Privacy Policy

Last updated 10 November 2026 · Français

Royal Nile Villas ("we", "us") runs egyptvillastours.com and arranges villa stays and private tours in Luxor and Aswan. This policy explains what personal data we collect, why, how long we keep it, and the rights you have. We are the controller for that data.

1. What we collect

Enquiries and bookings. When you contact us (WhatsApp, email, or a form on this site) we receive your name, phone number, email address, travel dates, party size, and any preferences or questions you send. If you book, we add the details needed to deliver the stay or tour and to invoice you.

Enquiry data is sent through WhatsApp. Our enquiry buttons open WhatsApp with a pre-filled message. WhatsApp is operated by Meta; the message travels through their systems under their own terms, and Meta also receives technical data such as your phone number and IP address. See section 6.

Availability search. When you check dates, your browser fetches availability calendar files for the villas. That request is relayed through a proxy service (api.allorigins.win) so the calendars can be read across origins. The proxy sees your IP address and the calendar requested.

Technical data. Our host and CDN record standard server logs for every request: IP address, user agent, referrer, requested URL, timestamp and response status. We use them for security, abuse prevention and diagnosing faults.

Analytics and advertising. With the tags currently on the site, Google Analytics 4 measurement and the Meta Pixel run and set cookies (section 7). Both report on page views, referring source, approximate location derived from IP, device and browser, and interactions such as clicking an enquiry button.

We do not knowingly collect data from anyone under 18, and we do not use automated decision-making with legal effect.

2. Why we use it, and our lawful basis

Purpose	Data	Lawful basis
Answering enquiries, quoting, arranging stays and tours	Contact details, dates, party, preferences	Contract, or steps taken at your request before a contract
Taking payment and keeping accounting records	Name, contact, invoice details	Contract and legal obligation
Site security, abuse prevention, fault diagnosis	Technical logs	Legitimate interests
Understanding how the site is used and improving it	Analytics data	Consent (analytics cookies)
Measuring and targeting advertising	Advertising identifiers, events	Consent (advertising cookies)
Responding to a legal claim or regulator	Any of the above as needed	Legitimate interests and legal obligation

Where we rely on legitimate interests we have weighed our need against your rights; the data involved is limited to technical records and you can object at any time (section 8). Where we rely on consent you can withdraw it freely and nothing else changes.

3. Do we sell your data?

No. We do not sell personal data or share it for cross-context behavioural advertising beyond the tags described here.

4. How long we keep it

Data	Retention
Enquiries that do not become bookings	24 months from last contact, then deleted
Booking, invoicing and accounting records	7 years, to satisfy Egyptian accounting and tax rules
Server and security logs	30 days
Analytics data	14 months
Advertising measurement data	14 months
Cookie consent records (once a banner exists)	24 months, as proof of consent

5. Who else is involved

We use these providers, who process data on our behalf or as independent controllers for their own part:

• Hostinger — hosting, CDN and DNS. Servers in the EU.
• Titan — our email provider, for email you send us and our replies.
• Google — Google Fonts (served from Google's CDN), Google Tag Manager, Google Analytics 4.
• Meta — WhatsApp for enquiry messages, and the Meta Pixel for advertising measurement.
• jsDelivr — public CDN for two JavaScript libraries; receives the IP address of the browser requesting them.
• allorigins — a public proxy that relays availability calendar requests.

Outbound links to Airbnb, Booking.com, Google Maps and LinkedIn are not data transfers by us; once you follow one, the destination site's own policy governs. Our contact details are also published on Google Business Profile, Airbnb and Booking.com, where those platforms act as independent controllers.

6. Transfers outside the EU/UK

We are established in Egypt and our providers are in the EU (Hostinger) and the United States (Google, Meta, allorigins). Transfers to the US rely on the European Commission's Standard Contractual Clauses and, where the recipient is certified, the EU–US Data Privacy Framework; the UK Addendum applies for UK data. You can ask us for the safeguards relied on.

Where you contact us on WhatsApp, the message is also held by Meta under Meta's own terms and their regional entity may be the controller for that part.

7. Cookies and similar technologies

Strictly necessary — none are set by our own pages today. The site works fully without any cookie.

Both categories below are non-essential. They are switched on as the page loads, and a banner on your first visit lets you accept or reject them; rejecting stops them from that point on. A Cookie settings link in the footer reopens the banner whenever you want to change your mind.

Analytics — Google Analytics 4 sets _ga and _ga_<id> (up to 13 months) to distinguish visitors and count sessions.

Advertising — the Meta Pixel sets _fbp (90 days) and reads _fbc, and Google may append gclid when you arrive from an ad click, to attribute a booking enquiry to the ad that produced it.

Declining both leaves the site fully usable: the availability search, the villa pages and the WhatsApp enquiry buttons all work without any cookie.

8. Your rights

You can ask us to:

• confirm whether we hold data about you and give you a copy (access)
• correct anything wrong (rectification)
• delete it, where no legal duty keeps it (erasure)
• pause its use while a dispute is resolved (restriction)
• give it to you or another provider in a portable format (portability)
• stop processing based on legitimate interests (objection)
• withdraw consent, at any time, for analytics and advertising

Write to privacy@egyptvillastours.com. We answer within 30 days and may ask for proof of identity where a request is substantial. Withdrawing consent does not affect processing already carried out.

9. Complaining

If we have got something wrong, tell us first — most things are fixable in a day. You can also complain to a supervisory authority: any EU or UK data protection authority where you live, work, or where the alleged breach happened, or in Egypt the Egyptian Data Protection Center under Law 151/2018.

10. EU and UK visitors

We are not established in the EU or UK. Where the GDPR or UK GDPR applies to you, we process on the bases in section 2 and honour the rights in section 8 regardless of where you are.

We have considered whether we must appoint a representative in the EU under Article 27 GDPR (and the equivalent UK provision). Our processing is limited to enquiries, bookings, server logs and two measurement tags, involves no special category data and no systematic monitoring beyond ordinary web analytics, and is assessed as unlikely to present a risk to your rights and freedoms. We therefore rely on the exemption in Article 27(2)(a) and have not appointed a representative. You may address any question about your data directly to us at the details in section 13, and we answer in English or French. If our volume of EU or UK visitors grows, or we begin large-scale tracking or profiling, we will appoint one and update this page.

11. Security

The site is served over HTTPS only and sends the browsers of returning visitors straight to the encrypted version. Access to booking and enquiry records is limited to the owner and staff who need it, protected by passwords and two-factor authentication on the accounts that hold it. No system is perfect; if a breach affects your rights we notify you and the regulator as required.

12. Changes

We update this page when our processing changes and revise the date at the top. Material changes are announced on the homepage. Previous versions are available on request.

13. Contact