Privacy Notice

Hermes Securities Brokerage Company S.A.E.

In accordance with Personal Data Protection Law No. 151 of 2020 and its Executive Regulation No. 816 of 2025

 

Important note: This Notice is addressed to you in your capacity as a visitor to our website or a client of Hermes Securities Brokerage Company S.A.E. It explains how your personal data is collected and processed, and the rights guaranteed to you by law. Please read it carefully.

 

The entity controlling your personal data is:

Company Name	Hermes Securities Brokerage Company S.A.E.
Email	hermesContactCenter@EFG-HERMES.com
Address	Building No. B129, Phase 3, Smart Village, Km 28 Cairo Alexandria Desert Road, Egypt
Phone	+20(0)235356499 +20235357200 16900
Website	www.efghermesone.com

 

Note: Hermes Securities Brokerage Company S.A.E. operates under the supervision of EFG Holding Group. Accordingly, both are jointly responsible for protecting your data as a client or visitor of Hermes Securities Brokerage Company S.A.E. Hermes Securities Brokerage Company S.A.E. is the primary controller of your data relating to brokerage services, while EFG Holding Group undertakes supporting operational and group-level compliance roles.

 

Hermes Securities Brokerage Company S.A.E. has appointed a Data Protection Officer whom you may contact directly:

Job Title	Data Protection Officer (DPO)
Email	dataprotection@efghldg.com

 

a. Personal Data:

• Identity data: full name, national ID card or passport, date of birth, nationality, and the selfie you provide during the identity verification process, which may undergo automated facial-matching processing and, in that case, is treated as sensitive biometric data collected under your explicit written consent; the process may include human review.
• Contact data: address, email, phone numbers, and your location via the Global Positioning System (GPS). We collect GPS location data — after obtaining your permission — for identity verification, fraud prevention, and compliance with regulatory requirements (Know Your Customer). You may disable this permission at any time from your device settings, noting that this may affect the availability of certain services.
• Website data: IP address, browsing data, cookies, information about the device used, and your account details (including username and password) relating to the accounts used to access our website and/or mobile application.
• Communication records: correspondence via email or phone, and contact forms.
• Your demographic information.

b. Sensitive Personal Data:

Within certain services required by legal or contractual necessity, we may collect:

• Financial data: your bank account, payment card details, information about your income, and information about your account balances.
• Criminal conviction data: within the framework of anti-money laundering procedures, if required by law, your criminal record certificate.
• Children's data: collected only when opening an account on behalf of a minor or where there are minor beneficiaries, under the explicit written consent of the parent or legal guardian and treated as sensitive personal data in all cases.

 

Sensitive data safeguards: Sensitive data is processed under the safeguards stipulated in Law No. 151 of 2020, and is collected only under separate, explicit written consent where required by law. Sensitive data includes your financial data, which is processed only under your explicit written consent. In the case of children's data, processing is carried out under the explicit written consent of the parent or legal guardian.

 

We process your personal data on the following legal bases under Article 6 of Law No. 151 of 2020:

Legal Basis	Associated Purposes
Performance of a contract	Performing contracts based on the services requested.
Legal obligation	Compliance with the requirements of the Central Bank of Egypt and the Financial Regulatory Authority, anti-money laundering and counter-terrorism financing, and tax reporting requirements.
Consent	Sending newsletters and marketing messages, and analytical and non-essential cookies (which you may withdraw at any time).
Legitimate interests	Operating the website and ensuring its security and continuity, improving user experience, managing client relationships, and fraud prevention.
Establishment / exercise / defense of legal claims	Retaining necessary documents in the event of disputes or legal proceedings.
Execution of a court judgment or an order from a competent investigative authority	Responding to requests from Egyptian regulatory and judicial authorities.

 

• To enter into a contract with you or to take steps related to entering into a contract with you.
• To identify the products or services we believe you are interested in through the use of cookies or similar tracking technologies on the Services, which track and analyze how you use the Services.
• To retain a copy of your correspondence with us.
• For administrative, assessment, and analytical purposes.
• To verify your identity.
• To monitor and analyze the use of our products and services for system administration, operation, testing, and support purposes.
• To manage our information technology and ensure the security of our Services and systems.
• To establish, exercise, and/or defend against any legal claims or rights, and/or to assist our clients or others with all of the foregoing.
• To investigate and respond to complaints or incidents relating to us or our business, maintain service quality, and train our staff to handle complaints and disputes.
• To ensure compliance with, and to enforce, our terms and conditions and other contractual terms.
• In relation to any proposed merger or acquisition of any part of our business.
• To comply with the laws applicable in the Arab Republic of Egypt and in any other jurisdiction in which we carry out any activities.
• To serve the purposes set out in the “Cookies and Similar Technologies” section.

For the avoidance of doubt, we obtain your consent for the use of non-essential cookies, and you have the right to withdraw your consent at any time. By expressing your refusal or withdrawing your consent, certain aspects or features of the Services may not be available to you. Withdrawing your consent does not affect the lawfulness of processing your personal data collected based on your original consent prior to its withdrawal.

In order for us to provide you with certain services — including, but not limited to, securities brokerage services and research services — which require us to process your personal data to meet regulatory and legal requirements (such as Know Your Customer and anti-money laundering), the provision of personal data is mandatory. If the relevant personal data is not provided to us, we will not be able to provide you with the full range of our services, meaning our services may be offered only with a limited scope or not at all. Any other provision of your personal data is optional.

