Privacy Policy

1. Introduction, Operator and Scope

1.1 Resolve is operated by Panacea for Business Entrepreneurship, a company established under the laws of the Arab Republic of Egypt, registered in the commercial register under No. 149370, with its registered office at 23 Ibn Al Haytham Street, Nasr City, Cairo, Arab Republic of Egypt (the "Operator"). References to "we", "us" and "our" are to the Operator. Brand names used in connection with the Platform do not identify a different contracting party.

1.2 Resolve is a specialised platform for presenting and managing cases of companies in financial distress or special situations and for connecting them, under controlled conditions, with Investors and Experts. Its functions include case submission and review, anonymised presentation of Opportunities, access requests, confidentiality undertakings, controlled disclosure through a virtual data room, Expressions of Interest, in-platform correspondence and, where made available, financial diagnostic tools.

1.3 This Privacy Policy explains how the Operator collects, uses, discloses, transfers, retains and protects Personal Data in connection with the Platform, the legal grounds on which it relies, and the rights that Data Subjects have under the PDPL and other Applicable Law. It applies to Personal Data processed through the Platform's public pages, registered areas, dashboards, data rooms, tools, communications and related services.

1.4 This Privacy Policy applies to each person described in Article 5, whether or not that person holds an account.

1.5 This Privacy Policy is an informational notice. Reading it is not acceptance of any contract and is not consent to any processing. Where the Operator relies on consent for a particular processing activity, that consent is requested separately, in a specific and granular form, and recorded as described in the Consent Management Policy (RES-POL-08).

1.6 This Privacy Policy should be read together with the Terms of Use (RES-POL-02), the Company Terms (RES-POL-03), the Investor Terms (RES-POL-04), the Confidentiality Policy (RES-POL-05), the Cookie Policy (RES-POL-06), the Data Processing Notice (RES-POL-07) and the Consent Management Policy (RES-POL-08). The Data Processing Notice describes in more detail the role the Operator and other parties play in each Platform workflow.

1.7 This Privacy Policy does not apply to the processing of Personal Data by any person outside the Platform, including the processing carried out by an Investor, Expert or Company for its own purposes after information has been lawfully released to it, by a third-party website linked from the Platform, or by any person under a separate engagement that is not performed through the Platform. Those persons are responsible for their own processing under Applicable Law, without prejudice to the obligations they have accepted towards the Operator and other parties, including under any NDA.

2. Definitions and Interpretation

2.1 In this Privacy Policy the following terms have the meanings set out below. Terms defined in the Terms of Use (RES-POL-02) and not defined here have the meaning given there.

(a) "Resolve" or the "Platform" means the Resolve website(s), application, dashboards, data rooms, tools and related services operated by the Operator.

(b) "Platform Personnel" means the Operator's founder(s), directors, managers, employees and authorised representatives, each acting in that capacity for the Platform.

(c) "User" means any person who accesses or uses the Platform, including a visitor and a Registered User; "Registered User" means a User holding an account.

(d) "Company" means a business entity (and its authorised representatives) that registers or is presented on the Platform to seek investment, financing, restructuring support, Expert services or a transaction.

(e) "Investor" means a natural person or entity registered to review opportunities with a view to investing, financing, acquiring or partnering.

(f) "Expert" means a professional registered or appointed on the Platform to provide restructuring, financial, legal, valuation or related professional services within an assigned scope.

(g) "Submitting Party" means any Company, Investor, Expert or other person who supplies, uploads, submits or makes information available through the Platform; "Third-Party Information" means any information, data, document or statement supplied by a Submitting Party (other than the Operator acting for itself).

(h) "Opportunity" means a specific case, project or transaction presented through the Platform.

(i) "Confidential Information" has the meaning given in the Confidentiality Policy (RES-POL-05); "NDA" means a confidentiality undertaking or non-disclosure agreement executed for a specific Opportunity or engagement.

(j) "Access Grant" means an express permission recorded by the Platform allowing a specific person access to a specific level of information for a specific Opportunity, for a stated period.

(k) "Contact Release" means a separate recorded event by which direct contact details are released between parties.

(l) "Expression of Interest" or "EOI" means a non-binding indication of interest submitted through the Platform.

