OSTA Privacy Policy

1. Who is responsible for your data?

The Osta platform is operated by El Sane Group — ELSANE Group, which is the party responsible for determining the purposes for which data related to Osta's services is used, in accordance with applicable laws.

2. Data we may collect

Depending on your account type and how you use the service, data may include: name, phone number, email, profile photo, addresses, service location, location data, past and current orders, conversations, photos and files, ratings, complaints and warranties, financial transaction data, and device and session data.

For service providers and establishments, data may include identity documents and the professional or commercial documents needed for verification.

3. Why do we use data?

Osta uses data to operate accounts, verify service providers, fulfil orders, match, price, schedule, track, chat, send notifications, process payments and refunds, provide warranties and support, prevent fraud, ensure security and improve the Platform's performance.

Data is not used for purposes incompatible with the purpose for which it was collected, except on the required legal basis.

4. Location

The customer's location is used to determine where the service is performed, calculate distance and help the service provider get there.

The technician's location may be used during an active order or while heading to the customer to provide tracking, navigation and matching.

Osta does not aim to track users without an operational need related to the service.

Users can manage location permissions from their device settings, but refusing some permissions may stop some app features from working.

5. Sensitive identity data

Osta may request official data or documents from service providers to verify their identity.

This data is handled with a higher level of protection, under defined access permissions, and is stored encrypted.

The ID card or national ID number is not shown to the customer merely to carry out an order.

6. Payment data

When electronic payment is used, sensitive payment data is processed by the approved payment provider according to the payment method.

Osta keeps the information needed to document the transaction — such as the amount, status, reference and link to the order — without storing full card details.

7. Data sharing

Osta does not sell users' personal data for advertising purposes.

The minimum necessary data may be shared with: the service provider assigned to the order, payment gateways, hosting and storage providers, map services, messaging and notification services, crash-analysis and security services, and government or judicial authorities where there is a valid legal obligation.

Shared data is minimised to what is necessary to achieve the purpose.

8. Sharing customer data with the technician

A technician's registration on Osta does not give them access to all customers' data.

Only the data needed to perform the service is shown, according to the order's status and the technician's role.

The service provider must not keep customer data, use it for purposes unrelated to the service, or share it with anyone unauthorised.

9. Storage outside Egypt

Osta may use cloud or technical services operating from data centres outside the Arab Republic of Egypt.

Cross-border data transfers and processing are carried out in accordance with the applicable legal requirements and the measures needed to protect the data.

10. Retention period

Osta keeps data for as long as needed to operate the account, fulfil orders, settle payments, complaints and warranties, and meet legal obligations.

The period may vary by type of data; financial and tax records are subject to the retention periods required by law.

When the data is no longer needed, it is deleted, anonymised or restricted, depending on the case and the law.

11. Data protection

Osta applies appropriate technical and organisational measures to protect data from unauthorised access, use or modification.

These measures include encryption, access controls, audit logs, secure storage, system monitoring and backups.

However, no electronic means can be guaranteed 100% risk-free, so protection measures are continuously reviewed and improved.

12. User rights

Under the applicable laws, users may request access to their data, correct or update it, object, withdraw certain consents, or request deletion of their account and data where the law allows.

13. Delete account

Osta provides a way to request account deletion from inside the app and through a dedicated web page.

If the account has an active order, a pending financial transaction, a dispute or an outstanding legal obligation, some deletion steps may be postponed until the reason for keeping the data ends.

After that, data that there is no longer a legitimate reason to keep is deleted or anonymised.

14. Marketing and notifications

Osta may send necessary notifications about orders, accounts, security, payments and warranties.

Marketing messages are subject to the user's available choices and consents under the applicable laws.

Users can turn off types of notifications and marketing from the app or device settings where available.

15. Cookies

The Osta website may use cookies or similar technologies to run sessions, save settings and improve security and performance.

The required choices are offered to users according to the type of technology and the applicable law.

16. Children's privacy

Osta is not intended for independent accounts by anyone under 18, and does not knowingly collect their personal data for that purpose.

17. Security incidents

If Osta discovers a security incident affecting personal data, it is investigated and contained, damage-limitation measures are taken, and the competent authorities or affected people are notified where required by law.

18. Policy updates

This privacy policy may be amended because of service development, changes to the systems used, or legal requirements.

Users will be notified of material changes appropriately.

19. Contact

Users can contact Osta about privacy, their account or exercising their rights through the official support channels shown at the bottom of this page.