Last updated: 2026-11-01 · Version: 2.0
This policy explains what personal data we collect through qmmgroup.com (the "Site") and related channels, why, how we use and protect it, and your rights. It applies under the Saudi Personal Data Protection Law and its regulations for people in the Kingdom and Egyptian Personal Data Protection Law 151/2020 and its Executive Regulations for people in Egypt.
1. Who is responsible
Qmm Group (قمم جروب للتحويل الرقمي), 1003 Al Shorouk Tower, Abraj Al Khaleej Compound, Al Bahr Al Azam, Giza, Egypt 3724650. Privacy email: privacy@qmmgroup.com · Data protection officer: Eng. David, privacy@qmmgroup.com.. Data we process inside systems we build or run for clients is controlled by that client under its own policy and our contract.
2. What we collect
- Contact, quote, sample and waitlist forms: name, mobile number, email (optional), business name, your message, and for a waitlist the company size range.
- With every form or WhatsApp button: traffic source and campaign data (UTM), ad click identifiers (e.g. gclid, fbclid, ttclid, ScCid, li_fat_id), the page, and a short code in the prefilled WhatsApp message showing the ad or page (after you accept non-essential cookies, see #cookies).
- Consent log: what you agreed to, the consent wording and its version, date and time, and the form or channel.
- Assistant "Qaf": chat text and anything you choose to share; voice recordings only with your explicit consent.
- "Check your invoice" tool: the invoice file (XML) or QR image you upload and the result. Invoices may include other people's data (e.g. buyer name and VAT number).
- "Check your website" tool: site URL, your email for the report, scan results (public data about the site).
- Careers: name, contact details, CV and attachments. Correspondence: WhatsApp, email, calls.
- Browsing: IP address, device and browser, pages, visit time, cookies (#cookies). We do not ask for sensitive data (health, religion, financial or banking, biometric) and we do not knowingly collect data of people under 18 through the Site.
3. Why (purposes and basis)
Answering and following up your request by phone, WhatsApp or email, and preparing quotes, samples or reports (your request and consent to be contacted about it; pre-contract steps) · performing a contract · running Qaf (consent at chat start; separate explicit consent for voice) · running the invoice or website check (your request) · assessing job applications · offers and news: only with your separate, prior, explicit consent (an optional, unticked box), withdrawable at any time · site and campaign measurement (your consent to non-essential cookies) · security, abuse prevention and legal duties (legitimate interest, legal obligation). We never sell your data, and we never use an uploaded invoice for marketing.
4. Where it is kept and who sees it
Form and chat data is kept in QMM's internal admin system, with an encrypted backup on our own servers, in Germany (EU), protected by encryption in transit, need-to-know access, access logs, backups and anti-bot controls. Only our team and technical providers acting on our instructions (hosting, content delivery and protection, email, messaging, automated chat analysis and speech-to-text) access it, under confidentiality terms. Measurement and advertising platforms (Google, Meta, TikTok, Snap, LinkedIn) receive data only if you accept non-essential cookies: pages and events (e.g. a form sent), the click identifier, and one-way hashed contact data (e.g. phone, email) for ad measurement; they also process it under their own policies.
5. Retention
Leads that did not become clients: 48 months after last contact · consent log: 3 years from the consent's last use · Qaf chat text: 90 days · Qaf voice: deleted once transcribed · "Check your invoice" file: deleted within 24 hours · website-check reports: 24 months · job applications: 24 months unless you agree to longer · client and invoice records: contract term, then as tax and commercial law requires · security logs: 365 days · cookies: see #cookies. Then data is deleted or irreversibly de-identified.
6. International transfers
Some data may be processed outside your country (e.g. measurement and ad platforms after your consent, speech-to-text and automated analysis). Saudi Arabia: only under the Regulation on Personal Data Transfer outside the Kingdom and its safeguards, minimised. Egypt: only as Law 151/2020 and its regulations allow, with any required licence or permit.
7. Your rights and how to use them
To be informed; to access and get a copy; to correct; to have data destroyed when no longer needed (unless the law requires keeping it); to withdraw consent at any time; to object to direct marketing and stop it, easily and free; (Egypt) to object to processing or its results where it conflicts with your rights, and to be told of a breach.
- Stop offers: reply "STOP" (or «إيقاف») to any message, or use the unsubscribe link in emails. We stop the same day.
- Other rights: email privacy@qmmgroup.com or write "privacy request" on WhatsApp. We reply within 30 days (or any shorter statutory period) and may verify your identity first.
- Cookie choices: "Cookie settings" at the bottom of every page. You may complain to SDAIA (Saudi Arabia) or the Personal Data Protection Centre (Egypt).
8. Marketing
We send offers or news (WhatsApp, SMS, email, calls) only to people who ticked the separate optional box. Every message names us and has an easy, free opt-out. A number you used to contact us is used only to answer that request unless you opt in to offers.
9. Cookies and similar technologies
No non-essential cookie and no measurement or ad pixel runs before you consent. On your first visit you see "Accept" and "Reject" with equal prominence, plus "Customise".
| Category | Examples | Purpose | Duration | Consent? |
|---|---|---|---|---|
| Essential | session, language, anti-bot protection, remembering your consent choice | running and securing the Site | session up to 12 months | No |
| Analytics | Google Analytics 4 (via Google Tag Manager) | aggregated usage statistics | cookie lifetime up to 13 months; analytics data kept 14 months | Yes |
| Advertising and campaign measurement | Meta Pixel, TikTok Pixel, Snap Pixel, LinkedIn Insight Tag, Google conversions, stored campaign source and click ID | knowing which ad brought you, measuring results, showing relevant ads on those platforms | up to 13 months | Yes |
| How it works: measurement and ad data passes through a server-side container on our own servers, which limits what reaches the platforms and sends nothing before your consent. With consent, we may send events (e.g. "form submitted") with one-way hashed contact data for ad measurement. | ||||
| Change your choice any time via "Cookie settings" or your browser. Refusing analytics or advertising cookies does not stop you using the Site. |
10. Incidents
If a breach affecting your data is likely to harm you, we notify the competent authority within the statutory deadline and tell you without undue delay what happened, what we did and what you can do.
11. Changes
We update this policy when our practices or the law change and publish the date and version above; where a change needs fresh consent, we will ask for it.