(m) "Financial Diagnostics" means the outputs of the Platform's financial diagnostic tools (metrics, model classifications, scenarios, findings, inferred indicators); "Inferred Indicators" means system-generated indications derived from data, labelled as inferences, distinct from a Company's "Stated Needs".

(n) "PDPL" means the Personal Data Protection Law promulgated by Law No. 151 of 2020 and its Executive Regulations.

(o) "Personal Data", "Sensitive Personal Data", "Data Subject", "Controller" and "Processor" each have the meaning given by the PDPL. Sensitive Personal Data includes financial data relating to an identified or identifiable natural person.

(p) "Center" means the Personal Data Protection Center.

(q) "Policies" means the Platform policy documents listed in clause 1.6 and this Privacy Policy.

(r) "Applicable Law" means all laws and regulations of the Arab Republic of Egypt and any other law that applies mandatorily.

2.2 In this Privacy Policy: headings are for convenience only and do not affect interpretation; "including" and similar words mean "including without limitation"; the singular includes the plural and vice versa; and a reference to a law includes that law as amended or replaced and any regulation issued under it.

3. Summary of Key Points

3.1 This Article summarises the main points of this Privacy Policy. It does not replace the detailed Articles that follow, which prevail in case of any difference.

(a) Who is responsible. The Operator is responsible for the processing of Personal Data that it carries out to operate the Platform. Its contact details and the details of its Data Protection Officer are in Article 23.

(b) What we collect. We collect account, identity, role and contact data; organisation membership and verification data; documents and information uploaded to the Platform, which may contain Personal Data of other people; records of access requests, NDAs, Access Grants, EOIs, Contact Releases, messages and consents; audit and access logs; and technical data.

(c) Why and on what basis. We use Personal Data to operate the Platform at your request, to control and record access to confidential information, to protect security and integrity, to comply with the law and, where we rely on it, with your explicit consent. Accepting the Terms of Use is not consent to processing, and consent is not the only legal ground we use.

(d) Financial data. The PDPL treats financial data about an individual as Sensitive Personal Data. Financial and commercial information about a company is not automatically Personal Data, but it can contain Personal Data. We process Sensitive Personal Data only as Article 8 describes.

(e) Controlled disclosure, not sale. Confidential details of an Opportunity are released to an Investor or Expert only through a recorded Access Grant after an access request, any required NDA and approval by Platform Personnel. We do not sell Personal Data. We send marketing only with your separate opt-in consent.

(f) Who receives data. Platform Personnel on a need-to-know basis; Investors, Experts and Companies to the extent of the applicable grants and roles; service providers acting for us; professional advisers; and authorities where the law requires.

(g) Transfers. Because the Platform serves users in more than one country, Personal Data may be transferred outside Egypt, only as the PDPL permits.

(h) Retention. We keep Personal Data only for as long as necessary for the purpose concerned and for any longer period required by law or needed for legal claims. Certain records, such as audit logs and immutable assessment snapshots, are retained to preserve integrity and evidence.

(i) Security. We apply appropriate technical and organisational measures, including role-based and grant-based access, logging and watermarked exports. No system is completely secure, and we will notify personal data breaches as the law requires.

(j) Your rights. You may request access to your Personal Data, correction, updating or erasure, restriction of processing, withdrawal of consent, notification of breaches and objection where processing conflicts with your fundamental rights. You may also complain to the Center.

(k) Age. The Platform is intended for persons of full legal capacity acting for business purposes.

4. The Operator's Role in Processing

4.1 The Operator acts as Controller for Personal Data that it processes for its own purposes in operating the Platform, including account and registration data, verification records, access and consent records, communications with Platform Personnel, audit and access logs, security records and technical data.

4.2 When a Submitting Party uploads documents or information that contain Personal Data of other individuals, the Operator processes that Personal Data to host, review, organise, anonymise, analyse where requested and disclose it under controlled conditions in accordance with the Platform's rules. The Submitting Party determines what material it chooses to supply and remains responsible for its lawful supply, as described in Article 9. The Operator is responsible for its own processing of that material on the Platform and for complying with the obligations that the PDPL places on it in respect of that processing.

