Information Security Policy

1. Commitment to Information Security

Qadaya Misr, a digital platform owned by Shubeik for Services and Consultancy, is committed to implementing technical, organizational, and security controls designed to protect the platform's systems, data, and information against unauthorized access, unlawful use, alteration, destruction, disclosure, or loss.

The platform affirms its commitment to operating in accordance with the legislation in force in the Arab Republic of Egypt and respecting applicable requirements relating to personal data protection, information security, and the prevention of information technology crimes, as applicable.

Maintaining the confidentiality, integrity, and availability of information is a fundamental principle governing the platform's administration, operation, and development of its digital services.

2. Scope of This Policy

This Policy applies to Qadaya Misr's systems, digital services, and information processed through the platform, including:

• The website, technical infrastructure, servers, and databases.
• User accounts, administrative accounts, and internal systems.
• Personal data, contact information, and account information.
• Consultation requests, correspondence, and legal documents submitted through the available services.
• Data relating to lawyers and specialists registered on the platform.
• Technical and security logs and backup copies.
• Employees, contractors, and service providers whose roles authorize them to access the platform's systems or data.

All parties authorized to access information must maintain its confidentiality and use it only within the scope of their assigned duties and granted permissions.

3. Confidentiality of Information and Data Protection

Qadaya Misr treats the information it holds as an asset requiring protection and seeks to prevent unauthorized access, use, or disclosure.

The protection measures include:

• Restricting access to information to authorized individuals according to their roles.
• Preventing the use of data for purposes incompatible with the lawful purpose for which it was collected or processed.
• Protecting personal information and legal documents against unauthorized disclosure.
• Taking appropriate measures to protect data during transmission, storage, and processing.
• Limiting data collection and retention to what is necessary to provide services and fulfill legal obligations.
• Regulating the sharing of information with lawyers, specialists, and service providers according to the nature of the service and the applicable legal basis.

Employees and contractors must not access users' data or documents out of curiosity, for personal purposes, or for any reason outside their authorized responsibilities.

4. Access Control and Permissions

The platform's administration follows the principle of granting the minimum access privileges necessary to perform assigned duties, thereby reducing the risk of unauthorized access or misuse of administrative accounts.

Depending on the systems in use, the controls may include:

• Defining user and employee permissions according to their responsibilities.
• Protecting administrative accounts and login credentials.
• Reviewing access permissions when duties change or an employment or contractual relationship ends.
• Revoking unnecessary access when it is no longer required.
• Prohibiting the sharing of passwords or login credentials between individuals.
• Using additional authentication measures for sensitive accounts where available and appropriate.
• Reviewing access logs and administrative activities where supported by the systems.

Accessing any account, system, or database without authorization, exceeding granted permissions, or attempting to obtain information that is not available to the account holder is prohibited.

5. Protection of Systems and Technical Infrastructure

Qadaya Misr's administration is committed to taking appropriate measures to protect the technical systems used to operate the platform against known security risks, in proportion to the nature of the services and the level of risk.

These measures include efforts to:

• Update systems, software, and technical components in accordance with security requirements.
• Address security vulnerabilities and technical issues that may affect the confidentiality, integrity, or availability of data and services.
• Limit unauthorized access attempts and misuse of accounts.
• Protect databases, service interfaces, and administrative systems.
• Review security settings and permissions when significant changes are made.
• Use appropriate protection measures for networks, servers, and data.
• Test and periodically review security procedures according to the nature of the systems and available resources.

No person may conduct penetration testing, security scanning, or vulnerability exploitation against the platform's systems without prior written authorization from an authorized representative.

6. Protection of Legal Documents and Consultation Requests

Given the nature of Qadaya Misr as a digital legal platform, consultation requests and submitted documents may contain personal data or information relating to disputes and judicial proceedings.

The platform's administration therefore seeks to implement appropriate safeguards to protect such data and limit access to it or its circulation beyond legitimate needs.

These safeguards include:

• Restricting access to requests and documents to authorized individuals.
• Using data only to the extent necessary to process a request or provide the requested service.
• Avoiding the transmission of sensitive documents through inappropriate or unauthorized channels.
• Maintaining confidentiality when information is made available to a lawyer or specialist selected by the user.
• Disclosing information to third parties only where an appropriate legal basis or required authorization exists.
• Securely disposing of data when its retention purpose has ended, unless retention is required by law or justified by a legitimate need.

Users must not submit documents or data relating to third parties without a legitimate basis and should redact information that is unnecessary for providing the service whenever possible.

7. Content Management and Administrative Permissions

Qadaya Misr's administration is responsible for preparing, reviewing, and approving the content published on the website. Users are not permitted to publish general materials or directly modify approved content unless the platform expressly provides a service designed for that purpose.

Content preparation and approval permissions are managed through authorized accounts. The platform seeks to protect these accounts against unauthorized use and maintain the integrity of published content and administrative change records where such records are available.

Administrative content-management permissions must not be used to alter, delete, or replace information for unauthorized purposes. Administrative access must not be exploited to obtain or disclose users' data beyond the limits of legitimate work.

8. Backups and Service Continuity

The platform's administration seeks to implement appropriate measures to maintain service continuity and minimize the effects of technical failures, data loss, or security incidents.

