Cookie & Privacy Notice

Part A — English

Version 1.0 · Effective 1 November 2026

This notice applies to the WeLend websites, including welend.credit and our merchant portal, where businesses sign up and complete onboarding.

1. Who we are

WeLend runs the WeLend websites, including welend.credit and our merchant portal. We help Egyptian businesses get financing against their invoices and for working capital.

For the personal data described in this notice, WeLend is the controller: we decide why and how it is used. You can contact us, and our Data Protection Officer, at privacy@welend.credit. As Law No. 151 of 2020 (Article 8) requires, WeLend has appointed a Data Protection Officer and will register the appointment with the Personal Data Protection Center (PDPC).

This notice covers what happens when you visit our websites and sign up. Once you start an application, our Privacy Policy also applies; it explains how we handle your application, documents, Tax Authority data and sharing with lenders. You can read it at https://welend.credit/en/legal#privacy.

2. What we collect on our websites

Information you give us. When you contact us or sign up, we collect what you enter, such as your name, work email, mobile number, company name and role.

Information collected automatically. Our servers record technical information needed to run and protect the websites: IP address, browser and device type, pages requested, date and time, and error and security logs.

Cookies and similar technologies. Cookies are small files saved by your browser. Some are needed for the website to work. Others are used for analytics and marketing, only if you agree (see Section 4).

Website journey events (only with your consent). If you allow Analytics or Marketing, we record steps of your visit, for example: landing on the site, pages viewed, signup started, account created, each onboarding step completed, Tax Authority account connected, and application submitted.

What we never send to analytics or advertising tools. These tools receive only event names and technical identifiers (such as random cookie IDs or event IDs). We never send them your name, phone number, email, national ID or tax ID, invoice data, bank data or documents, and we do not put these details in web addresses (URLs).

3. Why we use your data and our legal basis

Purpose	Data	Legal basis under Law No. 151 of 2020
Run the websites, sign you in and create your account	Signup details, sign-in session cookie, technical data	Necessary to perform a contract with you, or a step you ask us to take before one (Law 151, Article 6(2))
Keep the websites and accounts secure and prevent fraud	Technical data, security logs, sign-in session cookie and security tokens	Our legitimate interest in security (Article 6(4)), and our legal obligations to protect data (Article 6(3))
Remember your cookie choice and keep proof of it	Consent cookie and consent record	Legal obligation to keep proof of consent under the Executive Regulations (Article 6(3))
Understand how the websites are used and improve them (Analytics)	Analytics cookies and journey events	Your consent
Measure whether our ads lead to visits and signups (Marketing). We use Marketing tools for ad measurement only, not to build ad audiences or for retargeting	Marketing cookies, ad click IDs and journey events	Your consent
Answer your questions	Contact details and your message	Your request (contract, Article 6(2)) or our legitimate interest (Article 6(4))

4. Cookie categories

You choose by category in our cookie banner. Nothing in Analytics or Marketing loads until you click Accept all or switch that category on and save. If you click Reject all, only Necessary cookies are used. Rejecting does not affect your access to the websites or to financing.

Necessary (always on): needed for sign-in, security and remembering your cookie choice. They cannot be switched off, but they are not used for analytics or advertising.
Analytics (off unless you agree): help us count visits and see which pages and steps work or cause problems.
Marketing (off unless you agree): help us measure whether our ads on Meta (Facebook and Instagram) and in ChatGPT lead people to sign up.

Cookie and tracker table

Cookie names and expiry periods for third-party tools are set by their providers and may change. We will update this table when they do.

Category	Name / tool	Provider	Purpose	Data	Expiry	Where
Necessary	Sign-in session cookie (welend_merchant_session, welend_lender_session, welend_session). Set only when you sign in	WeLend	Keeps you signed in to the WeLend portals, including the merchant portal	Random session ID	12 hours from your last activity, renewed while you are active; you must sign in again after 30 days at most; deleted when you sign out	Belgium (Google Cloud region europe-west1)
Necessary	welend_consent	WeLend	Remembers your cookie choice across the WeLend websites on welend.credit	Random consent ID, choices, banner version, date	12 months	Your browser; record on our servers in Belgium (Google Cloud region europe-west1)
Analytics	Google Analytics 4 (_ga, _ga_*)	Google LLC	Counts visits; shows which pages and steps are used	Random client ID, pages viewed, journey events, device and browser, approximate location (such as country). Your IP address is used briefly to derive this location and is then discarded; Google states it is not logged or stored in Analytics. Google signals and ad personalisation are turned off	12 months	United States
Marketing	Meta Pixel (_fbp, _fbc)	Meta Platforms, Inc. (independent controller for its own advertising purposes)	Measures whether Meta ads lead to visits and signups	Random browser ID, ad click ID (fbclid), page address, journey events, IP address and device data	90 days	United States
Marketing	OpenAI ChatGPT Ads Measurement Pixel (oaiq; cookies __oppref, __obref)	OpenAI OpCo, LLC (independent controller)	Measures whether ads in ChatGPT lead to visits and signups	Ad click reference (oppref), journey events and event IDs, page origin, IP address and device data	__oppref 30 days from the last ad click it records; __obref 365 days from when it is set. Set only while you consent. If you withdraw consent, the pixel's own __oaiq_consent cookie and a browser-storage entry stay; they record only your refusal, so the pixel stays off	United States
Marketing	Google Tag Manager (container GTM-T2BV73V8)	Google LLC	Loads and manages the marketing tags above; loads only if you chose Marketing	Page address, device and browser data, IP address (to deliver the script)	Tag Manager itself sets no cookies. The tags it loads (listed above) may set their own, and they load only after you consent	United States
Marketing	Meta Conversions API (server-to-server)	Meta Platforms, Inc.	Same purpose as the Meta Pixel, sent from our servers, only for visitors who chose Marketing	Event names, random event IDs, Meta browser and ad-click IDs (_fbp, _fbc), page address without query string. No email, phone, name or account ID	Meta keeps event data for up to 2 years	United States

