Privacy Notice

Karim Othman

Creative Direction & Brand Design
karimothman.com

Effective: 29 September 2026 ·

Version 1.0
Issued under the Egyptian Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (Prime Ministerial Decree No. 816 of 2025)

1. Who I am

I am Karim Othman, an independent creative director and brand designer operating as [sole practitioner / a company registered in Egypt under commercial register no. 000000 and tax card no. 000-000-000 — choose one and complete], based at [FULL ADDRESS, CITY, EGYPT].

For the purposes of the Personal Data Protection Law No. 151 of 2020 ("the PDPL") I am the data controller for the personal data described in this notice, except where section 3 states that I act as a data processor for a client.

Personal Data Protection Centre registration: [licence / permit no. — insert once issued]
Data Protection Officer: [Karim Othman / NAME], registered with the Centre under [reference]
All privacy matters: hello@karimothman.com

This notice covers karimothman.com and its subdomains, enquiries and briefs sent to me, client engagements, production work (shoots, interviews, research), my mailing list, and the publication of finished work. It does not cover third-party sites I link to, or platforms I design that are owned and operated by a client under their own privacy notice

5. What I collect

5.1 Website visitors

IP address, browser and device type, operating system, screen size, referring URL, language; pages viewed, time on page, projects opened, files downloaded, outbound links clicked; cookies as described in section 9. Server logs are kept [30 days] for security and diagnostics.

5.2 Enquiries and prospective clients

Name, company, role, email, phone, and whatever you tell me about the project — budget range, timelines, brand position, competitors, internal context. Briefs routinely contain confidential commercial information. I treat them as confidential from the moment they arrive, NDA or not.

5.3 Clients

Contracting and billing contacts; signatory details; commercial register and tax card details; bank or payment details; purchase orders; correspondence and meeting records; feedback and approval history; brand assets and source files you supply.

5.4 Production and research participants

Where a project involves photography, film, interviews, casting, workshops, or user research: name and contact details; images, audio, and video; likeness and voice; sizing and fit notes; accessibility requirements; travel and expenses; [dietary requirements]; the scope of rights granted; and payment details for fees.

5.4 Production and research participants

Participation is voluntary. Recordings are made only under a signed written release stating where the material may be used and for how long.

5.5 Collaborators and suppliers

Name, trading name, contact details, portfolio and rates, engagement terms, national ID or commercial register details where required for payment or contracting, invoices and payment records.

5.6 Applicants and speculative portfolios

CVs, portfolios, cover letters, links, references, interview notes. Unsolicited portfolios are kept [6 months] and then deleted unless you ask me to keep them on file.

5.7 Mailing list

Email address, name, [company], how you subscribed, and whether you opened or clicked — used only to judge whether the mailing is worth sending.

5.8 What not to send me

Please don't send sensitive personal data — health, biometric, financial, religious, or political information — unless I've specifically asked for it for a stated production or accessibility purpose, because Egyptian law imposes a higher standard on it and criminal penalties for getting it wrong. Don't send payment card numbers by email; use the payment link on the invoice.

5. What I collect

7. Confidentiality and embargoes

Client material is confidential by default:

Briefs, strategy, unlaunched identities, and pricing are shared only with the specific collaborators working on the engagement, each under written confidentiality terms.
Embargoed work is not shown, described, listed, posted, or entered for awards until the client confirms the embargo has lifted.
Where a signed NDA is stricter than this notice, the NDA governs.
I won't name a client or reproduce their marks without the rights set out in section 8.

