Legal & Regulatory Framework

§1The laws we follow

Growmark is based in Cairo, Egypt. Our work is governed by these Egyptian laws:

Law	What it covers
Cybercrime Law, No. 175 of 2018قانون مكافحة جرائم تقنية المعلومات	Unauthorized access, account misuse, data interference and online privacy.
Personal Data Protection Law, No. 151 of 2020قانون حماية البيانات الشخصية	How personal data is collected, used, stored and shared, and marketing consent.
Intellectual Property Law, No. 82 of 2002قانون حماية حقوق الملكية الفكرية	Copyright in branding, graphics, websites, software and other creative work.
Consumer Protection Law, No. 181 of 2018قانون حماية المستهلك	Accurate information for consumers, misleading advertising and online sales.
Electronic Signature Law, No. 15 of 2004قانون تنظيم التوقيع الإلكتروني	Electronic signatures, electronic documents and their value as evidence.
Telecommunications Regulation Law, No. 10 of 2003	Telecommunications activities. A secondary reference for us, relevant if we provide hosting or online platforms.

The Personal Data Protection Law applies together with its Executive Regulations (Ministerial Decree No. 816 of 2025). When we work with brands in the Gulf, the data protection law of that country can apply too. Our Privacy Policy explains how.

§2Your rights

If we hold your personal data

Access, correction and deletion. You can see the personal data we hold about you, correct it, and ask us to delete it (Law 151/2020, Article 2).
Withdrawing consent. Anything you agreed to, you can withdraw (Article 2).
A clear purpose. Your data is collected for specific, legitimate purposes and kept only as long as they need (Article 3).
Stronger protection for sensitive data. The law adds restrictions for sensitive personal data (Articles 12–13).
Notice of a breach. If a breach affects your personal data, the Personal Data Protection Centre must be told within 72 hours of it being discovered, and you within three working days after that (Article 7).
Protection across borders. The law sets the level of protection required when personal data leaves Egypt (Articles 14–16).
Saying no to marketing. Electronic marketing must name its sender and give you an easy way to refuse it or withdraw (Articles 17–18).
Complaint. You can complain to the Personal Data Protection Centre.

If you are a client

Access only with your authorization. We open only the accounts and systems you authorize, and stop when that authorization ends (Law 175/2018, Articles 14–15).
One permission, one purpose. Access to one account gives us no right to any other system, and no right to use its data for anything unrelated.
Your systems protected. We don’t change your website, delete your data or disrupt your operations without authorization (Articles 17–19).
Your assets stay yours. Logos, photographs, trademarks, copy, product images and other materials you give us remain yours.
A written transfer of rights. When rights in our work pass to you, the writing names each right, its scope, purpose, duration and territory (Law 82/2002, Article 149).
Your customers’ data on your instructions. We process it only as you instruct, and we protect it (Law 151/2020, Article 5).

If you see advertising we made

Accurate information. You have a right to accurate information about what is sold to you (Law 181/2018, Article 2).
No misleading claims. Claims, benefits, prices and discounts must not mislead you (Article 9).
Correction. The law provides for misleading advertisements to be corrected or suspended (Article 57).

To use any of these rights, email . Our Privacy Policy explains how we answer data requests.

§3Our rights

Authorship of our work. We keep our moral rights as authors, including protection against certain changes to the work. These don’t transfer the way economic rights do (Law 82/2002, Article 143).
Economic rights until transferred. The right to reproduce, distribute, adapt and publish what we create stays with us until it is transferred in writing (Articles 147 and 149). Your agreement says when that happens, and whether it depends on full payment.
Payment for rights. We are entitled to compensation for the economic rights we transfer (Article 150).
Our own methods and tools. Our frameworks, diagnostic methodology, templates, reusable components, software, design systems and processes remain ours unless we agree otherwise in writing.
Your confirmation of what you give us. We rely on you to confirm you have the rights to the materials you supply.
Proof before we publish. The law counts advertising agencies as advertisers (Law 181/2018, Article 1). So we ask clients to approve and support product claims, prices and discounts, testimonials and reviews, features and benefits, stock claims, certifications and awards before a campaign goes out.
Electronic approvals. We can rely on compliant electronic signatures and documents as evidence (Law 15/2004, Articles 14–15).
Protection of our own systems. Our website, accounts and email have the same protection against unauthorized access and interference, and we report crimes against them to the authorities (Law 175/2018, Articles 14–19 and 35).

§4Your accounts and systems

The Cybercrime Law (No. 175 of 2018) governs how we treat anything you give us access to, such as your store, ad accounts, analytics, domains or hosting.