4.3 Where, under a separate written agreement, the Operator processes Personal Data only on the documented instructions of a Company or other person and for that person's purposes, the Operator acts as Processor for that processing, and that person acts as Controller. The Data Processing Notice (RES-POL-07) describes the roles for each workflow.

4.4 An Investor, Expert or Company that receives Personal Data through the Platform under an Access Grant, Contact Release or engagement processes that data for its own purposes and is responsible for its own compliance with Applicable Law, subject also to its NDA and the applicable Policies. Such a recipient is not, by reason of that receipt alone, a Processor of the Operator.

4.5 Where the law of another country applies mandatorily to a User or to particular processing, the Operator will comply with that law to the extent it applies.

5. Persons Covered by this Policy

5.1 This Privacy Policy applies to Personal Data relating to the following persons:

(a) visitors to the Platform's public pages who do not hold an account;

(b) Registered Users of every role;

(c) individuals who act as representatives, owners, members, officers or contact persons of a Company, an Investor that is an entity, or an Expert's firm;

(d) Investors who are natural persons, and individuals acting for Investors that are entities;

(e) Experts, and individuals acting for an Expert's firm;

(f) individuals whose Personal Data appears in information or documents supplied through the Platform, including shareholders, partners, directors, managers, guarantors, employees, creditors, debtors, customers, suppliers, auditors and other counterparties of a Company; and

(g) individuals who contact the Operator in connection with the Platform, including through privacy or other enquiries.

5.2 Platform Personnel are covered by this Privacy Policy in respect of the Personal Data recorded about their actions on the Platform, such as audit logs. Their employment-related data is governed by separate internal notices.

6. Personal Data We Process and Its Sources

6.1 The categories of Personal Data that the Operator processes depend on how a person uses or appears on the Platform. They include the following:

(a) account and identity data, such as name, title, nationality where provided, identification details where required for verification, username, sign-in credentials, language preference and account status;

(b) role and profile data, such as the role held (Company representative, Investor, Expert), professional title, employer or firm, areas of interest or investment mandate, professional qualifications and experience, sectors and markets of interest, and profile statements;

(c) contact data, such as business e-mail address, telephone number, postal address and preferred contact channel;

(d) organisation membership data, such as the organisations to which a Registered User belongs, the role held in each organisation and assignments to particular cases;

(e) verification data, such as documents or information supplied to verify identity, authority to act for an organisation, professional status or credentials, and the outcome and record of the verification step;

(f) uploaded content, being documents and information supplied by Submitting Parties, including financial statements, management accounts, forecasts, valuations, ownership and shareholding information, debt and creditor schedules, contracts, correspondence, court or administrative documents and supporting evidence, which may contain Personal Data of the individuals described in clause 5.1(f);

(g) access and confidentiality records, such as access requests, the NDA version accepted, acceptance and countersignature records, Access Grants and their level, scope and period, revocations and expiries, and Contact Release records;

(h) transaction workflow data, such as EOIs and their content, status changes and related communications;

(i) messages, being correspondence exchanged through the Platform with Platform Personnel and any attachments;

(j) Financial Diagnostics data, where the relevant tools are made available, being financial statement inputs and the revisions confirmed by a Company, evidence files, the resulting assessment snapshots and outputs, the Company's Stated Needs and the Inferred Indicators, and the Company's publication and sharing consents;

(k) consent and acceptance records, such as the version of each document accepted or consented to, the date and time, the account that acted and any withdrawal;

(l) audit, access and export data, such as records of sign-in, document views and downloads, administrative actions, and watermark details applied to exports (including the identity of the reader, the snapshot concerned and the time); and

(m) technical data, such as IP address, device and browser information, session identifiers, pages accessed, time stamps and security events, collected through cookies and similar technologies as described in the Cookie Policy (RES-POL-06).