5. What I collect

8. Portfolio, case studies, and image rights

Showing the work is how the practice earns the next engagement. It is also a use of someone else's personal data and image, and Egyptian law protects a person's right to their own likeness. So:

I publish completed work in my portfolio, on social channels, in award submissions, press, and new-business materials where the engagement agreement grants that right, or the client has approved it in writing. Where approval is required, I ask before first publication and keep the record.
Images of identifiable people are published only within the scope of their signed release. No release, no face.
Fees, revenue figures, and internal metrics are published only with written permission, or anonymised so they can't be attributed.
Takedown: any client or person featured may request removal at hello@karimothman.com. I'll remove it from everything I control within [30 days]. I can't compel press, aggregators, or award archives to remove material they've reposted, and I'll tell you honestly where that limit sits.
I credit collaborators by name where they want credit, and leave them out where they don't.

5. What I collect

9. Artificial intelligence

I use generative and machine-learning tools in parts of the process — [image generation, transcription, research, drafting, code assistance]. Because those tools process whatever is uploaded to them, these rules apply:

No confidential client material, personal data, or unlaunched work goes into a consumer or free-tier AI service. Where AI is used on client work, it's through [business-tier accounts whose terms prohibit training on my inputs and outputs].
No training on client material. Where a setting or contractual term exists to prevent a provider training on my inputs, it is switched on.
A person makes every decision. No automated system makes a decision about you that produces legal or similarly significant effects.
Likeness is protected. I do not generate or train synthetic likenesses of identifiable people from production material without a separate, specific written consent saying so. A standard model release does not cover synthetic recreation.
Disclosure. Where AI materially shapes a deliverable, I tell the client and record it in the project file.
Your rules win. If your contract restricts AI use further, say so at kick-off and I'll follow it.

Note that most AI tools are hosted outside Egypt, so section 12 applies to them.

5. What I collect

10. Cookies

Nothing but strictly necessary cookies is set until you consent. Rejecting is one click, with the same visual weight as accepting. You can change your mind at any time at [link to cookie settings]. Full details of each cookie and its duration are in the [Cookie Notice].

Email tracking. My mailing list records opens and clicks. Blocking remote images stops open tracking; unsubscribing stops all of it.

Direct electronic marketing. Under Article 28 of the Executive Regulations, direct electronic marketing in Egypt requires a specific permit from the Centre and the prior consent of the recipient. Every marketing email I send identifies me as the sender, gives a valid contact address, is clearly identifiable as marketing, and carries a working unsubscribe link. I keep the record of your consent for as long as I hold your address.

5. What I collect

11. Who I share data with

I do not sell personal data.

Service providers. Each is engaged under terms restricting them to my instructions:

Collaborators. Photographers, retouchers, developers, illustrators, motion artists, copywriters, producers, printers, and fabricators — each under confidentiality terms, each given access only to what the task requires.

Advisers. Lawyers and accountants, under professional duties of confidence.

Authorities. Where disclosure is required by Egyptian law, by a court, or by a competent authority acting within its powers — including obligations that apply to service providers under the Anti-Cyber and Information Technology Crimes Law No. 175 of 2018. I disclose the minimum required and, where I am lawfully permitted to tell you, I will.

5. What I collect

12. Transfers outside Egypt

This is the part of Egyptian law that differs most from the rest of the world, and I'd rather state it directly than bury it.

Under the PDPL and its Executive Regulations, personal data may be transferred outside Egypt only where the destination provides protection no less than Egyptian law, and only under a licence or permit issued by the Personal Data Protection Centre, in addition to the consent of the data subject. The permit names the destination country, and a change of destination needs fresh approval.

Because I use internationally hosted tools, some data will be stored or processed outside Egypt. My position:

[Cross-border transfer permit no. — insert once issued / Application submitted on DATE]
Where a transfer is not covered by a permit or a statutory exception, I keep the data in Egypt or use a local alternative.
Where I act as a processor for a client, I transfer their data only on their written instruction and only under the same safeguards.
You may request details of the safeguards applied to any specific transfer at hello@karimothman.com.

For clients in the EU, UK, or EEA: Egypt is not the subject of an EU adequacy decision. If you are sending me personal data from the EEA or UK, we will need Standard Contractual Clauses (or the UK International Data Transfer Addendum) plus a transfer risk assessment, alongside the Egyptian permit on my side. I have a template ready; ask and I'll send it with the proposal.

