Privacy Policy

This Privacy Policy explains how The Foundry ("we", "us"), the operator of the Lotus platform ("Lotus"), collects, uses and protects personal data when your company uses Lotus to run auctions. That processing is subject to Egypt's Personal Data Protection Law, issued by Law No. 151 of 2020 (the "Law"), and its Executive Regulations.

The Foundry, 22b Taha Hussein, Zamalek, Cairo, Egypt (privacy@thefoundry.run), is the controller of the personal data of seller and admin accounts, of billing and payment data, and of technical logs.

For buyer records and for the content of messages that your company enters or exchanges on Lotus, each seller company is the controller of its own buyers' personal data, and The Foundry is its processor: we process that data on the company's behalf, under our agreement with it and according to its instructions (Section 5 of the Terms of Service). A buyer who wants to exercise a right over that data should contact the seller company; requests that reach us are handled as described in Section 8.

• Account information for sellers and admins: full name, email, password (handled by our authentication provider — we never see or store passwords in cleartext), profile photo if provided, language preference.
• Buyer information entered by your sellers: name, phone number, tags, notes, onboarding documentation (e.g. photo of signed paperwork).
• Auction data: titles, station and location names, descriptions, prices, reserve prices, bid amounts and quantities, photos uploaded with auctions, lifecycle events (creation, activation, close).
• Message logs: the content and timestamps of WhatsApp messages exchanged between your sellers and buyers through Lotus, including bids, broadcasts, and seller replies.
• Billing information for your company: legal name, tax ID, billing email and phone, address, and the bank details you give us for refunds (bank name, account name, account number, IBAN, SWIFT).
• Payment records: the credit pack bought, the amount, the date, the bank-transfer or Paymob reference, and receipts uploaded for bank transfers. Card numbers are entered on Paymob's page and never reach us.
• Technical logs generated by the platform for operational and security purposes (request timestamps, error reports).

We process personal data only to operate the platform, and only for the specified purposes below. We do not sell personal data and do not use it for advertising. Each purpose rests on one of the cases set out in Article 6 of the Law:

• Creating and securing your team's accounts, selling and delivering credits, taking payments and paying refunds: the processing is necessary and intrinsic for the performance of a contractual obligation towards your company (Art. 6(2)).
• Keeping billing and payment records: performing an obligation regulated by law, namely Egyptian tax law (Art. 6(3)).
• Keeping technical logs, preventing misuse and keeping the Service secure: performing an obligation regulated by law where Law No. 175 of 2018 Concerning Information Technology Crimes applies to us (Art. 6(3)), and enabling the controller to perform its obligations and exercise its legitimate rights, unless this conflicts with the fundamental rights and freedoms of the data subject (Art. 6(4)).
• Storing buyer records, routing WhatsApp messages between sellers and buyers, recording bid history and showing metrics on the dashboard: we do this as processor, on the seller company's instructions. The seller company, as controller, must rest this processing on one of the cases in Article 6, such as the data subject's consent to the processing for one or more specified purposes (Art. 6(1)) (see Section 1).

Where processing relies on consent, the controller keeps a record of when and how the consent was given and of any withdrawal of consent. For buyers, the seller company keeps that record (Section 4 of the Terms of Service); Lotus stores every message exchanged with a buyer (Section 4), including any message in which the buyer withdraws consent.

Lotus uses Meta's WhatsApp Business API to send and receive auction-related messages on your company's behalf. Buyers participate by messaging your company's WhatsApp number. Each message — inbound or outbound — is stored on Lotus for auditability.

We rely on the following service providers, each of which processes personal data for us as a processor and is bound by its own data-protection obligations: Clerk (authentication), Convex (database and serverless functions), Vercel (web hosting), Sentry (error monitoring; receives technical error reports), Meta Platforms, Inc. (WhatsApp Business API), and Paymob Solutions S.A.E. ("Paymob", card payment processing). For a card payment we send Paymob the paying admin's first and last name, email and phone, and the amount. Card details are entered on Paymob's own page and never reach our servers; we receive only the payment result and reference. We do not disclose personal data to any other third party, and we disclose it to public authorities only on a reasoned order from a competent judicial authority, or to perform an obligation regulated by law.