6.2 The Operator obtains Personal Data from the following sources:

(a) directly from you, when you register, complete a profile, submit information or documents, request access, accept an NDA, submit an EOI, send a message or contact the Operator;

(b) from a Submitting Party, such as a Company that uploads documents containing information about its shareholders, directors, employees or creditors, or an organisation that adds you as a member or representative;

(c) from Platform Personnel, when they record reviews, verification outcomes, approvals and decisions;

(d) from the Platform itself, when it generates logs, watermark data, Access Grant records and, where made available, Financial Diagnostics; and

(e) from publicly available sources or official registers, where that is necessary to verify identity, authority or professional status and permitted by Applicable Law.

6.3 You are not required to provide Personal Data to visit the public pages of the Platform. Certain Personal Data is necessary to register, to hold a particular role or to use particular functions. Where data is necessary, the relevant form indicates this, and if you do not provide it the Operator may be unable to provide the function concerned.

7. Purposes and Legal Grounds

7.1 The Operator processes Personal Data only for specified and legitimate purposes and only on a legal ground recognised by the PDPL. Those grounds include the explicit consent of the Data Subject, the performance of a contract or the taking of steps at the Data Subject's request, compliance with a legal obligation or an order of a competent authority, and any other ground permitted by law. Consent is not the only legal ground on which the Operator relies, and accepting the Terms of Use or any other terms is not consent to the processing of Personal Data.

7.2 The following table sets out the main purposes, the data used and the legal ground relied on.

7.3 Where the Operator relies on a ground other than consent, it does so only to the extent that the processing is necessary for the purpose stated and does not conflict with the fundamental rights and freedoms of the Data Subject.

7.4 The Operator will not use Personal Data for a purpose that is incompatible with the purpose for which it was collected unless the Data Subject has consented or Applicable Law permits it. Where a new purpose requires consent, the Operator will request it before the processing begins.

8. Sensitive Personal Data and Financial Information

8.1 The PDPL classifies certain Personal Data as Sensitive Personal Data, including financial data relating to an identified or identifiable natural person. Processing Sensitive Personal Data requires the explicit written consent of the Data Subject, save where Applicable Law provides otherwise, and any licence or permit required by law.

8.2 Financial and commercial information about a Company, such as its statements, accounts, debts, forecasts and valuations, is not automatically Personal Data. It becomes Personal Data, and may become Sensitive Personal Data, to the extent that it relates to an identified or identifiable natural person. Examples include a schedule identifying an individual shareholder's holding, a personal guarantee given by a director, an individual creditor's claim, or the remuneration of a named employee.

8.3 The Operator processes Sensitive Personal Data only:

(a) where the Data Subject has given explicit written consent for the specific processing;

(b) where the Submitting Party has confirmed, in accordance with Article 9, that it holds the lawful basis required for supplying that data through the Platform, including any required written consent, and the Operator's own processing is within the scope of that basis; or

(c) in any other case permitted by Applicable Law,

and in each case subject to obtaining any licence or permit required by law.

8.4 The Operator does not request health, biometric, genetic, religious, political or criminal data for the purposes of the Platform. Submitting Parties should not upload such data unless it is strictly necessary for the Opportunity and they hold the required lawful basis. Where such data is identified on the Platform without an apparent lawful basis, the Operator may restrict access to it, request redaction or remove it.

8.5 Submitting Parties are asked, where practicable and consistent with the purpose of the Opportunity, to redact, pseudonymise or aggregate Personal Data of individuals that is not needed for evaluation of the Opportunity.

9. Personal Data Supplied by Submitting Parties

9.1 Each Submitting Party is responsible for having the authority, rights and lawful basis required to supply through the Platform any Personal Data relating to other persons, including for informing those persons where Applicable Law requires and for obtaining any consent that Applicable Law requires. This responsibility is set out in Clause A (clause 9.1) of the Terms of Use (RES-POL-02).

9.2 That responsibility does not transfer to the Submitting Party any obligation that the PDPL places on the Operator. The Operator remains responsible for its own processing on the Platform, including for processing only for the stated purposes, applying appropriate security measures, controlling disclosure, keeping records, honouring Data Subject rights within its control and notifying breaches as required.

9.3 The Terms of Use and the role terms contain clauses on responsibility for information, no certification of Third-Party Information, independent assessment and the limits of Financial Diagnostics (Clauses A to D); those clauses do not reduce, and nothing in any terms accepted by a User waives, any right that a Data Subject has under the PDPL or other Applicable Law.

