Go Online — Privacy Policy
This policy covers the Go Online website, every shop website and shop app built with Go Online in Egypt, and the business dashboard.
1. Who is responsible for your data
1.1 Go Online is operated by SBSUCCESS LTD, a private company limited by shares registered in England and Wales, registered office 128 City Road, London, United Kingdom ("we"). Privacy contact: [email protected].
1.2 Two kinds of responsibility.
- We are responsible (controller) for data about businesses and their staff, the waitlist, billing, security and abuse prevention, our logs, the directory and the shared product catalog.
- Each shop ("Merchant") is responsible (controller) for how it uses the details you send it with a Request — to prepare, deliver and follow up your order, booking, enrolment or quote. For that data, we store it and pass it on for the Merchant as its service provider (processor), and we also use it for our own limited purposes in section 4 (running and securing the platform, billing, legal duties).
2. What we collect
| Who | Data | Where it comes from |
|---|---|---|
| Shoppers | name and phone number; delivery address for deliveries; the note you add to an order; the message you write with a quote request (up to 1,000 characters); first names of the people attending a class you book (they may be children); the Request itself (items or service, time, status) | you, when you send a Request |
| Shoppers | the reason a Merchant gives when it rejects or cancels your Request | the Merchant |
| Businesses and staff | account holder's name, email and phone number; password (stored only as a one-way hash); staff accounts; business profile, catalogue, photos and opening hours; balance, fees and billing records | you |
| Waitlist | business name, type and country; the email or phone number you give | you |
| Technical data | IP address of each request; date, time, page or route and result; coarse device data (device class, operating system, browser family and major version, language, whether the app is installed) — no device fingerprinting | your browser or app |
| Acceptance records | which version of which legal page (by its fingerprint) was accepted or shown, when, in which language, on which screen and app version, and with which account or Request; for accounts, the pseudonymous code of the IP address (never the address itself); for Requests sent without an account, no IP code | our systems |
| Records of actions | which member of our staff did what, when, on which business (for example a change of a shop's status or balance), with ids and reason codes | our systems |
We do not collect medical records (section 3), we do not collect card numbers, and we do not buy data about you.
3. Health information
3.1 No medical records. For doctors, dentists, clinics and laboratories we keep booking details only: the service, the time, and your name and phone number. Booking forms for health businesses have no free-text note. Please do not send symptoms, diagnoses, test results or prescriptions through Go Online.
3.2 Requests can still reveal something about your health. A request to a pharmacy (for example for a medicine) or a booking at a laboratory can show that you or someone close to you may have a health need. We show such a Request only to the business you sent it to and to our staff who need it to run and secure the service, and we keep it only as section 8 says.
3.3 Prescription medicines cannot be ordered through checkout. You can send a request, and the pharmacy contacts you to confirm your prescription outside Go Online. Nothing is uploaded.
4. Why we use it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Pass your Request to the Merchant and show you its status | Request data | the service you ask for; the Merchant's instructions |
| Run business accounts, fees and billing | business data | our contract with the business; accounting law |
| Keep proof of which terms were accepted or shown, and ask again when they change | acceptance records | our legal duties; our legitimate interest in being able to show what was agreed |
| Keep Go Online secure; stop fake Requests, fraud and abuse | technical data, Request data, records of actions | our legitimate interest; legal duties |
| Fix errors and measure speed (with totals that identify no one) | technical data | our legitimate interest |
| Tell you when Go Online opens for businesses like yours (waitlist) | waitlist data | your consent, which you can withdraw at any time |
| Answer questions, complaints and legal requests | what you send us | your request; legal duties |
| Comply with the law and with orders of competent authorities | any, as required | legal duty |
What we never do: we do not sell personal data, we show no advertising, and our websites load no third-party trackers or analytics scripts. We make no automated decisions with legal or similarly significant effects on you. Automated checks of product listings never receive Shopper data.
5. Who receives your data
5.1 The Merchant you send a Request to receives your name and phone number, and your address for a delivery. For a quote request, it sees your phone number only after it accepts the request. The Merchant then uses these details under its own responsibility.
5.2 Our service providers, who process data only on our instructions, under contract:
| Provider | What it does | Data | Where |
|---|---|---|---|
| LightNode | our servers and database | all data | France (Marseille) |
| Cloudflare | network protection, content delivery, DNS; storage of photos, published shop pages and our encrypted backups | traffic passes through it; photos; encrypted backups | worldwide network; storage in Europe |
| Backblaze | second copy of our encrypted backups; recovery copy of photos | encrypted backups; photos | EU (Netherlands) |
| Google Cloud | our logs | technical data, with your IP address replaced by a pseudonymous code | EU (Belgium) |
| Resend | sending our emails (confirmations, password resets, notices) | email address, message | EU (Ireland) |
| Google Workspace | our mailbox for support and legal requests; a spreadsheet to contact one country's waitlist at a time | what you write to us; waitlist contacts we export for outreach |
This list was last changed on the date this policy took effect. We publish any change here, with its date, at least 30 days before a new provider receives Shopper data.
