We use your data to operate and improve the ordering and delivery service and secure your account. We do not sell your personal data and only share it as necessary to provide the service, meet a legal obligation or with your consent.
1. Definitions and scope
This policy applies when you use the Tolba app, website and related services. For the purposes of this policy:
- Account: the account you create to access Tolba’s services.
- App or service: the Tolba app, website and the services it provides.
- Company or we: the entity operating the Tolba service.
- Personal data: any information relating to an identified or identifiable person.
- Service provider: any person or company processing data on our behalf to provide part of the service.
- Usage data: data collected automatically through use of the app or its technical infrastructure.
- User or you: the person accessing or using the service.
2. Data we collect
Data you provide
We may request data needed to create an account, place an order and communicate with you, including:
- Your name, phone number and email address when available.
- Delivery addresses, address details and the point you select on the map.
- Details of orders, products, stores and the pickup or delivery method.
- Support requests, correspondence, complaints and feedback you send us.
Usage and device data
We may automatically collect device type, operating system, app version, device identifiers, network address, access times, pages or features used, and crash and diagnostic logs. This data helps us protect the service, troubleshoot issues and improve performance.
Location data
With your permission, we may use your device location to identify your service area, show available stores, calculate delivery coverage and help you choose your address. You can disable location permission in your device settings, but some features may not work correctly.
Payment data
When you choose online payment, an approved payment provider processes the transaction. We may receive the transaction reference, status, amount and payment method, but we do not ask you to store full card details in Tolba’s systems.
Cookies and measurement technologies
The website may use cookies or similar technologies to operate sessions, remember choices, understand service usage and improve it. You can control these files in your browser settings.
3. How we use your data
We may use data for the following purposes:
- Creating an account, verifying your phone number and managing sign-in.
- Creating and fulfilling orders, updating their status and enabling communication between the customer, vendor and driver when needed.
- Processing payments, refunds and settlements, and preventing fraud.
- Sending order, security and support notifications and important service changes.
- Saving addresses, preferences and favourites and providing a suitable user experience.
- Responding to support requests and resolving disputes and complaints.
- Analysing performance, fixing crashes, developing features and improving usability.
- Meeting legal obligations and protecting our rights, users’ rights and service integrity.
- Sending offers or marketing messages where permitted by law, with the option to stop them at any time.
When we share data
We may share the minimum necessary data in the following cases:
- With the vendor and driver: to fulfil and deliver an order or prepare it for pickup.
- With service providers: such as hosting, storage, maps, notifications, payments, support, analytics and verification messaging.
- In business transactions: during a merger, acquisition or transfer of part of the business, with appropriate data safeguards.
- For legal and security reasons: to meet a legal obligation, respond to a valid request from a competent authority or protect the service and users.
- With your consent: for another purpose we explain to you and obtain your consent for.
We do not sell phone data or messaging consent data to any party for marketing or promotional purposes.
4. Text messages and verification codes
Text messages
When you consent to receive messages, we may retain your phone number, the date and method of consent, and delivery and read data. Messages may include customer service, account alerts, order and delivery updates, verification codes, security alerts and permitted offers.
Consent to marketing messages is not a condition of purchasing or using the service. You can opt out by replying STOP or request help by replying HELP. Your carrier’s message and data rates may apply, and message frequency may vary.
WhatsApp verification codes
Tolba uses WhatsApp messages to verify phone ownership during registration, sign-in and certain sensitive steps. A temporary code is generated for a limited period and becomes invalid after use or expiry.
We use Meta’s official WhatsApp Business Platform to send approved message templates. We only share the minimum data needed to send the message: the phone number and temporary verification code. We do not use the verification code channel for marketing content.
Third-party service providers: Tolba may use providers for infrastructure, storage, notifications, payments, maps and verification messages. Their access is limited to data necessary to deliver the agreed service, subject to appropriate confidentiality and security safeguards.
5. Data retention
We retain personal data for as long as needed for the purposes in this policy, to meet legal obligations, resolve disputes, enforce agreements or protect the service against fraud and security risks.