9.4 Where the Operator becomes aware that Personal Data has been supplied without an apparent lawful basis, or receives a credible complaint from a Data Subject, it may suspend access to the material concerned, ask the Submitting Party to demonstrate its lawful basis or to correct or redact the material, and take any other step required by Applicable Law.

10. Controlled Disclosure, No Sale and Marketing

10.1 Opportunities are first presented in anonymised form. Company names and confidential details are not shown at that stage. The Operator takes reasonable steps to ensure that anonymised presentations do not identify individuals, and prohibits recipients from attempting to re-identify them.

10.2 Confidential information about an Opportunity, including any Personal Data it contains, is disclosed to an Investor or Expert only through an Access Grant. An Access Grant is issued per person and per Opportunity, at a specified access level and for a stated period, after (a) an access request, (b) acceptance of an NDA where required, and (c) approval by Platform Personnel. Acceptance of an NDA does not by itself open access. Membership of an organisation does not by itself confer access to information released to another member.

10.3 Direct contact details are released between parties only through a separate Contact Release. A Contact Release is distinct from the disclosure of Opportunity information.

10.4 Access to documents in the virtual data room depends on the access level held. Viewing, downloading and exporting are logged, and exports are watermarked with details identifying the reader, the snapshot and the time.

10.5 The Operator does not sell Personal Data and does not rent or trade it to third parties for their own marketing purposes. Disclosure of Opportunity information to Investors and Experts under Access Grants is part of the service requested by the Company and is not a sale of Personal Data.

10.6 The Operator sends electronic marketing communications only to persons who have given separate, prior, opt-in consent, which is never a condition of registration and is never bundled with acceptance of terms. Every marketing message identifies the Operator as sender and offers a simple, free means to opt out. Electronic direct marketing is carried out subject to obtaining any licence or permit required by law. Service and security notifications that are necessary for the operation of an account are not marketing.

10.7 Platform notifications are designed to carry a secure link requiring sign-in rather than statements, figures or attachments.

11. Financial Diagnostics and Automated Processing

11.1 Where Financial Diagnostics tools are made available, a Company may enter or import financial statements, confirm a specific revision and receive an assessment snapshot. The snapshot is preserved without alteration so that its basis can be identified later. Documents in PDF or image form are kept as evidence only. The Company's Stated Needs are kept separate from Inferred Indicators generated by the Platform, and Inferred Indicators are labelled as inferences.

11.2 Financial Diagnostics are analytical outputs that depend on the inputs, methodology, dates and assumptions used. They are not decisions based solely on automated processing that produce legal effects concerning a Data Subject or similarly significantly affect a Data Subject. They do not by themselves approve, reject, list or delist a Company or an Opportunity, grant or refuse access, or determine any transaction.

11.3 Submitted assessments are reviewed by Platform Personnel. No Company or Opportunity is automatically rejected on the basis of Financial Diagnostics, and decisions on listing, publication and access are taken by Platform Personnel.

11.4 A published assessment is visible to an Investor only where the Company has given the relevant consent, the publication setting is enabled and the Investor holds a sufficient access level. Separate Company consents apply to publication of metrics, publication of metrics with their sources, and sharing of Inferred Indicators. After publication, a Company may narrow its consent; widening it requires withdrawal and a new review. Withdrawal removes the published projection from further display. A consented projection may be used for matching Opportunities with Investors.

11.5 A Company's consent concerns the Company's information. Where a published assessment contains Personal Data of an individual, the Operator also requires a legal ground for that individual's data as described in Articles 7 and 8.

