Privacy Notice

1. Who we are

The data controller for personal information processed through this website is:

Nile Rail Pass Services L.L.C.
7 Tersa Street, Giza 12511, Egypt
Tax ID (ETA): 894-152-637 · Commercial Registry: 368420
Email: [email protected]
Phone: +20 2 3571 9264

We operate egypt-passes.xyz as an independent rail-planning information desk. We do not sell train tickets, process payments, or act as a travel agent. Our service is to answer rail-route enquiries submitted through the contact form on this site.

2. Legal framework

We process personal data in accordance with Egypt's Personal Data Protection Law No. 151 of 2020 (PDPL) and its Executive Regulations, which came into force in October 2023. Where we interact with residents of the European Economic Area, we additionally apply the principles of the General Data Protection Regulation (GDPR, Regulation EU 2016/679) as a matter of good practice.

Under Egyptian PDPL, Nile Rail Pass Services L.L.C. is classified as a data controller. We have a data processing register maintained internally and available on request from the desk email above.

3. What data we collect and why

We collect only the data you voluntarily submit via the contact form on contact.html. There is no background data collection, no behaviour tracking, and no analytics platform on this site.

The specific fields and the reason each exists:

Field	Why we ask for it
Full name	To address you correctly in our reply and attach the response to the right enquiry thread.
Email address	The channel through which we send your rail plan. We do not use it for any other purpose.
Cities & dates	The core input for preparing a rail itinerary. Without a route, we cannot give useful advice.
Interested plan	Helps us frame the plan at the right scope (single leg, multi-city loop, or group booking).
Free-text message	Any additional context you choose to share — group size, time preferences, budget notes.

We do not ask for, and do not want, sensitive personal data such as payment card numbers, passport details, national ID numbers, or health information. If you include such data in the free-text message field, we will not store it beyond what is needed to reply and will ask you to send it through a more secure channel if it is truly necessary.

4. Legal basis for processing

Under Egyptian PDPL Article 4 and GDPR Article 6, we rely on the following lawful bases:

• Consent — you tick the consent checkbox on the contact form before submitting. This is the primary basis for processing your enquiry data.
• Legitimate interest — retaining a record of correspondence for a reasonable period so that we can refer back to it if you follow up. Our interest in keeping business correspondence does not override your privacy rights; you can ask us to delete records at any time.

You may withdraw your consent at any time by writing to [email protected]. Withdrawal does not affect the lawfulness of processing that occurred before you withdrew.

5. How we use your data

The personal data you submit is used for one purpose only: to read your rail enquiry and compose a relevant response. Specifically:

1. We read your name, email, and message fields to understand the enquiry.
2. We use your cities, dates and plan preference to prepare the rail itinerary.
3. We send the rail plan to the email address you provided.
4. We retain the email thread as a business record in case you reply with follow-up questions.

We do not use your data to build audience segments, infer interests, or send you anything beyond the reply to your specific enquiry. There is no newsletter, no re-engagement campaign, and no automated decision-making applied to your submission.

6. Data retention

We keep email correspondence, including the original form submission, for 15 months from the date of your last message in the thread. After that period, the thread is permanently deleted from our mail system. This duration gives us a reasonable window to handle follow-up questions within the same travel season and the next, without holding data indefinitely.

If you would like your records deleted sooner, write to [email protected] from the address you used when contacting us, and we will confirm deletion within 10 working days.

7. Who receives your data

Your data is not sold, rented, or traded. It is not shared with advertising networks, data brokers, or third-party analytics providers. The only parties who may handle it are:

• Our mail provider — we use a professional hosted email service to receive and send messages. The provider processes email content as a data processor acting on our instructions and is bound by a data-processing agreement.
• Our web hosting provider — the form submission is transmitted over HTTPS to our server. The hosting provider stores the website files and logs standard server access records (IP address, timestamp, page requested) for security purposes only, with a retention of 30 days.
• Regulatory bodies — if compelled by a lawful order from the Egyptian Personal Data Protection Centre (PDPC) or a competent court, we may be required to disclose records. We would notify you of any such request to the extent permitted by law.

There is no transfer of your personal data to any third-party commercial entity for their own use.

8. International data transfers

Our primary operations are based in Egypt. Our mail provider may route messages through servers located in the European Economic Area or the United States. In either case, the provider applies standard contractual clauses or equivalent safeguards recognised under GDPR Article 46. For EEA residents, this means your data is handled with a level of protection consistent with EU standards even when it passes through servers outside the EEA.

We do not knowingly transfer personal data to countries without an adequate framework for data protection without first informing you and obtaining your explicit agreement.

9. Cookies and tracking

This website does not use advertising cookies, tracking pixels, analytics cookies, or third-party scripts that set persistent identifiers. We run no audience-measurement platforms, no social-network conversion trackers, no tag-injection containers and no app-telemetry services of any kind.

Your browser may store a small session-level cookie to support the contact form's submit flow — this is a short-lived technical cookie that expires when you close your browser tab and carries no personal identifier. It is not readable by any party other than this site and is not used to track you across sessions or other websites.

If your browser settings require a cookie consent notice, you can accept or decline the technical session cookie without affecting your ability to read the content on this site. You will only need the cookie if you plan to submit the contact form.

10. Security

All data in transit between your browser and our server is encrypted using TLS (HTTPS). Our mail system uses encryption at rest. Access to enquiry data is limited to the staff members who handle rail-planning replies. We do not store form submissions in a database separate from the email thread — the email itself is the record.

Despite these measures, no internet transmission is completely risk-free. Please do not send payment card details, passport scans, or other highly sensitive documents via the contact form.

11. Your rights under Egyptian PDPL and GDPR

You have the following rights over the personal data we hold about you. To exercise any of them, write to [email protected] from the email address associated with your enquiry:

• Right of access — you can ask for a copy of the personal data we hold about you.
• Right to rectification — if any information we hold is inaccurate, you can ask us to correct it.
• Right to erasure — you can ask us to delete your data. We will do so unless we have an overriding legal obligation to retain it (for example, a court order).
• Right to restriction — you can ask us to suspend processing your data while a dispute about accuracy or the basis of processing is resolved.
• Right to withdraw consent — as noted in section 4 above, you can withdraw consent at any time. This does not affect processing that already occurred.
• Right to object — you can object to processing based on legitimate interest.
• Right to lodge a complaint — you may complain to the Egyptian Personal Data Protection Centre (PDPC) or, if you are an EEA resident, to the supervisory authority in your country of residence.

We will acknowledge your request within 5 working days and complete it within 30 days. If the request is complex we will let you know of any extension within the first 30-day period.

12. Children's data

Our service is directed at adult travellers and travel planners. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, please ask a parent or guardian to submit the enquiry on your behalf. If we discover that we have received data from a minor without appropriate consent, we will delete it promptly.

13. Changes to this notice

If we change how we handle personal data in any material way, we will update this page and revise the "Last revised" date at the top. We will not reduce your rights under this notice without clear prior notice. Continuing to use the site after a change constitutes acknowledgement of the updated notice.

We recommend checking this page periodically if you have submitted an enquiry or plan to do so in the future. The current version is always the authoritative one.

For information on Egypt's trains, classes and booking channels, see the Rail Network overview or the Booking Guide. To submit a rail enquiry, go to Contact.