1. Who we are
Heritage Conservation Review L.L.C. ("we", "us", "the newsroom") is an independent publishing company registered in Egypt under Commercial Registry number 357942, with its registered office at 6 Brazil Street, Zamalek, Cairo 11211, Egypt. Our Tax ID (ETA) is 794-625-138. We publish editorial content about museum conservation, restoration projects and heritage exhibitions at egypt-museums.sbs. We are the data controller for the personal information described in this policy.
If you have a question about this policy or about the data we hold, write to us at [email protected] or call +20 2 2736 4180 (Sunday–Thursday, 10:00–17:00 Cairo time).
2. The legal framework that applies to us
We operate under Egyptian Data Protection Law No. 151 of 2020 and its executive regulations. To the extent that we receive data from individuals residing in the European Economic Area or the United Kingdom, we also apply the relevant provisions of the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the UK GDPR. Where the standards overlap, we apply whichever affords the individual the stronger protection.
Under these frameworks, we are required to have a lawful basis for processing your personal data, to be transparent about how we use it, to keep it only as long as necessary, and to honour your rights to access, correction and, where applicable, erasure. The sections below explain how we meet each of these obligations in practice.
3. What data we collect and why
We collect personal data in two distinct contexts: through our editorial contact form and through newsletter subscription. We describe each separately below.
3a. Editorial contact form
When you use the contact form on our contact page, you provide your full name, your email address, and — optionally — your institutional affiliation and an indication of your reader or subscription tier. You also write a free-text message. We store all of this information so that we can read, evaluate and respond to your message. The lawful basis for this processing is your explicit consent, given when you tick the consent checkbox before submitting the form, and the legitimate interest we have in managing editorial correspondence. If your message contains a correction request, we additionally have a legitimate interest in verifying and recording the exchange for our editorial accuracy records.
We do not ask for, and please do not volunteer, sensitive categories of personal data — including health information, political opinions, religious beliefs, or financial account details — through the contact form. If your message incidentally contains such information, we will delete the sensitive element and handle only the editorial substance of your enquiry.
3b. Newsletter and subscription communications
If you sign up for our newsletter or activate a subscription through our subscriptions page, we collect your name and email address. We use these to send you editorial digests, coverage summaries and, where applicable, subscription confirmation and renewal notices. The lawful basis is consent (for promotional communications) and, once a subscription is active, the performance of a contract. You may withdraw consent and unsubscribe at any time using the link included in every email we send.
4. Data we do not collect
We do not embed third-party analytics scripts on this website. We do not use any tracking pixels, session-recording tools, cross-site advertising identifiers, or behavioural profiling software. We do not pass your data to advertising networks. We do not set advertising cookies or third-party cookies of any kind. The only cookies this website places, if any, are operationally necessary first-party cookies required for the functioning of the contact form session — they carry no identifying value beyond the duration of the browser session and are not shared with any external party.
5. How we share your data
We do not sell, rent or trade your personal data. We share it with third parties only in the following limited circumstances.
Email service provider: To deliver newsletter and subscription emails, we use a transactional email provider. That provider processes your email address on our behalf under a data processing agreement and is contractually prohibited from using it for any purpose other than delivering messages we instruct them to send.
Legal requirements: We may disclose personal data if required to do so by Egyptian law, a court order, or a regulatory authority with lawful jurisdiction, and only to the minimum extent necessary to comply.
Business continuity: In the unlikely event that the newsroom's assets are transferred to another entity as part of a corporate transaction, personal data held at the time of transfer would form part of those assets. We would notify affected individuals before any such transfer and describe their options.
In all other circumstances, your data stays within the newsroom.
6. International data transfers
Our primary servers are located in the European Union. If data is transferred from Egypt to those servers, it moves under the contractual safeguards permitted by Egyptian Data Protection Law No. 151/2020. Where transfers involve individuals in the EEA, we rely on Standard Contractual Clauses approved by the European Commission. We do not transfer personal data to countries or territories whose data protection frameworks we have not assessed as adequate for the type of data concerned.