11.6 The limits of Financial Diagnostics are described in Clause D (clause 9.4) of the Terms of Use (RES-POL-02).

12. Recipients of Personal Data

12.1 The Operator discloses Personal Data only to the extent necessary for the purposes in Article 7, to the following categories of recipients:

(a) Platform Personnel who need access to perform their functions, on a need-to-know basis, under role-based permissions and confidentiality obligations. Emergency access by a Super Administrator is permitted only for a stated purpose, is time-limited and is recorded in the audit log;

(b) Investors and Experts, to the extent permitted by their Access Grants, assigned scopes, NDAs and any Contact Release;

(c) Companies, to the extent necessary for the workflow concerned, such as receiving an EOI, an access request or Contact Release details;

(d) organisation members, to the extent of the role and assignment each holds within an organisation, without automatic inheritance of Access Grants;

(e) service providers acting on the Operator's behalf, such as hosting and data-storage, e-mail delivery, information-security and technical-support providers, each bound by a written agreement requiring it to process Personal Data only on the Operator's instructions and to apply appropriate security and confidentiality measures;

(f) professional advisers of the Operator, such as lawyers, auditors and insurers, under duties of confidentiality;

(g) courts, public prosecution, regulators, the Center and other competent authorities, where disclosure is required by Applicable Law or by a binding order, or is necessary to establish, exercise or defend legal claims; and

(h) a successor or acquirer of the Operator's business or of the Platform, in the event of a reorganisation, merger or transfer, subject to Applicable Law and to that party being bound by obligations equivalent to this Privacy Policy.

12.2 Where the Operator receives a request from an authority for disclosure, it will disclose only what is legally required and, where lawful, will inform the Data Subject or the relevant Company.

13. Cross-Border Transfers

13.1 The Platform serves users and Companies in more than one country, and Personal Data may be accessed by or transferred to Users, Platform Personnel or service providers located outside the Arab Republic of Egypt. The Platform is hosted, and its service providers are located, in the Arab Republic of Egypt or in other countries in which the Operator's service providers operate, subject to the transfer conditions of the PDPL.

13.2 The Operator transfers Personal Data outside Egypt, or makes it accessible from outside Egypt, only as the PDPL permits, including where the destination country provides a level of protection not lower than that provided by the PDPL, subject to obtaining any licence or permit required by law, and with appropriate contractual and organisational safeguards.

13.3 Where a transfer is to an Investor, Expert or Company outside Egypt under an Access Grant or Contact Release, the transfer takes place in the course of the controlled disclosure that the relevant parties requested, and the recipient remains bound by its NDA and the applicable Policies. Such transfers are made only where permitted by the PDPL.

13.4 Information about the safeguards applicable to a particular transfer may be requested using the contact details in Article 23.

14. Retention

14.1 The Operator retains Personal Data for no longer than necessary for the purpose for which it was collected, and thereafter only as required or permitted by Applicable Law. Retention is governed by the Operator's retention rules, under which data is kept only for as long as necessary for the purpose concerned and for any longer period required by Applicable Law or needed to establish, exercise or defend legal claims.

14.2 The following principles apply:

14.3 Where Personal Data is subject to a legal hold, a dispute, an investigation, a court or authority order or a statutory retention duty, the Operator retains it for as long as that hold or duty applies, notwithstanding the ordinary retention period or an erasure request.

14.4 Audit logs, signed or accepted document records and immutable assessment snapshots are retained in unaltered form to preserve the integrity of the Platform's records and to evidence who accessed what, when and on what basis. Where a Data Subject's request for correction concerns such a record, the Operator may record a correction or annotation rather than altering the original record.

14.5 Deleted Personal Data may persist in backup copies, where backups are maintained, until those backups are overwritten in the ordinary cycle. Data in backups is not used for any other purpose and remains protected in the meantime.

14.6 At the end of the applicable period, the Operator erases Personal Data or anonymises it so that it no longer identifies a Data Subject.

14.7 Information that has been lawfully released to a recipient under an Access Grant or Contact Release may be retained by that recipient subject to its NDA, the Confidentiality Policy (RES-POL-05) and Applicable Law.

15. Security and Incident Handling

15.1 The Operator applies appropriate technical and organisational measures designed to protect Personal Data against unauthorised or unlawful access, disclosure, alteration, loss and destruction, having regard to the nature of the data and the risks involved.

15.2 These measures include role-based and grant-based access controls; per-Opportunity access levels; NDA gating; controlled release by Platform Personnel; recording of access, downloads and administrative actions in audit logs; watermarking of exports; restrictions on the types of files that can be uploaded and checks on uploaded files; time-limited and recorded emergency access; notifications that link to the Platform rather than carrying confidential content; and confidentiality obligations of Platform Personnel and service providers.