Depending on the system architecture, these measures may include:

• Creating backup copies of important data and systems.
• Protecting backups against unauthorized access or tampering.
• Establishing procedures for restoring data and services following a failure.
• Reviewing the recoverability of backup copies when necessary.
• Developing procedures for handling service interruptions or failures in technical infrastructure components.

Recovery capabilities depend on the nature and capabilities of the systems and the results of operational testing. The existence of backups alone does not guarantee that all data or services can be restored under every circumstance.

9. Security Monitoring and Logs

The platform may record and review technical and administrative activities necessary to protect its systems, verify lawful use, detect unauthorized access attempts, and investigate technical failures and security incidents.

Such records may include login and logout events, administrative changes, unsuccessful access attempts, and relevant technical events.

These logs are used for legitimate security, operational, and investigative purposes. Access to them is restricted according to authorization and actual need, and they are retained for the period necessary under applicable legislation and obligations.

Security monitoring must not be used to collect excessive data or access personal information beyond its legitimate purpose.

10. Handling Security Incidents

When a security incident is detected or a potential breach, unauthorized disclosure, data loss, or misuse of systems is suspected, the platform's administration will take appropriate measures based on the nature and severity of the incident.

Such measures may include:

• Investigating the incident and determining its scope and potential impact.
• Containing the incident and limiting its continuing effects.
• Suspending affected accounts or permissions when necessary.
• Preserving relevant records and technical evidence.
• Addressing the technical or security cause and taking steps to reduce the risk of recurrence.
• Notifying competent authorities or affected individuals when required by law.
• Documenting the incident and the measures taken, in accordance with applicable systems and procedures.

Security incidents must be handled seriously and without deliberate concealment of violations, while complying with applicable legal procedures and regulatory obligations.

11. Service Providers and External Parties

The platform may rely on external providers for hosting, maintenance, email services, technical protection, and other services necessary for its operation.

The platform's administration seeks to select and engage such providers in a manner proportionate to the nature of the service and its associated risks, while taking appropriate contractual, security, and legal safeguards into account.

Platform data may be made available to a service provider only to the extent necessary to perform its assigned task and in accordance with the legitimate purpose and applicable legal requirements.

If the use of an external provider results in personal data being transferred outside the Arab Republic of Egypt or made available abroad, the applicable legal requirements governing such transfers must be observed.

12. User Responsibilities

Users are responsible for maintaining the confidentiality of their account credentials and using the platform's services lawfully.

Users are prohibited from:

• Attempting to access systems or accounts without authorization.
• Bypassing security controls or exceeding technical permissions.
• Uploading or transmitting malicious files or using tools intended to disrupt services.
• Exploiting security vulnerabilities or obtaining data they are not authorized to access.
• Impersonating others or using another person's login credentials.
• Attempting to alter, destroy, or disclose data without authorization.
• Using the platform for activities that violate the law or compromise its security or other users' data.

Users are encouraged to notify the platform's administration promptly if they suspect an account compromise, data misuse, or security vulnerability. Reports should be submitted through an official contact channel. Users must not exploit a vulnerability, access or copy other users' data, or disclose such data.

13. Reporting Security Vulnerabilities and Issues

Qadaya Misr's administration accepts reports concerning security vulnerabilities, attempted intrusions, or unauthorized use through an official contact channel designated for these purposes.

A report should clearly describe the issue and its potential impact without attaching personal data or confidential documents that are unnecessary for verification.

Receipt of a report does not constitute authorization to conduct further testing or access systems or data beyond the scope of an express authorization. Reporters must refrain from exploiting the issue, disrupting services, or publicly disclosing technical details before coordinating with the administration.

Security Incident and Vulnerability Reporting Email: [Insert the official email address designated for this purpose before publication.]

14. Legal Compliance and Cooperation with Competent Authorities

Qadaya Misr is committed to observing relevant Egyptian legislation concerning information security, personal data protection, and the prevention of information technology crimes, as applicable, including legal obligations relating to data protection, incident handling, and disclosure of information.

The platform will cooperate with competent authorities and provide data or records that it is legally required to disclose, in accordance with applicable legal procedures, while protecting information that may only be disclosed as permitted by law.

This Policy does not mean that the platform is a government entity or holds any official security accreditation or certification. Any applicable license, permit, or certification remains subject to the requirements and procedures established by the competent authorities.

15. Review and Updates to This Policy

Qadaya Misr's administration reserves the right to review and update this Information Security Policy when necessary to reflect technical, operational, legislative, and emerging security risks.

The administration will work to improve appropriate controls and procedures based on the results of these reviews and the nature of the services. Published amendments will take effect in accordance with applicable legal requirements and the relevant Terms of Use.

Qadaya Misr's Commitment to Information Security

Qadaya Misr affirms its commitment to protecting its digital systems and users' information, maintaining the confidentiality, integrity, and availability of data and services, and taking appropriate measures to reduce security risks and prevent unauthorized use.

The platform treats suspected breaches and misuse seriously and takes appropriate action within its authority, while complying with Egyptian legislation and cooperating with competent authorities whenever required by law.

This Policy does not constitute an absolute guarantee that all risks or technical incidents can be prevented. Rather, it establishes the principles and controls governing information security management, subject to ongoing review and improvement in accordance with the platform's nature and legal obligations.

Owner: Shubeik for Services and Consultancy
Platform: Qadaya Misr
Website: https://www.qadayamisr.com