7. How long we keep your data
Contact form submissions are retained in our editorial records for 22 months from the date of submission. This period covers our standard editorial cycle and allows us to reference past correspondence if a related correction or follow-up arises. After 22 months, contact records are securely deleted unless an ongoing editorial relationship means the correspondence is still actively relevant — in which case we will inform you and confirm your agreement to continue holding the data.
Newsletter and subscription data is held for the duration of the subscription plus six months after cancellation or lapse, to allow for re-activation or subscription queries. Unsubscribe requests are processed within five working days, after which your email address is removed from all active mailing lists.
Where we are required by law to retain certain records for a longer minimum period — for example, financial records related to subscription payments — we keep only what is legally necessary and for only as long as the law requires.
8. Your rights
Under Egyptian Data Protection Law No. 151/2020 and, where applicable, the GDPR, you have the following rights in relation to your personal data:
Right of access: You may ask us to confirm whether we hold personal data about you and, if so, to provide you with a copy of it along with an explanation of how it is used.
Right to correction: If the data we hold is inaccurate or incomplete, you may ask us to correct or complete it.
Right to erasure: In certain circumstances — for example, where processing is based on consent and you withdraw that consent — you may ask us to delete your personal data. We will do so unless we are required to retain it by law or have another legitimate basis for continued processing.
Right to restriction: You may ask us to pause processing of your data while a dispute about its accuracy or the lawfulness of our use of it is resolved.
Right to object: Where we process your data on the basis of our legitimate interests, you have the right to object. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you may ask us to provide your data in a structured, machine-readable format so that you can transfer it to another service.
Right to withdraw consent: Where processing is based on your consent — for example, newsletter subscription — you may withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.
To exercise any of these rights, write to [email protected] with the subject line "Data rights request." We will respond within 30 days. If your request is complex, we may extend this period by a further 60 days and will notify you of the extension and the reason for it.
9. Cookies
This website does not set advertising, analytical or third-party tracking cookies. If a session cookie is placed during a form submission, it exists solely to maintain the technical state of that form session and expires when you close your browser. It does not identify you to any external party and is not used to build any profile of your behaviour on this or any other website.
Because we set no persistent cookies beyond what is technically necessary for core page function, no cookie consent banner is displayed. If our cookie practices change, we will update this policy and, where required by law, seek your consent before placing any new non-essential cookies.
10. Children's data
Our publication addresses an adult professional and informed-general readership. We do not knowingly collect personal data from individuals under the age of 18. Our contact form includes a consent checkbox which implies the capacity to give informed consent, and we rely on the declaration implicit in that act. If we discover that we have inadvertently received data from a minor, we will delete it promptly. If you believe a minor has submitted data to us, please contact us at [email protected] and we will investigate and act within five working days.
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or disclosure. These include encrypted data transmission (HTTPS), access controls limiting who within the newsroom can view contact records, and a defined internal procedure for responding to any suspected data breach. In the event of a breach that poses a risk to individuals' rights and freedoms, we will notify the relevant supervisory authority and, where required, the affected individuals without undue delay.
12. Complaints and supervisory authority
If you consider that our handling of your personal data has infringed your rights under applicable law, you have the right to lodge a complaint with the relevant supervisory authority. In Egypt, the supervisory authority established under Law No. 151/2020 is the Personal Data Protection Centre (PDPC). Individuals in the EEA may complain to the data protection authority of their country of residence. We nonetheless encourage you to contact us directly first — many concerns can be resolved without formal escalation, and we take every complaint seriously.
13. Changes to this policy
We may update this policy from time to time to reflect changes in the law, our data practices, or the services we offer. When we make a material change, we will update the "last updated" date at the top of this document and, where the change affects how we process data for existing subscribers or correspondents, notify those individuals by email. The version of this policy that was in force at the time your data was collected is the one that governs how we use that data, unless the law requires otherwise or you consent to a different arrangement.
We encourage you to review this policy periodically. The current version is always the one published at this URL. Older versions are retained in our internal records and may be requested by writing to the editorial address.
Questions about this policy? Contact the newsroom at [email protected]. Interested in our reporting? Start with restoration projects or current exhibitions. For subscription details, see our subscriptions page.