15.3 No method of transmission or storage is completely secure, and the Operator does not guarantee the security of Personal Data. Users are responsible for keeping their credentials confidential, using the Platform only through their own account, and notifying the Operator without delay of any suspected unauthorised use.

15.4 If the Operator becomes aware of a personal data breach, it will take steps to contain and assess it and will notify the Center within 72 hours of becoming aware of it. It will notify affected Data Subjects within the period and in the manner required by the Executive Regulations, and will provide the information required by Applicable Law. Where the breach concerns data the Operator processes as Processor, it will inform the relevant Controller without undue delay.

16. Your Rights

16.1 Subject to the PDPL and other Applicable Law, a Data Subject has the right:

(a) to know of, access and obtain the Personal Data relating to him or her held by the Operator, and information about its processing;

(b) to withdraw consent previously given to processing;

(c) to correct, amend, update or erase his or her Personal Data;

(d) to restrict processing to a specific scope;

(e) to be notified of any breach of his or her Personal Data; and

(f) to object to processing, or to its results, where it conflicts with his or her fundamental rights and freedoms.

16.2 These rights are not absolute. The Operator may decline or limit a request, in whole or in part, to the extent that:

(a) the request would adversely affect the rights of other persons, including the confidentiality of information belonging to a Company or other Data Subjects;

(b) the Operator is required by Applicable Law, a court or authority order or a legal hold to retain or continue processing the data;

(c) the data is needed to establish, exercise or defend legal claims, or to evidence an NDA, Access Grant, consent or other recorded event; or

(d) Applicable Law otherwise permits the limitation.

16.3 Where the Operator declines or limits a request, it will explain its reasons, unless prohibited by law, and inform the Data Subject of the right to complain to the Center.

17. How to Exercise Your Rights

17.1 A Data Subject may exercise his or her rights by contacting the Operator in writing at its registered address stated in clause 1.1 or through the messaging and contact channels available on the Platform, or by contacting the Operator's Data Protection Officer by writing to that address marked "For the attention of the Data Protection Officer" or through the contact channels available on the Platform. Registered Users may also use any request function made available in their account.

17.2 The Operator will take reasonable steps to verify the identity of the person making a request and, where the request is made on behalf of another person, the authority to act. The Operator may request additional information for that purpose and will use it only for verification.

17.3 The Operator will respond within the period prescribed by the PDPL and its Executive Regulations from receipt of a complete and verified request.

17.4 Requests are handled free of charge, save where Applicable Law permits a fee to be charged.

17.5 Where a request concerns Personal Data contained in material uploaded by a Company or other Submitting Party, the Operator may consult or coordinate with that Submitting Party, for example to verify the accuracy of a correction or to arrange redaction. Such coordination does not relieve the Operator of its own obligations in respect of its own processing, and the Operator will not make the exercise of a right conditional on the Submitting Party's agreement where the right lies against the Operator.

17.6 Where the Operator acts as Processor for a particular processing activity, it will pass the request to the relevant Controller without undue delay and assist that Controller as required by Applicable Law and the applicable agreement.

18. Consent and Its Withdrawal

18.1 Where the Operator relies on consent, the consent is explicit, informed, specific and freely given; it is requested separately from acceptance of any terms; optional consents are never pre-selected; and the Operator records the version, date and time, the account that consented and the scope of the consent. Where the PDPL requires written consent, the consent is obtained in a form that satisfies that requirement. The Consent Management Policy (RES-POL-08) describes each consent event.

18.2 A Data Subject may withdraw consent at any time, as easily as it was given, through the relevant account setting, the opt-out mechanism in a message or the contact details in Article 23.

18.3 Withdrawal of consent takes effect for the future. It does not affect the lawfulness of processing carried out before the withdrawal, and it does not affect processing that the Operator carries out on another legal ground.

18.4 Information that was lawfully released to an Investor, Expert or Company under an Access Grant or Contact Release before withdrawal cannot be recalled from that recipient by the Operator. The recipient remains bound by its NDA, the Confidentiality Policy (RES-POL-05) and Applicable Law in respect of that information. Following withdrawal, the Operator will cease further disclosure based on the withdrawn consent and, where applicable, revoke related links and remove the related published projection.