5. What I collect

14. Your rights

Under the PDPL you have the right to:

Know what data I hold and be informed before it's collected.
Access a copy of it.
Correct anything inaccurate, incomplete, or out of date.
Erase it where I no longer have a basis to keep it.
Restrict processing while a dispute is resolved.
Object to processing, and to direct marketing at any time, absolutely.
Withdraw consent at any time — including withdrawing a release for future use of your likeness. Withdrawal doesn't undo lawful prior use, or retrieve copies already published.
Be informed of a breach affecting your data.
Complain to the Personal Data Protection Centre.

How to exercise them. Email hello@karimothman.com with "Privacy request" in the subject line.

I will respond within six (6) business days, which is the period Egyptian law allows — considerably shorter than the one month you may be used to under European law. I may need to verify your identity first. There's no charge.

If your request concerns data I hold as a processor for a client, I'll pass it to them without delay and tell you who they are.

Complaints. If you're unhappy with my answer, you can complain to the Personal Data Protection Centre, the supervisory authority established under the Ministry of Communications and Information Technology. I'd appreciate the chance to fix it first.

5. What I collect

15. Data breaches

If personal data I hold is lost, disclosed, altered, or accessed without authorisation, I will:

notify the Personal Data Protection Centre within 72 hours of becoming aware of it, and immediately where the breach touches national security;
notify affected individuals within three (3) working days of notifying the Centre, where the breach is likely to cause them harm;
where I act as a processor, notify the client controller without delay so they can meet their own obligations;
keep a written record of the breach, its effects, and the remedial action taken.

5. What I collect

16. Security

I apply measures appropriate to the risk: [TLS 1.2+ in transit and encryption at rest; multi-factor authentication on every account; a managed password vault; least-privilege access reviewed quarterly; full-disk encryption on all devices; automatic screen lock; separate client workspaces; signed confidentiality terms for every collaborator; supplier checks before onboarding; encrypted versioned backups; documented incident response].

No system is perfectly secure. Section 15 sets out what happens if something goes wrong.

5. What I collect

17. Children

My services are directed at businesses, not children. Under Egyptian law, data relating to children under 15 is sensitive personal data and requires the explicit written consent of a legal guardian.

Where a project involves minors — casting, family photography, youth research — I obtain guardian consent in writing, a guardian-signed release, and apply tighter limits on publication and retention. If you believe I hold a child's data without proper consent, email hello@karimothman.com and I'll delete it.

5. What I collect

18. Clients and visitors outside Egypt

Where I process the personal data of people in the EU, UK, or EEA in a way that brings me within the scope of the GDPR or UK GDPR, I also honour the rights and obligations those laws impose — including the right to data portability, the right not to be subject to solely automated decision-making, and the transfer safeguards described in section 12.

Where I process the data of residents of US states with comprehensive privacy laws (California, Colorado, Connecticut, Virginia, and others), I confirm that I do not sell personal information or share it for cross-context behavioural advertising, I honour Global Privacy Control signals, and I will not treat you differently for exercising a right.

Where Egyptian law and a foreign law both apply and conflict, I'll comply with the stricter standard and tell you which one I've applied.

5. What I collect

19. Changes

I review this notice at least annually, and whenever my tools, suppliers, or activities change materially. The version and effective date are at the top. Material changes are announced by email to clients and subscribers, and by a notice on karimothman.com for [30 days] before they take effect. Previous versions are available on request.

5. What I collect

20. Contact

Karim Othman
[FULL ADDRESS, CITY, EGYPT]
hello@karimothman.com
karimothman.com
[Commercial register no. / Tax card no.]
[PDPC licence no.]

Supervisory authority: Personal Data Protection Centre, Ministry of Communications and Information Technology, Egypt.

Karim Othman