Article	What it covers	What it means in our work
2	Service-provider duties	Confidentiality and security of data. Where the law treats a business as a service provider, certain system records are kept for 180 days.
14	Unauthorized access	We don’t access a website, account or system without authorization.
15	Exceeding authorized access	We stay within the permissions given, and stop when they end.
16	Interception	We don’t intercept data moving across networks or computers.
17	Data and system interference	No unauthorized destruction, disabling, alteration or deletion of information.
18	Private accounts	No damaging, disabling or disrupting of websites, email or company accounts.
19	Website interference	No defacing, hiding, altering or damaging of a company’s website without authorization.
25	Privacy and mass messaging	No bulk unsolicited messages, and no disclosing personal data for marketing without consent.
35	Reporting	An attack on our own website, accounts, email or systems is reported to the authorities.
36	Management responsibility	Growmark’s management answers for what is done in the company’s name.

What your authorization covers

Before we open an account, we record:

Which accounts we can access
What we are authorized to do in them
Which people on our team can access them
How long the authorization lasts
When access must be removed

§5Your personal data

The Personal Data Protection Law (No. 151 of 2020) governs personal data we handle. Our Privacy Policy gives the detail of what we collect and how long we keep it.

Article	Subject	What it requires
1	Definitions	Defines personal data, controller and processor.
2	Your rights	Access, correction, deletion and withdrawal.
3	Conditions for processing	Specific, legitimate purposes and limited retention.
4	Controller duties	Security, documentation and appropriate permissions.
5	Processor duties	Processing on written instructions, and protecting the data.
7	Breaches	Notice to the Centre within 72 hours, then to affected people within three working days.
8–9	Data Protection Officer	Appointment and duties, where applicable.
12–13	Sensitive data	Additional restrictions and protections.
14–16	Transfers abroad	The level of protection and authorization needed, subject to the law’s exceptions.
17–18	Electronic direct marketing	Consent, sender identification, a way to opt out, and consent records kept for three years from the last message.

When we decide, and when you do

We are the controller for data we collect for ourselves. For example, when you send your name and email through our website, we decide how it is used.
We are the processor for data we handle for a client. For example, when a client gives us its customer analytics for a Diagnosis, the client decides the purpose and we follow its instructions.

§6Creative work and ownership

The Intellectual Property Law (No. 82 of 2002) protects the work we create and the work you give us.

Article	Subject	What it covers
140	Protected works	Graphic design, illustrations, websites, software, photography, video and databases.
143	Moral rights	Authorship, and protection against certain changes to the work.
147	Economic rights	Reproduction, distribution, adaptation, publication and other uses.
149	Transfer of economic rights	A written agreement naming each right, its scope, purpose, duration and territory.
150	Remuneration	Compensation for transferred economic rights.

Who owns what

Category	Includes	Owner
Client assets	Logos, photographs, trademarks, copy, product images and other materials you provide.	You
Deliverables we create	Brand identities, campaigns, website designs, illustrations, graphics and other agreed work.	Us, until the agreed rights are transferred to you in writing
Growmark’s own IP	Frameworks, diagnostic methodology, templates, reusable components, software, design systems and processes.	Us, unless agreed otherwise

§7Advertising

The Consumer Protection Law (No. 181 of 2018) applies to the advertising and promotional work we create for our clients.

Article	Subject	What it covers
1	Who is an advertiser	Includes advertising agencies, intermediaries, advertisers and media.
2	Consumer rights	The right to accurate information.
5	Arabic language	Applies to consumer-facing advertising and commercial documents.
9	Misleading advertising	Product claims, benefits, prices, discounts and other representations.
14	Competitions	Advertised competitions require notifying the Consumer Protection Agency.
57	Correction	Correcting or suspending misleading advertisements.

§8Electronic agreements

Under the Electronic Signature Law (No. 15 of 2004), compliant electronic signatures (Article 14) and compliant electronic documents (Article 15) count as evidence in civil, commercial and administrative matters. Not every click or message qualifies, because the law sets technical requirements.

We use documented electronic approval for agreements, scopes of work, proposals, change requests, acceptance of deliverables, rights transfers and account authorizations. We keep the documents, signatures, timestamps and audit trails.

§9Where this is written down

Client agreement: scope of access, confidentiality, responsibilities, payment, termination, approvals and ownership of the work
Data terms: who is responsible for what data, permitted purposes, security, third-party services, transfers, breach notice and deletion at the end of the work
Privacy Policy: what we collect, why, how long we keep it and how to use your rights
GDPR notice: for the people we work with at client brands

If your signed agreement with us says something more specific than this page, the agreement applies between us.

§10Read the laws

Egyptian Supreme Cybersecurity Council: laws and legislation, including Law 175/2018 and its Executive Regulations
Ministry of Communications: ICT laws and legislation
Executive Regulations of the Personal Data Protection Law (Decree 816/2025)
WIPO: Intellectual Property Law 82/2002
Consumer Protection Law 181/2018
WIPO: Electronic Signature Law 15/2004

This page is a plain-language summary, not legal advice. Where it differs from the text of a law, the law applies.

Contact

Questions about your rights or ours? Email