Personal data on Lotus is stored and processed outside Egypt, on the infrastructure of the service providers listed in Section 5, each of which is needed to provide the Service. We share with each provider only the personal data it needs for its role, always over encrypted connections, and each processes it only on our behalf. We do not sell or rent personal data, and we do not make it available to any other third party. Under Article 14 of the Law, transferring personal data to a foreign country, or storing or sharing it there, requires a level of protection not lower than that set out in the Law and a licence or permit from the Personal Data Protection Center; we will publish the details of that licence or permit here once it is issued.

Personal data is not retained for longer than is necessary to fulfil the purpose specified for it. Auction data, message logs and buyer records are retained for the duration of your company's account. Account information for sellers and admins (name, email, profile photo, language preference) is kept while your company's account is active. When a user is removed, their login is erased and their account is deactivated, but their name, email, profile photo and language preference stay in your company's records (for example, on past auctions) until your company's data is erased, except where a name must stay in billing and payment records. When a seller deletes a buyer, the buyer's record is erased immediately; the buyer's past bids and messages stay in your company's auction history, shown as "Deleted buyer", and an uploaded onboarding document is erased when your company's data is erased. Erasure of an entire company's data can be requested in writing by a company admin via the contact below. Billing and payment records are kept for at least five years, as the Unified Tax Procedures Law (Law No. 206 of 2020) requires, even after your company's account is closed; because of that legal obligation we cannot erase them earlier on request. Technical logs: where Law No. 175 of 2018 applies to us as a service provider, system logs are kept for a continuous period of 180 days, as Article 2 of that Law requires; otherwise they are kept only as long as needed to run and secure the platform.

Under Article 2 of the Law, as a data subject you have the right to:

• know the personal data about you held by any holder, controller or processor, and review, access or obtain it;
• withdraw your prior consent to the retention or processing of your personal data;
• the correction, editing, erasure, addition or updating of your personal data;
• limit the processing to a specified scope;
• know of any breach or violation of your personal data;
• object to the processing of your personal data or its results whenever it conflicts with your fundamental rights and freedoms as a data subject.

To exercise these rights, write to privacy@thefoundry.run; requests about your company's data as a whole must come from a company admin. We will respond within six working days of the date you submit your request, as Article 32 of the Law requires. The seller company is the controller of buyer data (Section 1), so buyers should send their requests to that company; if a buyer's request reaches us, we will pass it to the seller company and help it respond within the same period.

If you believe your personal data has not been handled lawfully, you have the right to submit a complaint to the Personal Data Protection Center.

Data is transmitted over TLS. Access to production databases is restricted to platform operators. Legacy per-company access tokens stored on the platform are encrypted at rest with AES-256-GCM. If a personal data breach occurs, we will report it to the Personal Data Protection Center within seventy-two hours and notify the data subjects affected within three business days of the date of that report, as Article 7 of the Law and its Executive Regulations require. Where the breach concerns buyer data that we process for a seller company, we will also inform that company without delay so that it can meet its own obligations.

Lotus uses a small number of strictly necessary cookies for authentication (set by Clerk) and to remember your selected language. No analytics or advertising cookies are used.

This policy may be updated as the platform evolves. We will post the updated policy at lot-us.bid/privacy with a new "last updated" date, and we will notify company admins by email before any material change takes effect.

The Foundry, 22b Taha Hussein, Zamalek, Cairo, Egypt. Email privacy@thefoundry.run for anything about your personal data. Our Data Protection Officer can be reached at privacy@thefoundry.run; the officer's details will be published here once registered with the Personal Data Protection Center. You can also reach us through our Contact page (lot-us.bid/contact) or by phone on +20 12 90011016.