Privacy policy
This page explains, in plain language: what data this site takes from you, why, where it is kept, who else sees it, and how you get a copy of it or have it deleted.
Last updated: 2026-08-09
The whole thing in four lines
- We take two things and no more: what you type into the forms, and a limited set of context data — which campaign brought you, and which page you sent the form from — all of it set out in full below.
- No third-party tracking script and no advertising tag runs on this site. We do record, for ourselves, which campaign brought you — and we are not hiding it from you.
- Your data sits on a server we run ourselves. It is never sold and never reaches an advertiser.
- You can ask for a copy of your data, have it corrected, or have it deleted, whenever you want.
Who is responsible for your data
This site is run by Shortcut for Training and Consultation, a practical HPLC lab training provider in Egypt. The person responsible for your data and for answering your requests about it is Eng. Mohamed Samy.
To reach us about anything to do with your privacy:
Not yet settled
- Registered legal name, entity form, and commercial registration or tax number: [owner to confirm]
- Official postal address: [owner to confirm]
- Whether a dedicated data protection officer has been appointed: [owner to confirm]
Exactly what we collect
Nothing below is collected quietly. Every item here is either something you typed into a form, or something the server records alongside your request so it knows where the request came from.
What you type into the forms
Depending on which form you fill in, we may ask for:
- Your name
- Your email address
- Your WhatsApp or phone number
- Your country — chosen alongside the phone dialling code, and sent with the request
- Your organization — on team-training requests
- Your professional segment: student, recent graduate, working in a lab, and so on
- A free-text message where you write whatever you need to
Required fields are marked inside each form. Everything else is optional, and leaving it blank does not stop the form from being sent.
What is recorded alongside what you typed
Every submission records a set of fields describing the context of the request rather than you. Some are sent by your browser along with the form; others are added by our server. The difference matters, so we spell it out:
What your browser sends with the form
Before the form is sent, the site reads the following from the page address and from your browser and attaches them to the submission: the campaign parameters if the link carries any (utm_source, utm_campaign, utm_medium, utm_content, utm_term), the address of the external page you arrived from if there is one (document.referrer), and the full address of the page you sent the form from, including anything after the question mark.
The campaign-source field is mandatory in our system: if the link carries no campaign parameter at all, the value "direct" is sent instead. Support requests are the exception — they carry no campaign parameter and no referrer, only the page address.
What our server adds
Once the request arrives, the server adds fields your browser does not send: which form the request came from, which course it relates to, the region, the segment, the type of request, an internally calculated interest score, and any batch or quotation attached to it.
The purpose is operational and internally commercial: so we know what you are asking about before we reply and you never have to explain it twice, and so we know which advert or page requests actually come from. None of these fields leaves our server, none is uploaded to an advertising platform, and none is used for advertising targeting.
The free self-assessment
Your answers to the assessment questions, your score and the resulting band are stored with us as an assessment attempt. If you leave no contact details, no lead record is created for you; a lead record is only created when you give us contact details yourself.
The attempt record is created the moment you start the assessment — before you answer a single question — and it carries the segment you picked and the language of the questions. So if you walk away halfway through, an incomplete attempt remains with us, with no answers, no name and no email.
Booking a seat
When you request a seat, a customer record and a draft sales order are created in our system, carrying the contact details you entered along with the batch and the number of seats requested.
Support requests and complaints
A support request opens a ticket in the support system and never enters the sales pipeline. That separation is deliberate and enforced in the code itself: someone who complains does not get moved onto a marketing list.
The ticket carries what you entered: your name, email, the subject and the text of the request, your WhatsApp number if you gave one (it is optional here), and the batch the request relates to if there is one — together with the address of the page you sent it from. No campaign parameter and no referrer is sent with a support request.
The waiting list
If a batch is full and you ask to join its waiting list, we keep your contact details and the batch you are waiting for so we can tell you when a seat opens or a new batch starts.
IP address
The IP address the request came from is passed to our back end for one purpose: capping how many requests each client may make, and stopping the forms from being flooded by automated submissions. Your browser's user agent string is not passed to our back end.
The IP address is not used to build a profile of you, or to locate you for marketing.
Why we collect it, and on what lawful basis
Each purpose has one clear lawful basis, not a general bucket everything is filed under:
- Answering your enquiry and following up with you about the training.Basis: your consent, given when you submitted the form — and you can withdraw it at any time.
- Fulfilling the seat booking, issuing the quotation, and running the training.Basis: performance of the contract between us, or steps taken at your request before it.
- Issuing your competency record and making it checkable on the verification page.Basis: performance of the contract — the record is what you trained for.
- Handling and answering the support request or complaint you sent.Basis: steps taken at your own request.
