What the Minya desk records, what it deletes, and the rights you retain.
Last reviewed 3 June 2026. The Mallawi School Programmes Index — published by Minya Education Press S.A.E. — collects personal information through three channels: the contact form, the subscription system, and observer-visit reports submitted by teachers and parents.
1. The data controller.
Minya Education Press S.A.E., an Egyptian joint-stock company registered at the Minya Commercial Registry under number 41/2018, with Egyptian Tax Authority VAT identifier 183-475-902, at 12 Sharia Saad Zaghloul, Corniche district, Minya 61511. Legal representative: Nada el-Boraey, founder and majority shareholder.
2. The data officer.
Khaled el-Saady, research and data editor, holds the data officer role since 2022. Reach him on [email protected] with subject "data request" or by office telephone during opening hours.
3. What we collect.
From the contact form: name, email, optional role/affiliation, optional subscription tier, age band of interest, topic, message body. Lawful basis: consent and pre-contractual interest.
From subscriptions: name, email, optional school/institutional affiliation, postal address for institutional subscribers and printed-digest option, country, annual payment records. Lawful basis: contract.
From observer-visit reports: observer's name and contact details, role (teacher/parent/home-schooling adult), programme observed, museum, date of visit, party composition (number of adults and children with general age band; specific identifiers not collected), the structured observation note, and the honorarium payment record. Lawful basis: contract (the EGP 200 honorarium creates a paid-author relationship). Observer-visit reports inform the published quarterly ratings; the observer's identity is not published in the rating unless the observer has explicitly consented.
From booking-consultation bookings: requester name, contact details, school/institutional affiliation, the specific consultation question, the eventual written response. Lawful basis: contract.
From the website: standard request logs at the hosting provider. Lawful basis: legitimate interest in server security. No cookies, no analytics scripts, no tracking pixels.
4. What we do not collect.
We do not collect payment instruments. We do not collect health data (other than accessibility-need disclosures volunteered by parents enquiring about accessibility provision; these are held only for the duration of the relevant enquiry response). We do not collect religious affiliation, political views or other special-category data. We do not collect specific children's identifiers in observer-visit reports — the report records party composition by adult-and-child count and age band, not by individual child name. We do not buy mailing lists.
5. Who else sees this information.
Contact-form messages, subscription records and observer-visit reports are visible to the five editors and the administrator. The mail server is hosted in Frankfurt by a German provider under a written processor agreement. Subscription payment records are visible to the cooperative's bank (Banque du Caire, Minya branch) and PayPal where applicable. The Mallawi Cultural Foundation sees aggregate annual subscriber numbers, not individual identities.
6. International transfers.
Because the mail server is in Germany, email passes through the EU. Subscription records held in Minya on encrypted local storage with off-site Cairo mirror. No transfer outside Egypt for storage purposes.
7. How long we keep your information.
Contact-form messages not leading to subscription or commission — twelve months, then deleted.
Subscription records — duration of subscription plus seven years (Egyptian commercial-law retention). After seven years personal name and postal address are erased.
Observer-visit reports — retained indefinitely as part of the editorial archive (the observation is the basis of a published rating). The observer's identity is removed from any published version unless they have consented to identification.
Booking-consultation files — retained for two years from the consultation date, then archived offline.
Email correspondence with subscribers — duration of subscription year plus two years, then offline archive; offline archives erased after seven years.
Server logs — fourteen days at the hosting provider. Aggregate access counts kept indefinitely with no identifying information.
8. Your rights.
Under Egyptian Personal Data Protection Law (Law 151/2020) and the EU GDPR where it applies, you have rights of access, portability, rectification, erasure, restriction, objection and withdrawal of consent. Khaled handles requests within thirty days, free of charge.
9. Security measures.
Encrypted disks at the Minya office, encrypted off-site Cairo mirror, TLS for all client connections, encrypted backups, access-controlled to the chair and the data officer.