We send Meta Conversions API events from our servers only for visitors who chose Marketing. We do not send your email, phone, name or account ID to Meta. If that ever changes, we will update this notice and ask for your consent first.

Meta and OpenAI may also use cookies on their own websites (for example, if you are signed in to Facebook, Instagram or ChatGPT) to link these events to their own users. Their own privacy policies apply to that use. Meta and OpenAI act as separate (independent) controllers for their own use of this data.

5. Transfers outside Egypt

Google, Meta and OpenAI process tracker data in the United States, and possibly elsewhere. This happens only if you accept Analytics or Marketing. We transfer data outside Egypt only as Law No. 151 of 2020 (Articles 14 to 16) and its Executive Regulations allow, under written terms with each provider, and we will apply to the Personal Data Protection Center (PDPC) for any licence or permit the law requires. Our websites and their databases are hosted by Google Cloud EMEA Ltd in Belgium (Google Cloud region europe-west1).

6. How to change or withdraw your consent

Click "Cookie settings" at the bottom of any page on our websites. You can switch each category on or off at any time. Withdrawing is as easy as giving consent.
When you withdraw, the tools in that category stop at once, and we delete their cookies set on our domain where technically possible. Withdrawal does not affect use before you withdrew.
You can also block or delete cookies in your browser settings. If you block Necessary cookies, sign-in may not work.
Your choice applies to the browser and device you used. We will ask again if we change the categories or tools, and at least every 12 months.

7. Your rights

Under Law No. 151 of 2020, you have the right to:

know, review and get a copy of the personal data we hold about you;
withdraw your consent at any time;
correct, update, complete or delete your data;
limit our processing to a specific purpose;
be told about any breach affecting your personal data; and
object to processing, or its results, where it conflicts with your fundamental rights and freedoms.

To use these rights, email privacy@welend.credit. We may need to check your identity. We will reply within six working days (Law 151, Article 32). We do not charge a fee for these requests. Withdrawing a cookie consent does not affect any application or financing.

You can also complain to the Personal Data Protection Center (PDPC) at https://pdpc.gov.eg.

8. How long we keep data

Data	How long
Sign-in session cookie	12 hours from your last activity, and no more than 30 days; deleted when you sign out
Your cookie choice (in your browser)	12 months, then we ask again
Consent records (proof of your cookie choice)	If you are not signed in: while your choice is in effect (no more than 12 months), plus 5 years. If you are a signed-in user: for as long as our relationship lasts, plus at least 5 years
Analytics data in Google Analytics	14 months (GA4 data-retention setting)
Marketing cookies	See the expiry column above. Meta keeps event data for up to 2 years. Google deletes it within 180 days after processing ends. OpenAI keeps it under its Ad Tools data processing terms and Advertising Terms
Server and security logs	Application logs 30 days; security logs 400 days
Signup data if you never submit an application	We keep it for no longer than 6 months after your last activity, after which we delete or anonymise it as part of our regular data reviews, unless the law requires us to keep it longer
Applications and financing	We keep declined or withdrawn applications for no longer than 6 months, after which we delete or anonymise them as part of our regular data reviews, unless the law requires us to keep them longer. Know-your-customer and financing records at least 5 years after the facility closes, as the Anti-Money Laundering Law No. 80 of 2002 requires. Our Privacy Policy gives more detail

Data may be kept longer only where the law requires it or while a dispute or official request is open.

9. Security

We use encryption in transit (HTTPS) and at rest, access limited to staff who need it, multi-factor sign-in for staff, logging, and contractual terms with our service providers, which we are putting in written data-processing agreements where missing. Tracking tools are loaded only after consent and receive only event names and technical IDs. No system is completely secure; if a breach affects your personal data, we will tell the PDPC within 72 hours of becoming aware of it, and tell you within 3 business days after that, as Law No. 151 of 2020 (Article 7) and its Executive Regulations require.

10. Children

Our services are for businesses and their representatives. They are not meant for anyone under 18, and we do not knowingly collect children's data.

11. Contact us

Privacy questions and requests, and our Data Protection Officer: privacy@welend.credit

Complaints: Personal Data Protection Center (PDPC), https://pdpc.gov.eg

12. Changes to this notice

We may update this notice, for example when we add or remove a tool. We will change the version and date at the top. If a change affects what you agreed to, we will show the cookie banner again and ask for your choice before any new tool runs.