LEAL PRIVACY POLICY

Version 1.0 | Effective: 6 November 2026 | Website: https://leal.world/ | Privacy contact: info@leal.world

This is a customer-facing draft. Statements concerning cookies, analytics, storage location and retention must be matched to the production implementation before publication.

1. Who operates Leal and how to contact us

Leal (leal.world) is currently operated by Ahmed Taia as an individual operator based in Hurghada, Egypt. Leal is not currently incorporated as a company. For privacy questions, access requests, complaints or withdrawal of consent, contact info@leal.world. A complete service address and any required registration or data-protection identifiers must be provided when legally required.

This Policy describes personal data that Leal may collect or process when you browse the website, make or manage bookings, communicate with Leal, or act for a participating tourism provider. It supplements, but does not replace, our Customer Terms and any agency contract.

2. Who the Policy covers

This Policy applies to website visitors, customers, lead travelers, additional travelers, people contacting support, agency contacts and authorized agency portal users. For activities operated by a tourism provider, that provider may separately determine how it processes information necessary to deliver the activity and should supply its own privacy information where required.

3. Personal information we collect

Information you give us can include full name, email address, telephone/WhatsApp number, nationality, booking reference, selected trip and date, number of seats, names and adult/child categories of other travelers, pickup preferences, communications, inquiries, complaints and any evidence or photographs you voluntarily send.

Information generated through bookings may include availability and hold records, booking and cancellation status, payment or refund status, limited transaction identifiers and customer-support notes. We may receive payment confirmation, card brand or limited masked payment information from XPay where available; Leal should not collect or store full card numbers or card security codes itself.

Website and security systems may collect IP address, approximate location inferred from IP, browser/device information, access logs, cookies or similar identifiers, and diagnostic data. The exact cookies and analytics services in use must be confirmed against the production website before publication.

For agency partners we may collect representative names, work contact details, business identification, licensing and tax documentation, listing materials, portal access credentials and payment settlement details where necessary.

4. Additional travelers and children

The lead traveler must have authority to provide necessary details of other travelers and should share relevant privacy information with them. Information relating to a minor is collected only where reasonably needed for an adult-authorized booking or the activity; any further sensitive information should be collected only when necessary and with appropriate lawful safeguards.

5. Why we use personal information

We process relevant data to display and compare experiences, check availability, create and confirm bookings, collect payments through XPay, facilitate refunds, coordinate with agencies, deliver pickup and operational communications, respond to support requests, investigate disputes, prevent fraud, keep appropriate transactional records, comply with law and maintain website security.

Where we send optional marketing or use non-essential tracking, we will obtain consent when required, provide practical opt-out controls, and keep that use separate from essential booking communications.

6. Legal bases and fair processing

Depending on the activity and applicable law, processing may rely on the data subject’s legally valid consent, performance of an agreement or pre-contractual request, a legal obligation, or another basis expressly permitted by Egyptian law. Leal will not rely on an unavailable legal basis merely because it is described in this notice.

We aim to collect only information reasonably necessary for a defined purpose and not use personal data for incompatible new purposes without an appropriate legal basis.

7. Booking and payment providers

XPay and its relevant payment partners process payment instructions, authorizations and refunds under their own security systems. Leal may receive transaction identifiers and payment status, but full card details should be entered into the payment provider’s secure interface rather than stored by Leal.

The relevant tourism provider may receive only booking details needed to provide the experience, such as traveler names, seat count, date, pickup instructions and limited contact details if operationally necessary. A provider may not use booking data for unrelated promotion merely because it received the data from Leal.

8. Other disclosures

Information may be shared with vendors that operate hosting, technical infrastructure, customer communication, fraud prevention and business administration; professional advisers subject to duties of confidentiality; and competent authorities where lawful or required. We do not sell customer personal information to advertisers.

We may share information in connection with a lawful transfer of the Leal operation to a future registered entity, subject to applicable notice, security and data-protection requirements.

9. International processing and transfers

Some technology providers or communication platforms may process data outside Egypt. Before an international transfer requiring approval, license, permit, additional safeguards or other conditions under Egyptian law, Leal will assess and comply with those requirements. This Policy is not a statement that all transfers are currently authorized.

10. Cookies and analytics

Essential cookies or similar technologies may be used for security, session continuity, checkout and technical functionality. Optional analytics, advertising pixels and personalization cookies must be identified and subject to any required notice and consent.

The website implementation team must inventory active cookies/SDKs, their providers and retention periods, and update this section or a dedicated Cookie Notice before those services are activated. Users can also control cookies through their browser, although disabling essential cookies may impair booking functionality.

11. Retention and deletion

Leal keeps information only for as long as needed for the purposes described above, including ongoing bookings, refunds, complaints, accounting, tax, fraud prevention and legally mandated recordkeeping. Different categories may have different retention periods.

When no longer necessary and no applicable retention obligation applies, information will be deleted, anonymized or securely archived as appropriate. A precise retention schedule will be established and reviewed against the actual systems and legal requirements.

12. Security

Leal will use reasonable organizational and technical safeguards appropriate to the nature and sensitivity of the information, including access restrictions, authorization controls and secure handling of transaction data. No internet service can guarantee absolute security.

Providers and technology vendors given access to personal information must be instructed to protect it and restrict its use to authorized purposes.

13. Your choices and rights

Subject to applicable law and exceptions, you may ask for information about processing, request access to or correction of inaccurate data, request deletion or restriction where available, withdraw a consent that was the basis for processing, or object or complain where the law permits. Withdrawal will not necessarily affect processing already lawfully performed or records Leal must retain.

Email info@leal.world with the subject “Privacy Request”. We may reasonably verify identity before disclosing or changing information and will respond within applicable legal periods.

14. Marketing communications

Booking confirmations, operational messages and safety updates are service communications rather than optional promotional messages. Marketing email, SMS, WhatsApp or remarketing requires an appropriate lawful basis and, where applicable, prior consent. You may unsubscribe or withdraw promotional consent without losing access to essential booking communications.

15. Automated decisions

Technical systems may validate availability, detect duplicate transactions or flag suspected abuse, but Leal does not intend to make solely automated decisions producing significant legal effects without any safeguards required by law. Contact us to challenge an incorrect booking or payment outcome.

16. Changes to this Policy

We may update this Policy when the website, legal requirements or actual data practices change. We will post a new version and effective date and provide further notice where law requires it. Materially new processing will not be justified by updating this Policy alone where separate consent or authorization is required.

17. Applicable law and other notices

This Policy is intended to be read consistently with Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations issued under Decision No. 816 of 2025, to the extent applicable. Other applicable consumer, payment, recordkeeping and communications laws may apply.

The English and Arabic versions are intended to communicate equivalent information. Where law requires an Arabic disclosure or determines a controlling language, that rule prevails.

18. Contact

Privacy contact: Ahmed Taia (individual operator of Leal) | City: Hurghada, Egypt | Email: info@leal.world | Website: https://leal.world/