10. Children's data — the special protection.
Because the index's subject matter is museum education for school-age children, we take particular care over child data. Observer-visit reports never collect individual children's identifiers; the report records party composition by adult-count and child-count within age bands, not by individual name. School-network subscriptions are taken in the school's name, not in the children's names. Booking consultations discuss programme suitability in general age-band terms, not by individual child profile. Where a parent's enquiry surfaces a specific child's accessibility need, that information is held only for the duration of the enquiry response and is then erased.
11. Whistleblower protection.
Where information about a museum education programme reaches us through a whistleblower channel — typically a museum staff member, a school administrator or a ministry employee with concerns about a specific programme's safety, quality or curriculum compliance — we treat the source with strict confidentiality. Khaled holds the whistleblower-channel records separately, with access restricted to the data officer and the chair. We have received six such submissions since 2020; three led to changed ratings in the published index (with the source unidentified).
12. Subscriber telemetry.
We do not embed read-receipt pixels in the monthly bulletin. We do not track which ratings a subscriber opens. The only behavioural measure is the aggregate open-rate from the mail-server provider.
13. Data breaches.
If a breach occurs likely to result in a risk to your rights, we notify you within seventy-two hours and notify the Egyptian Personal Data Protection Centre. Two minor incidents have been logged since 2019.
14. Cookies.
This website sets no cookies. No analytics cookie, no consent cookie, no preference cookie.
15. Profiling and automated decisions.
We do not run profiling. Every reply is composed by a human; every rating is produced by a human editor.
16. Reader-mail attributions.
The monthly bulletin's reader-mail section attributes letters by first name and country only.
17. Annual external audit.
Since 2023 the index commissions an annual external audit of its data-protection practice.
18. Changes to this notice.
Reviewed every June. Material changes notified to active subscribers by email at least thirty days before they take effect.
19. Safeguarding protocol for child-safety concerns.
Where the cooperative receives information that suggests a child-safety concern at any indexed programme — for example, an observer-visit report describing inadequate adult supervision or a programme practice that could harm a child — we follow a separate safeguarding protocol. The protocol requires the data officer to notify the Egyptian Ministry of Education's safeguarding channel within forty-eight hours and to retain the relevant correspondence under restricted access (chair and data officer only). The observer's or complainant's identity is held confidential throughout the safeguarding-protocol process unless the regulator requires disclosure under formal investigation. We have invoked the safeguarding protocol three times since 2019; all three cases involved adult-supervision issues at workshop programmes and all three were resolved through the museum's own staff-training response to the regulator's notification.
20. Annual external audit.
Since 2023 the cooperative commissions an annual external audit of its data-protection practice, conducted by an independent Egyptian consultant. The audit reviews collection points, retention practice, security measures, and the data officer's response record. Reports are summarised in the December transparency note and available in full to the Egyptian Personal Data Protection Centre on request.
21. Data-protection cooperation with the Ministry of Education.
The cooperative shares aggregate data with the Egyptian Ministry of Education's curriculum-development unit as part of the informal collegial relationship described on the about page. The shared data covers aggregate subscriber counts (how many Egyptian schools subscribe at each tier) and the consolidated programme-rating findings (which programmes the index rates strongly or weakly for the curriculum-fit dimension). The shared data does not include individual subscriber identities, individual observer-visit reports, or any personally-identifying information. The data-sharing arrangement is documented in writing and reviewed annually at the September methodology revision.
22. Subscriber-correspondence retention beyond the active subscription.
Where a subscriber's correspondence raises substantive editorial questions that inform the index's continuing work — for instance, a teacher's detailed observation about a programme's quality drift — the correspondence may be retained in the editorial archive beyond the standard two-year-plus-subscription-year window described in section 7. Retention beyond the standard window is conditional on the subscriber's explicit consent at the time of correspondence; the cooperative does not retain correspondence beyond the standard window without consent. The editorial-archive retention is for the duration of the relevant editorial work, typically five to seven years from the original correspondence.
23. Contact for any data question.
Khaled el-Saady, data officer, Minya Education Press S.A.E.
Email: [email protected] · subject "data request"
Telephone: +20 86 4127 638 · Sunday, Tuesday, Thursday 10:00–14:00 Cairo time
Postal: 12 Sharia Saad Zaghloul, Corniche district, Minya 61511, Egypt.