Privacy Policy — 10point8

Effective Date: 24/10/2025

1) Who We Are (Data Controller)

10point8 (“we”, “us”, “our”) operates https://10point8.com (the “Site”) to sell cosmetics and beauty products. We determine the purposes and means of processing personal data collected through our Site and support channels.

Legal/Trading Name: 10point8
Address: Metro Al Ahram St. – next to Milad Raouf Store, Al-Kawthar, Hurghada, Egypt
Email: info@10point8.com
Phone: (+20) 01080096770
Data Protection Officer (if appointed): [Name, contact email/phone]

2) Scope

This Policy covers personal data collected via our Site, customer support, advertising and analytics tools (e.g., Meta/Facebook, Google, TikTok), external payment gateways (e.g., Paymob), logistics partners, and cloud/hosting providers we use to run and improve the store.

3) Personal Data We Collect

Identity & Contact: name, email, phone, billing and shipping addresses.
Account: login identifiers (stored securely), preferences, wishlists, order history.
Transactions: order IDs, items, totals, payment method (we do not store full card numbers/CVV/PIN).
Technical & Usage: IP, device/browser data, OS, referral URLs, pages viewed, session and cookie/pixel identifiers.
Marketing & Communications: newsletter opt-ins, campaign interactions, ad engagement, surveys/feedback.

4) How We Collect Data

Directly from you: checkout, account creation, forms, customer service.
Automatically: through cookies, pixels, SDKs, and similar technologies when you browse or interact with the Site.
From processors acting on our behalf: payment gateways, shipping/logistics, analytics/ads, and cloud services.

5) Legal Bases

We process personal data based on: contract (to fulfill your orders), consent (e.g., marketing/advertising cookies), legal obligation (tax/accounting/fraud reporting), and legitimate interests (security, service improvement, basic analytics) where your rights are not overridden.

6) Purposes of Use

Provide, process, and deliver orders; manage returns and refunds.
Authenticate users; protect against fraud and abuse; ensure Site and payment security.
Customer support and order/shipping notifications.
Improve Site performance, product catalog, and user experience.
Send offers and newsletters if you opt in (you can unsubscribe anytime).

7) Advertising, Tracking Plugins & Analytics

We use tracking add-ons and integrations — including Meta (Facebook/Instagram) Pixel and Conversions API, Google Analytics 4, and Google Ads (Enhanced Conversions) — to acquire more customers from Facebook and Google and to improve ad quality and relevance. This may involve:

Setting/reading cookies or pixels and collecting device/usage data.
Using hashed first-party identifiers (e.g., hashed email/phone) for audience matching and conversion measurement.
Producing aggregated or pseudonymized reports to evaluate campaign performance.

We do not sell or rent your personal data and we do not authorize platforms to use your data for their own independent marketing.

Children & sensitive data in ads: We do not send Business Tools any data we know or reasonably should know is from or about individuals under 18, nor do we include sensitive personal data categories. We rely on valid consent for advertising cookies and only use hashed first-party identifiers where applicable.

8) Payments via External Gateways (Paymob) — No Card Storage

Online payments are processed on external, secure payment gateways (e.g., Paymob). We do not process or store full payment card numbers, CVV, or PIN on our servers. Cardholder data is collected and processed directly on the gateway’s PCI DSS-compliant systems.

For the sole purposes of payment authorization, security, and fraud prevention, we share your own user data (e.g., name, contact details, billing/shipping address, order details, and risk signals such as IP/device info) with the payment gateway. The gateway may perform 3-D Secure or similar authentication with your issuer. Responsibility for cardholder-data security during the payment process rests with the payment gateway and the issuing bank. We remain responsible for your order, customer support, and coordinating with the gateway to resolve any payment issues.

9) Data Sharing & Disclosure (Processors Only)

We share personal data only with service providers acting on our behalf under binding contracts and confidentiality:

Payment Gateways / Anti-Fraud: authorize and settle payments, risk checks.
Couriers & Logistics: deliver orders and manage returns.
Cloud/Hosting & IT: operate and secure the Site and databases.
Analytics & Advertising: measure usage and deliver/assess ads as in Section 7.
Professional Advisors / Legal Compliance: where required by law or to defend legal claims.

We do not disclose your personal data to any external third party for their own independent marketing or profiling purposes.

10) International Transfers

Some processing may occur outside Egypt (e.g., with cloud or ad/analytics providers). Where data is transferred internationally, we apply appropriate safeguards (such as contractual protections or your explicit consent) to ensure a protection level not less than required by applicable law.

11) Cookies & Similar Technologies

We retain cookies and similar technologies to keep you signed in, remember preferences, analyze traffic, prevent fraud, and improve ad performance. You can manage or delete cookies in your browser; disabling some cookies may affect Site functionality.

Strictly Necessary: checkout/core functions; security.
Functional: preferences (e.g., language/currency).
Analytics: GA4/measurement.
Advertising: Meta/Google ads relevance and conversion measurement.

Typical retention: session cookies end when you close the browser; persistent cookies generally last up to 13 months unless your browser/platform sets a different period.

12) Retention

Account data: while the account is active, then up to 5 years after closure (or longer if required by law).
Orders & invoices: typically 5–10 years for tax/accounting and fraud prevention.
Marketing data: until you unsubscribe or withdraw consent.
Security logs: usually 12–24 months, longer if required for investigations.

13) Security

We use administrative, technical, and organizational measures appropriate to risk, including TLS/SSL encryption, access controls, least-privilege, monitoring, and periodic reviews. While no method is 100% secure, we work to prevent, detect, and respond to incidents promptly. If required by law, we will notify you and regulators of any breach.

14) Your Rights

You can: access your data; request correction, deletion, or portability; object to or restrict processing; and withdraw consent (e.g., for marketing/advertising cookies). To exercise your rights, contact info@10point8.com. We will respond within legally required timeframes and may request reasonable identity verification.

15) Children’s Privacy (18+)

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from minors. Where children’s data is involved, it is treated as sensitive personal data and requires verifiable consent from a parent or legal guardian and enhanced safeguards as required by law. If we learn that we collected such data without the required consent, we will delete it promptly.

16) Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects. Any personalization (e.g., recommendations) is non-intrusive and can be disabled upon request.

17) Third-Party Links

Our Site may contain links to third-party websites or apps. We are not responsible for their content or privacy practices; please review their policies before providing any personal data.

18) Complaints & Contact

If you believe your privacy rights have been infringed, please contact us first at info@10point8.com. You may also have the right to complain to the competent data protection authority in your jurisdiction.

19) Changes to This Policy

We may update this Policy from time to time. The latest version will always be posted here with an updated Effective Date. Significant changes will be communicated on the Site and/or via email before they take effect.