Privacy Policy

DFTR, operating via dftr.dev from New Cairo, Cairo, Egypt, is the data controller for personal data collected through our website, trial signups, and billing relationships. For Customer Data processed inside your ERP workspace — your employees, customers, and vendors — you are the controller and DFTR acts as your processor under your instructions and our Data Processing commitments in the Terms.

Our Data Protection Officer can be reached at privacy@dftr.dev. We have notified our processing activities to the Personal Data Protection Center (PDPC) as required by Law 151/2020 and its Executive Regulations.

We collect only what we need to run your ERP, comply with Egyptian law, and improve the service. We never sell personal data, and we never use your business data for third-party advertising.

Every processing activity rests on a legal basis recognized by Law 151/2020. Where consent is the basis, you may withdraw it at any time without affecting prior lawful processing.

We use strictly necessary cookies for sign-in sessions, language and theme preferences, and load balancing — these cannot be disabled because the Platform will not function without them. Optional analytics cookies measure aggregated usage to improve performance and are set only after you accept the cookie banner.

You can change your choice at any time from your browser settings or by clearing site data; rejecting optional cookies never blocks core ERP features. We do not use cross-site advertising trackers.

Sharing is limited to what is necessary, covered by written processor agreements, and never includes selling data. Each recipient receives only the minimum data required for its task.

We keep personal data only as long as necessary for its purpose. Active Customer Data is retained for the life of your Subscription plus a thirty (30) day post-termination grace period for export. Backups rotate out within ninety (90) days.

Egyptian law requires longer retention for specific records: tax invoices, accounting books, and supporting documents must be kept for five (5) years under tax and commercial legislation. Where erasure is requested but a legal hold applies, we restrict processing to storage and legal compliance until the hold expires, then delete.

Under Law 151/2020 you hold enforceable rights over your personal data, and we honor equivalent requests from your authorized users. Submit any request to privacy@dftr.dev from your registered email; we verify identity, respond within thirty (30) days, and never charge for reasonable requests.

We protect data with defense in depth: TLS 1.2+ encryption in transit, AES-256 encryption at rest, isolated per-customer database schemas, role-based access with least privilege, audit logging of sensitive operations, and daily encrypted backups stored in the Cairo region.

Employees access production data only through audited break-glass procedures for support cases you authorize. In the event of a personal data breach likely to affect your rights, we notify affected controllers without undue delay and cooperate with PDPC reporting duties under Law 151/2020.

Your data is hosted in the Cairo region by default. Where a support tool or sub-processor necessarily processes limited data outside Egypt, we transfer only under a Law 151/2020 safeguard: your explicit consent, contract necessity, or binding contractual clauses with equivalent protection — and we list active sub-processors on request.

ETA submissions are domestic Egyptian government filings, not international transfers.

DFTR is a business platform and is not directed at individuals under eighteen (18). We do not knowingly collect children’s data; if you process family or minor employment records where Egyptian law permits (such as lawful apprenticeships), you must have the guardian consent and legal basis required by Law 151/2020 and the Labor Law.

If you believe a child’s data was provided to us without proper authority, contact privacy@dftr.dev and we will delete it promptly.

We update this Policy as our practices, sub-processors, or Egyptian regulations evolve. Material changes take effect thirty (30) days after publication and notice to account administrators; the effective date at the top always shows the current version.

Where a change materially expands processing based on consent, we seek fresh consent before applying it.

For privacy questions, rights requests, or breach reports, contact our Data Protection Officer at privacy@dftr.dev or DFTR, New Cairo, Cairo, Egypt. We acknowledge every request within five (5) business days.

If we cannot resolve your concern, you may lodge a complaint with the Personal Data Protection Center (PDPC) under the Ministry of Communications and Information Technology, or seek the remedies provided by Law 151/2020 before the competent Egyptian courts.