheikh Zayed, Giza, Egypt. This policy does not replace the notices of independently operated schools, universities, hospitals or other services featured on the website. Nor does it cover a separate client portal or mobile application unless expressly stated in that service’s notice. Descriptions of campus CCTV, Wi-Fi, hospital records or data centres explain project facilities; they do not mean those systems collect data through this corporate website. Their operation requires the relevant operator’s own privacy information. A group relationship or project ownership alone does not determine who controls the data for each service.

We handle personal data in accordance with applicable Egyptian data protection requirements, including Law No. 151 of 2020 and its Executive Regulations. Reading this policy, browsing the website or submitting an enquiry does not automatically opt you into marketing.

2. Information we collect

Enquiries and business contacts: information you provide, such as your name, email address, telephone number, organisation, role, enquiry topic, project interest, message and relevant attachments, together with our correspondence. Topics may concern corporate matters, operator partnerships, investment and finance, government relations, consultants and contractors, or media. A media request may include your publication, requested materials, and response deadline. Only provide details relevant to your request.

Careers: your contact details, CV, employment and education history, qualifications, the role or graduate opportunity of interest, and other relevant information you choose to provide with an application, including an unsolicited application for future consideration. If references are requested, provide their details only when authorised to do so; we explain any further checks before carrying them out.

Technical information: information generated when your device connects to our website, such as IP address, browser and device details, requested pages, timestamps and security events. Optional analytics or advertising information is collected only where those tools are used and you have made the required choice.

Preferences and requests: records of your consent choices, withdrawals, communication preferences and requests to exercise privacy rights. Required fields are identified in the relevant form; without information necessary for your request, we may be unable to respond or assess an application.

Where information comes from: most information is supplied by you or generated by your use of the website. If an authorised representative or recruitment agency submits information about you, we handle it for the relevant enquiry or application and provide the information required by law about its source and intended use.

Information about another person: before providing a colleague’s or referee’s details, ensure you have authority to share them, make this policy available to that person, and provide only information relevant to the request. We remain responsible for establishing a lawful basis for our own processing.

3. Purposes and legal grounds

We use enquiry information to route your request to the appropriate MIDYAN team, respond to you, provide requested project or media materials, communicate about your request and assess potential business relationships. Sending an investment or finance enquiry does not enrol you in an investment service or authorise unrelated financial checks. Depending on the request, the applicable ground is your specific consent, a contractual necessity recognised by law, or a documented legitimate interest in managing business communications that does not override your rights.

We use application information to assess suitability for employment or a graduate opportunity and communicate about recruitment, on the applicable lawful ground identified at collection. Keeping a CV for unrelated future opportunities requires a separate choice where consent is the applicable ground.

We use limited technical information to deliver requested pages, detect misuse, troubleshoot faults and protect the website, relying on an applicable legal obligation or a legitimate interest in secure operation, subject to your rights. Optional analytics and advertising technologies require prior consent through cookie settings.

We send promotional communications only with the required prior consent. We also process necessary records to comply with legal obligations, manage privacy requests, and establish, exercise or defend legal rights. Where we rely on consent, you may refuse or withdraw it without losing access to unrelated services.

4. Marketing choices

You can choose separately whether to receive promotional communications through the channels offered at sign-up or whenever you are requested to subscribe. These choices are optional and are not a condition of sending an enquiry or applying for a job. Each marketing communication identifies its sender and offers an accessible, free way to opt out. You may also contact [PRIVACY_CONTACT_EMAIL].

Withdrawing marketing consent does not prevent us from responding to a request you initiated or sending necessary non-promotional communications. We retain the limited consent and suppression records necessary to demonstrate your choice and prevent further unwanted marketing, subject to applicable retention requirements.

5. Who may receive information

Access is limited to authorised people who need information for the stated purposes. Depending on the service used, recipients may include our hosting and IT providers, enquiry-management and communications providers, recruitment service providers, and professional advisers acting under appropriate obligations.

LS Investment Office and independently operated institutions do not automatically receive website enquiries or CVs. If your request concerns another group entity or an independent operator, we identify that recipient and the applicable purpose before passing on your details and obtain consent where required. Group membership alone is not permission for unrestricted sharing or marketing.

We may disclose necessary information to competent authorities where legally required, or to advisers and relevant parties in a genuine corporate restructuring or transaction, subject to a lawful basis, confidentiality and appropriate safeguards. Providers processing data for us must act under our instructions and applicable contractual protections.

