Privacy notice

1. The data controller

The data controller for this site is Verdi Heritage Studies L.L.C., registered at 23 El-Walidiyya Street, Asyut 71511, Egypt, under Tax ID (ETA) 748-302-916. The day-to-day controller is Hisham El-Bahnasawi, who runs the editorial desk. Any data-protection enquiry should be sent in writing to [email protected] with the subject line "Data protection" or addressed by post to the same office; we acknowledge receipt within five working days.

2. The legal frameworks that apply

The archive operates under Egyptian Data Protection Law no. 151 of 2020 and its implementing regulations. Where a subscriber or correspondent is established in the European Union or the European Economic Area, we additionally observe the European General Data Protection Regulation (EU) 2016/679. Where the United Kingdom General Data Protection Regulation applies because the subscriber is in the UK, we observe that regime in parallel. In the rare case of a conflict, we apply the standard most favourable to the data subject.

3. What categories of data we collect

We collect three categories of personal data and no others. First, correspondence data: the name, email address and message body of anyone who writes to the desk through the contact form, by email, or by post. Second, subscription data: in addition to the correspondence data, the billing address, the chosen subscription tier, the currency of payment, and the bank reference of the most recent successful payment. Third, technical access logs: the IP address, the page requested, the response code and the timestamp of every request to the public site, retained for fourteen days for security purposes only. We do not maintain advertising, behavioural or profiling cookies.

4. Why we collect each category

Correspondence data is collected to reply to your enquiry; that is the only purpose. Subscription data is collected to issue the invoice, process the payment, ship the printed Field Notebook where applicable, and provide subscriber access to the archive. Technical access logs are kept solely to detect and respond to attempts to compromise the site. We do not use any of this data for marketing without your explicit prior opt-in, and we have not run a marketing campaign of any kind since the archive was founded in 2011.

5. The legal basis for processing

Correspondence is processed on the basis of your consent, given when you tick the consent box on the contact form or when you choose to write by email. Subscription data is processed on the basis of the contract between you and Verdi Heritage Studies L.L.C., specifically the subscription agreement set out on the pricing page. Access logs are processed on the basis of our legitimate interest in maintaining the integrity of the website, balanced against the very limited and short-lived nature of the log retention.

6. How long we keep each category

Correspondence is kept for a rolling period of twenty-four months from the date of the last exchange, after which it is deleted from the active mailbox and from the editorial work file. A short message thread that resolves a one-off enquiry may be deleted earlier on request. Subscription data is kept for the duration of the subscription plus the seven-year retention period required by Egyptian tax law; after that the billing records are purged. Access logs are kept for fourteen days from the date of the log entry and are then overwritten.

7. Who can read your data

Inside the archive, only the four resident editors (Dr. Salwa El-Naggar, Karim Abdelmonem, Mariam Tawfik and Hisham El-Bahnasawi) have access to the correspondence and subscription mailboxes. Editorial contributors do not. Our Egyptian accountant in Asyut, Mr. Wael Mansour, has access to subscription invoicing data only, under the standing confidentiality clause in his engagement letter. The hosting provider technically has access to access logs, under a written processor agreement. No other party has any access.

8. Disclosure to authorities

We disclose personal data to a public authority only where a formal written request is presented under Egyptian law and the request meets the standard of necessity and proportionality required by Law 151/2020. Where the request relates to a non-Egyptian data subject, we additionally check that the request would be admissible under the data subject's home regime. We have not received such a request in the history of the archive; if we do, we log the request and the response in an annual transparency entry visible on this page.

9. International transfers

The hosting and email infrastructure for the archive is located in Frankfurt, Germany. Personal data of subscribers located outside the European Economic Area is therefore necessarily transferred into the EEA for technical processing. For correspondents and subscribers located inside the EEA the data does not leave the EEA. We have not authorised any onward transfer to a third country outside the EEA or Egypt, and the hosting agreement prohibits the hosting provider from doing so on its own initiative.

10. Cookies and tracking

The site does not set advertising cookies, behavioural tracking cookies, third-party analytics cookies or social-media embed cookies. The single cookie the site may set is a strictly-necessary session cookie used to remember whether you have closed the navigation menu on a small screen; it has no identifying value and is deleted when you close the browser. We do not embed Google Analytics, the Facebook Pixel, the Google Tag Manager, or any equivalent. There is no banner on the site asking you to consent to cookies because there are no cookies that require consent under Egyptian or EU law.

11. The rights you hold

You have the right to ask what personal data we hold about you, to receive a copy of it in a readable format, to ask for it to be corrected if it is wrong, to ask for it to be deleted if there is no longer a lawful basis for us to hold it, to ask for the processing to be restricted while a dispute is resolved, and to object to processing carried out on the basis of legitimate interest. Where you are an EEA or UK resident, you additionally have the right to data portability under the GDPR. We respond to a rights request inside one calendar month from receipt; this is shorter than the maximum permitted by Egyptian Law 151/2020 and matches the GDPR standard. There is no charge.

12. How to make a rights request

Write to [email protected] with the subject line "Rights request" and the specific right you wish to exercise. We will reply within two working days asking for a piece of identifying information sufficient to confirm you are the data subject — typically the email address used to subscribe or to write to the desk previously. Where the request comes by post we will reply by post to the address on the letter. We do not require notarised identity documents for routine requests; that would be disproportionate to the very limited data we hold.

13. Complaints

If you believe we have not handled your personal data correctly, the first step is to write to the desk so that we can address the matter directly; this is usually faster than any regulator. If we cannot resolve the matter to your satisfaction, you may lodge a complaint with the Egyptian Personal Data Protection Centre (the regulator established under Law 151/2020), or, where you are an EEA resident, with the supervisory authority of the EU member state where you reside. UK residents may complain to the Information Commissioner's Office. The supervisory authority for the hosting infrastructure is the German Federal Commissioner for Data Protection and Freedom of Information (BfDI).

14. Changes to this notice

The date at the head of this page is the date of the last review. Substantive changes are notified to active subscribers by email at least thirty days before they take effect; informational corrections (typos, link updates, clarifications that do not change the substance) are made without notice. A change log is held internally and can be supplied on request.

15. Specific notes for subscribers

If you cancel your subscription, your correspondence record is moved out of the active mailbox at the end of the paid period, but the billing invoices are retained under section 6 above for the duration of the tax retention period. If you wish your name to be removed from the contributor acknowledgements list in the next annual digest (Field tier), tell the desk in writing at least one calendar month before the digest goes to press. If you have any unfulfilled service order at the time you ask for deletion, we will complete the order before erasing the related data; you may also instruct us to terminate the order and erase immediately, in which case the engagement is treated as cancelled under the terms set out in the engagement letter.