- Calculating your self-assessment result and showing you your strengths and gaps.Basis: your consent, given when you chose to take the assessment.
- Preventing abuse of the forms and protecting the service from automated traffic.Basis: a security measure necessary to run the service itself; the IP address is used for rate limiting and for nothing else.
No third-party analytics and no advertising tags
This section is worth reading in full
- No third-party tracking script runs on this site: there is no Google Analytics, no Meta Pixel, no PostHog, no Plausible and no advertising tag of any kind.
- The site does, however, record campaign attribution for itself: the utm parameters present in the link you arrived through, and the address of the external page that referred you. Those values are sent with the form to our server alone and reach no third party. That is tracking in the ordinary sense of the word, and we are not going to call it something else.
- The only cookie this site sets is functional: a single cookie named NEXT_LOCALE, written by the next-intl library, which remembers the language you chose — Arabic or English — and routes you to your language's version. It does not follow your browsing. Its attributes (domain and scope) are set by that library, not by us, so we make no claim here about something we did not set ourselves.
- The site also stores — in your browser's session storage, under the key shortcut:attribution — the campaign source and the referrer, so they stay with you as you move between pages until you send a form. That is not a cookie, but it is storage on your device, and it belongs here because naming it is the honest thing to do. It is cleared automatically when you close the browser tab.
- You will not find a cookie consent banner because there are no advertising or analytics cookies to ask you about. The functional cookie and the attribution entry are both described above in full, and you can clear them from your browser settings whenever you like.
- We do not build an advertising audience out of you, and we do not upload your data to any ad platform.
Where your data lives, and who else touches it
The data lives on a server belonging to the business itself, running Frappe/ERPNext and Frappe CRM, hosted on infrastructure rented from the cloud provider Amazon Web Services. We do not put your data into a third-party commercial CRM platform.
Your data is not sold, rented or traded, and it does not reach any advertiser or data broker — neither for money nor in exchange for a service.
The outside parties that actually touch the data
- Google — outgoing email from the site is sent through the business Gmail account over SMTP. That means your email address and the text of the message pass through Google's service, and may be processed on its servers outside Egypt.
- Amazon Web Services — the provider of the infrastructure the server runs on.
- Meta, via WhatsApp — if you choose to message us on WhatsApp, that conversation happens on WhatsApp's platform and is governed by Meta's policy, not this one. Messaging us there is your choice, and email or the site's forms are always available instead.
We will not disclose your data to anyone else unless the law or an order from a competent judicial authority requires it.
How long we keep it
The principle we hold to: we do not keep your data for longer than the purpose it was collected for requires, or longer than the law requires.
That gap is left marked on purpose. Copying a ready-made period out of a ready-made policy and then not applying it is worse than admitting the number has not been settled yet.
It does not stop you asking for deletion now — the full procedure is on the data deletion page. Delete your data
Your rights under Egyptian Law No. 151 of 2020
The Personal Data Protection Law gives you the following rights over the data we hold about you:
- To know that we hold data about you, and what it is.
- To see it and obtain a copy of it.
- To have anything inaccurate corrected, amended or completed.
- To ask for it to be erased.
- To limit its processing to one defined purpose and no other.
- To withdraw your consent to processing at any time — withdrawal does not undo processing that was lawful before it.
- To object to the processing of your data, or to a result reached from it.
- To be notified if a breach or violation affecting your data occurs.
- To lodge a complaint about the processing of your data with the supervisory authority established by Law No. 151 of 2020 — the Personal Data Protection Centre.
How to exercise these rights in practice
Email us and say exactly what you want — access, correction, erasure, withdrawal of consent, or objection — together with the contact details you used with us, so we can find your record.
We may ask you to confirm the request really came from you, by having it arrive from the same email address or the same WhatsApp number we have on record. The point is to protect your data from a forged request, not to slow yours down.
- The time within which we commit to answering your request: [owner to confirm]
- Contact details for the Personal Data Protection Centre and whether it is in fact receiving complaints today — the right is written into the law, and we are not going to point you at a working channel we have not verified: [owner to confirm]
Children
The training is aimed at people working in laboratories and at undergraduate and postgraduate students. This site is not directed at children and we do not knowingly collect their data. If a child's data reaches us by mistake, write to us and we will delete it.
How we protect the data
The data sits on a server we administer ourselves rather than on a shared platform, the connection to the site is encrypted over HTTPS, and the site's forms are protected by a per-client request cap to prevent abuse.
We claim no accredited security certification. No system is entirely free of risk, and anyone who promises you otherwise is overstating it.
Updates to this policy
If the way we handle your data changes, we will update this page and change the last-updated date shown above. The version published here is the version in force.
A question about your privacy?
Write to us directly — email reaches the person responsible, not an automated inbox.