18.5 A Company's withdrawal of a publication consent for Financial Diagnostics is a separate matter from a Data Subject's exercise of privacy rights. Each operates independently and neither limits the other.

19. Minimum Age and Children's Data

19.1 The Platform is intended only for persons of full legal capacity, being twenty-one Gregorian years under the Egyptian Civil Code, who act for business or professional purposes. A person who does not meet that requirement must not register.

19.2 The Operator does not knowingly collect Personal Data of children through registration or direct interaction. Personal Data of a child may be incidentally contained in documents supplied by a Submitting Party, for example in shareholder records or estate documents; it may be supplied only where strictly necessary and lawfully supplied with any required guardian consent, and it is then processed with additional care and restricted access.

19.3 If the Operator learns that it holds Personal Data of a child without a lawful basis, it will take steps to delete it or restrict its processing.

20. Cookies and Similar Technologies

20.1 The Platform uses cookies and similar technologies, including those strictly necessary for sign-in, security and session management. Optional technologies are used only where the user has given consent through the mechanism provided on the Platform.

20.2 The Cookie Policy (RES-POL-06) describes these technologies, the categories in which they are used, their purposes and the choices available; details of the individual cookies used in each category are available on request as described in that policy. Changing browser settings is not a substitute for any choice that Applicable Law requires the Platform to offer.

21. Third-Party Sites and Services

21.1 The Platform may contain links to websites or services operated by third parties. The Operator does not control those websites or services and is not responsible for their privacy practices. Users should review the privacy notices of any third-party website or service they visit.

21.2 A third party engaged directly by a User, including an Expert acting under a separate engagement, processes Personal Data under its own responsibility and its own notices, except to the extent it acts on the Operator's behalf as a service provider under clause 12.1(e).

22. Changes and Versioning

22.1 We may revise this Privacy Policy prospectively. Each revision receives a new version number and is archived.

22.2 Material changes will be notified to Registered Users through the Platform and, where available, by e-mail a reasonable period before they take effect, and where Applicable Law or the relevant document requires renewed acceptance or consent, the revised version will apply to you only once you have accepted or consented to it.

22.3 A revision does not apply retrospectively to any act, acceptance, consent, NDA or other signed undertaking made before its effective date. A revision does not extend any consent beyond the scope given; where a new purpose requires consent, it will be requested separately.

22.4 The version in force and its effective date are published on the Platform; earlier versions are available on request.

23. Contact

23.1 Privacy enquiries and Data Subject requests: in writing to the Operator at its registered address stated in clause 1.1, or through the messaging and contact channels available on the Platform.

23.2 Data Protection Officer: the Operator's Data Protection Officer may be contacted by writing to the Operator's registered address stated in clause 1.1 marked "For the attention of the Data Protection Officer", or through the contact channels available on the Platform.

23.3 General legal notices: 23 Ibn Al Haytham Street, Nasr City, Cairo, Arab Republic of Egypt.

24. Complaints to the Center

24.1 A Data Subject who believes that his or her Personal Data has been processed in breach of the PDPL may submit a complaint to the Personal Data Protection Center in accordance with Applicable Law.

24.2 The Operator encourages Data Subjects to contact it first, using the details in Article 23, so that it can try to resolve the matter. Doing so is not a precondition to complaining to the Center, and nothing in this Privacy Policy or in any terms accepted by a User limits that right or any other remedy available under Applicable Law.

25. Language and Document Hierarchy

25.1 This Privacy Policy is issued in Arabic and English. Both versions are intended to have the same meaning. In the event of any inconsistency between the two versions, the Arabic version prevails.

25.2 Mandatory provisions of Applicable Law prevail over this Privacy Policy. This Privacy Policy is an informational notice explaining processing; it does not reduce any right a Data Subject has under Applicable Law and does not amend any executed NDA or other executed agreement. The order of precedence among the Policies is set out in the Terms of Use (RES-POL-02). Footer summaries and the "About Resolve" and "Independence Statement" pages are informational summaries and are not a privacy notice.

Version 1.0. Effective from the date of its publication on the Platform.