- Account data: while the account exists and for up to 24 months after closure to address follow-up matters or disputes.
- Support data and correspondence: for up to 24 months after the request is closed to follow up enquiries, improve quality and defend legal claims.
- Usage data and server logs: for up to 24 months for security, diagnostics and service improvement.
We may retain some data longer if required by law, needed for a legal claim, expressly requested by you, or if an encrypted copy remains in backups scheduled for periodic deletion.
When data is no longer needed, we delete it or remove its connection to your identity. Limited copies may remain in encrypted backups, and we may retain anonymised statistics that cannot be linked to you.
International data transfers
Data may be processed where we or our service providers operate, which may be outside your country of residence. Where required, we apply appropriate safeguards to protect data during transfer and processing under applicable laws.
6. Your rights and data deletion
Under applicable law, you may request access to, correction, updating or deletion of your data, or object to certain uses. You can edit some information in your account settings or contact us to exercise your rights.
We may need to verify your identity before acting on a request. We may retain some information where we have a legal obligation or legitimate basis to do so.
To delete your account, use the in-app account deletion option if available, or contact support with the phone number linked to your account. We will explain the steps and any data that must be retained by law.
Legal disclosure
We may disclose your data in response to a valid legal request, to protect Tolba’s rights or property, investigate suspected misuse, protect the safety of users and the public, or address legal liability.
Data security
We use reasonable technical and organisational measures to protect data against unauthorised access, use, modification or disclosure. However, no electronic transmission or storage method is completely secure, so full protection cannot be guaranteed in all circumstances.
7. Children and minors
The service is not directed at people under 16, and we do not knowingly collect their personal data. If you are a parent or guardian and believe a child has provided us with data, contact us so we can review the matter and delete the data as soon as possible.
If the law in a user’s country sets a higher age for consent to data processing, we may request parental consent before collecting or using data where consent is the legal basis for processing.
8. External links
The service may link to websites or services we do not operate. We recommend reviewing each website’s privacy policy because we do not control, and are not responsible for, other parties’ content or privacy practices.
9. Changes to this policy
We may update this policy from time to time. We will publish the new version on this page and update the last modified date. For important changes, we may send a notice within the service or through an appropriate communication channel. Changes take effect when published unless another date is stated.
10. Order cancellation and online payment refunds
Under the current operating policy, when cancellation is accepted for an order verified as paid by bank card or electronic wallet, the eligible amount is credited to your Tolba points balance for future orders instead of being automatically returned to the card or wallet. Each point equals one Egyptian pound for purchases within Tolba, and refund points can be used at stores available on the platform.
Cancellation compensation in points equals the amount paid electronically for the order, excluding the online payment processing fees disclosed at checkout. For example, if you paid EGP 100 for the order and EGP 3 in online payment fees, compensation is 100 points, not 103 points.
The points policy and exclusion of fees do not reduce any mandatory legal right. If the law requires a refund to the original payment method or a refund of fees, those rights apply and support will review the case. Using the service does not waive those rights.
You can request cancellation within the period displayed in the app. After that period or once fulfilment starts, contact support to review the order and refund eligibility. Closing the payment screen alone does not confirm cancellation or payment failure; compensation is recorded after payment and cancellation eligibility are verified.
If you paid part of the order with points, those points are returned separately under their terms and are not counted again in compensation for the electronically paid portion. Promotional gifts and coupons have their own terms and do not convert to cash. Order refund points differ from promotional gifts and cannot be withdrawn as cash within the app, without prejudice to statutory refund rights.
Some exceptional cases may be processed through the original payment method, such as a refund already initiated with the payment provider or correction of a duplicate payment. The same amount cannot be refunded in cash and compensated in points. When a refund is processed through the payment provider, the time for it to appear depends on the bank or wallet provider.
Check your order status and points balance in the app. If money was deducted but the order or compensation does not appear, contact us with the order number or transaction reference. Do not send your full card number, security code or verification code.
11. Contact us
If you have a question about this privacy policy or would like to exercise a right, please contact us.