6. Processing outside Egypt

Personal data may be accessed or hosted outside Egypt only where the applicable legal conditions are met, including required safeguards and any necessary authorisations or permits. A supplier contract or a visitor’s general use of the website is not, by itself, sufficient authorisation for a transfer.

The locations and providers relevant to this website are [HOSTING_AND_PROCESSING_COUNTRIES_AND_PROVIDERS]. The applicable transfer arrangements are [CONFIRMED_TRANSFER_BASIS_AND_SAFEGUARDS]. Contact [PRIVACY_CONTACT_EMAIL] for information about safeguards relevant to your data.

7. How long information is kept

We keep identifiable information only for as long as required for its stated purpose and applicable legal obligations. In setting retention periods, we consider the nature and sensitivity of the information, the consequences of retaining it, and whether the purpose can be achieved without identifying you. The website retention periods are: enquiries and business correspondence, [ENQUIRY_RETENTION_PERIOD_AND_TRIGGER]; unsuccessful applications, [APPLICATION_RETENTION_PERIOD_AND_TRIGGER]; optional future-opportunity CV records, [TALENT_POOL_RETENTION_PERIOD_AND_TRIGGER]; and technical/security logs, [LOG_RETENTION_PERIOD_AND_TRIGGER]. Cookie durations are listed in the Cookie Policy.

Marketing consent and opt-out evidence is retained for the legally required period, including at least three years where the electronic direct marketing rules apply. A legal claim or mandatory record-keeping requirement may justify retaining a limited record longer. When the purpose and applicable retention period end, we securely delete or anonymise the data; residual backups are removed under [BACKUP_DELETION_CYCLE] and are not reused for ordinary business purposes.

8. Your rights

Subject to applicable legal conditions, you may ask to know what personal data we hold about you, access or obtain it, correct or update it, delete it, restrict processing to a specific scope, object to processing or its results, and withdraw consent. Withdrawal does not retrospectively invalidate processing that was lawful before withdrawal. You also have rights to information about a personal data breach as provided by law.

Send your request to [PRIVACY_CONTACT_EMAIL], describing your relationship with MIDYAN and the right you wish to exercise. We may request proportionate information to verify your identity and authority. We respond within the applicable legal timeframe and explain any lawful limitation or refusal. We do not require unnecessary identity documents.

You may complain to Egypt’s Personal Data Protection Center through its official website, https://www.pdpc.gov.eg/, or exercise any other remedy available by law. You do not have to waive these rights to use our website.

9. Security

We apply technical and organisational measures appropriate to the nature of the data and the risks of processing. No online service is entirely risk-free. If a personal data breach occurs, we investigate and take appropriate action, including notifying the competent authority and affected people where and within the time required by law.

10. Children and sensitive information

This corporate website is not an admissions, student-record or patient-record system and is not intended to collect information from children under 18. Please do not submit children’s information, health records, financial account details or other sensitive information through general website forms. Where such processing is necessary for a separate service, a dedicated notice, lawful process and any required consent or authorisation must apply.

If you believe a child has submitted information through this website, or sensitive information has been sent in error, contact [PRIVACY_CONTACT_EMAIL] so we can assess and address it promptly.

11. Cookies, downloads and external services

See the Cookie Policy for information about cookies, similar technologies and preference controls. Reading news, project updates or sustainability information, and downloading a publicly available file, does not by itself subscribe you to marketing. A request for a page or file may still generate the limited technical logs described above. If a download requires contact details, the collection notice explains the purpose and any optional marketing choice. Links to LS Investment Office, Alexandria International Academy (AIA), Mediterranean University In Alexandria (MUA), Google Maps or independent media coverage lead to services governed by their own privacy notices. Following a link may disclose technical information, such as your IP address and referring page, to the destination as part of the connection. It does not itself authorise MIDYAN to forward your enquiry or CV. Where an embedded service uses optional tracking, it remains inactive until the relevant consent is given.

12. Updates and contact

We publish changes here with an updated date and provide further notice of significant changes when appropriate or legally required. If a new purpose requires fresh consent, we request it before proceeding; a policy update does not create that consent.

Privacy contact: [PRIVACY_CONTACT_EMAIL]. Data protection officer: [DPO_CONTACT]. Postal address: Majarrah Business Complex, 26 of July Corridor, Building No. 3, Fifth Floor, Sheikh Zayed, Giza, Egypt.