5.3 Authorities, when the law requires it or a competent court or authority orders it.
5.4 A company that takes over Go Online in Egypt, including a company of our group, under the same protections.
6. Public information
A shop's profile, contact details, catalogue and photos are published on its website, its app and in the directory, and copied to our content delivery network so pages load fast. Shopper details are never public.
7. Where your data is processed
Our servers and storage are outside Egypt — in France, elsewhere in Europe and on Cloudflare's worldwide network (section 5.2). We choose providers that protect your data by contract. Our company is in the United Kingdom.
8. How long we keep it
| Data | How long |
|---|---|
| Requests (orders, bookings, enrolments, quote requests) | kept so the Merchant and you can see them; made anonymous two years after the Request closes — your name, phone number, address, note, message and attendee names are removed; numbers, amounts and dates stay for billing records |
| Business accounts | while the account is open; after you ask us to close it, deleted within 90 days, except billing records that accounting and tax law require us to keep (up to 6 years) |
| Waitlist | unconfirmed entries are deleted after 7 days; confirmed entries are deleted once we have contacted you about Go Online opening in your country, and at the latest 12 months after you joined. Exported copies for outreach are deleted after the outreach, and searched when you ask us to erase your data |
| Logs at our log service (Google Cloud) | 30 days, then deleted automatically. They hold ids and a pseudonymous code instead of your IP address — no names, phone numbers, email addresses or street addresses |
| Logs on our servers | overwritten automatically when they reach a fixed size; they can contain IP addresses |
| Acceptance records | while the account exists and for 10 years after it closes (for a Request sent without an account, 10 years after the Request); they hold ids and codes only and are never changed |
| Records of actions | kept while needed for security, disputes and our legal duties |
| Database backups | one encrypted copy every night, stored in two places, each locked for 30 days so nobody — not us, not an attacker — can change or delete it early, then deleted automatically about 31 days after it was made (the provider's daily run can add one day). Data deleted from Go Online, also after a deletion request, can therefore remain in backups for about 31 days |
| Photos | photo files are kept after a photo is removed from a page, because one file can serve every shop that uses the same photo; we also keep a recovery copy at a second provider. When we receive a deletion request or an accepted takedown notice for a photo, we remove its files from our storage and from the recovery copy, every stored version included, within 31 days |
9. Data on your device
Shop websites and apps keep your cart, your last Request and your progress in a checkout or booking in your browser's storage, so they survive a reload. Installed apps keep their own files for a fast, offline start. Details: our Cookies Policy.
10. Your rights
10.1 You can ask us to tell you what data we hold about you and give you a copy; to correct it; to delete it or restrict its use; to stop a use you object to; and to withdraw a consent you gave. If a breach of your data is likely to harm you, we tell you (section 11).
10.2 Write to [email protected]. We may ask you to confirm your identity, for example from the phone number or email you used. We answer within 30 days.
10.3 Some data we cannot delete at once: billing records the law requires us to keep, data needed for a legal claim, and copies in locked backups (deleted automatically after about 31 days, section 8).
10.4 For a Request you sent to a Merchant, you can also contact that Merchant, which is responsible for its own copy.
10.5 You can complain to the Personal Data Protection Centre in Egypt. Because our company is in the United Kingdom, you may also be able to complain to the UK Information Commissioner's Office.
11. Security and breaches
11.1 Connections are encrypted. Passwords are stored only as one-way hashes. Each business can see only its own data, which the database itself enforces. Backups are encrypted, and the key to read them is never on our servers.
11.2 No system is perfectly secure. If a breach affects personal data, we act at once to stop it and limit the harm, find out what happened and whose data was affected, notify the Personal Data Protection Centre and the people affected as the law requires, tell affected businesses without undue delay, and keep a record of every breach.
11.3 We will never ask you for your password, a sign-in code or card details by email, phone or message. If someone does, it is not us: tell us at [email protected]. Report a security weakness to the same address with the subject "Security".
12. Children
Go Online is not meant for anyone under 18 to use on their own, and businesses must be run by adults. A parent or guardian may book a class for a child and give the child's first name.
13. Changes
We publish every change here with a new version number and date; earlier versions stay available on our website. If a change affects how we use data you already gave us, we tell account holders by email before it applies and, where the law requires, ask for consent again.
14. Contact
SBSUCCESS LTD, 128 City Road, London, United Kingdom — [email protected].