 

We may share your data with the following parties where necessary:

• EFG Holding Group affiliates: for operational and administrative support purposes under written agreements here.
• Service providers: contracted hosting, email, and analytics companies (data processors committed to protecting your data)here.
• Egyptian regulatory authorities: the Central Bank of Egypt, the Financial Regulatory Authority, and the Egyptian Exchange, where legally required.
• Courts and investigative authorities: pursuit of valid legal orders.
• You may view the list of EFG Holding Group affiliates at: www.efgholding.com

 

Confirmation: We do not sell your personal data to any external party, nor do we use it for commercial purposes outside the scope of Hermes Securities Brokerage Company S.A.E. services.

 

Where the operation of the Services requires transferring your data outside the Arab Republic of Egypt, we apply the following safeguards in accordance with Executive Regulation No. 816 of 2025:

• Verifying that the recipient country provides an adequate or equivalent level of protection.
• Entering into contractual agreements binding the recipient to the same standards applicable to us.
• Relying on the legal mechanisms approved by the Personal Data Protection Centre.
• Obtaining the cross-border data transfer authorization from the Centre where required.

The countries to which data may currently be transferred (depending on the contracted technology service providers) include — by way of example and not limitation — the countries of the European Union, the European Economic Area, and the United States of America, when relying on technology service providers within those countries. You may obtain the complete and updated list of countries and the safeguards applied from the Data Protection Officer at: dataprotection@efghldg.com

 

We retain your personal data for as long as necessary to achieve the purpose for which it was collected, or for a period required by law, whichever is longer:

Data Category	Retention Period	Legal Basis for Retention
Client identity data (name, ID number, address)	5 years from the end of the contractual relationship	Legal obligation — Anti-Money Laundering Law
Financial data and transaction records	5 years from the date the transaction is completed	Legal obligation — Anti-Money Laundering Law
Browsing data and analytical cookies	5 years	Consent
Correspondence and enquiry records	5 years from the date of correspondence	Legal obligation / Legitimate interests
Marketing message data	5 years from last contact or until consent is withdrawn	Consent
Data relating to legal claims or disputes	Until the final conclusion of the legal proceedings	Establishment, exercise, or defense of legal claims

 

Law No. 151 of 2020 guarantees you the following rights, and the controller is obliged to respond within six (6) working days of receiving your request:

Right	Description
Right to be informed and notified	The right to know how your data is processed, and to be notified in the event of a data breach within 3 working days of notifying the Centre.
Right of access and to obtain a copy	The right to access your personal data and obtain a copy of it.
Right to rectification	The right to request correction of inaccurate or incomplete data.
Right to erasure (right to be forgotten)	The right to request deletion of your data when the processing purpose has been fulfilled or consent withdrawn.
Right to restrict processing	The right to restrict the processing of your data and limit it to storage in specific cases.
Right to object	The right to object to processing that contradicts your rights or causes material or moral harm.
Right to data portability	The right to request the transfer of your data to another controller in a structured, machine-readable format.
Right to withdraw consent	The right to withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact the Data Protection Officer using the details in Section 2 above.

 

Cookie Type	Description
Strictly necessary cookies	Essential to the functioning of the website; do not require consent.
Analytical/performance cookies	To measure and improve website usage; require your consent.
Social media cookies	Facebook and Twitter sharing; require your consent.

You can manage your preferences or withdraw your consent at any time via the cookie preferences tool at the bottom of the website.

App Permissions:

The application may request the following permissions to operate specific features, and you may grant or withdraw them at any time from your device settings:

Permission	Purpose
Camera	To capture the verification photo (Selfie) and scan documents during registration.
Location (GPS)	For the purposes described in the data categories section above.
Notifications	To send account, transaction, and security alerts.
Fingerprint / Face Recognition (Biometric Login)	To secure access to the application; processed locally on your device and not stored by us.

 

• Directly from you: via registration, contact forms, and financing requests.
• Automatically: browsing data and IP address upon visiting the website.
• From third parties:
  • Entities within the Company's group (the “Group”), whose identities can be found in the link referenced in Section 6 above.
  • Publicly accessible sources, including publicly available online profiles and databases, for the purposes of establishing and verifying your identity, deriving your contact details, and supplementing the contact information we hold about you.
• Via cookies and similar tracking technologies: as set out in Section 10 above.
• Via email: we retain copies of correspondence for documentation and legal compliance purposes.
• Via telephone communications: when you contact us, telephone calls may be recorded for the purposes of documenting the instructions and orders issued by you, verifying transactions, resolving complaints and disputes, improving service quality, training, and complying with legal and regulatory requirements.

 

a. Contact Hermes Securities Brokerage Company S.A.E. first:

We encourage you to contact the Data Protection Officer (Section 2) to resolve any issue relating to your data. We will respond within six (6) working days.

b. Lodge a complaint with the Personal Data Protection Centre (PDPC):

If the matter is not resolved, you have the right to lodge a complaint directly with the Egyptian Personal Data Protection Centre:

Entity	Personal Data Protection Centre (PDPC)
Website	www.pdpc.gov.eg

 

We review this Notice periodically. Where material changes are made, we will notify you before they take effect.

Current Version	1.1
Issue Date	July 2026
Reference Law	Law No. 151 of 2020 and its Executive Regulation No. 816 of 2025