Integrations and Data Protection: What We Connect and How Your Data Is Handled
Payment gateways, e-invoicing, messaging and ERP integrations we build, and how personal data is protected under Egypt's Law 151 of 2020.
This page answers two questions procurement teams ask before signing: which external systems can your platform connect to, and what happens to personal data inside it. We integrate Egyptian and Gulf payment gateways, Egyptian (ETA) and Saudi (ZATCA) e-invoicing, WhatsApp, SMS, maps and ERP systems, each one tested in the provider's sandbox before launch and run on accounts opened in your name. On data, the client owns it, card data never touches our servers, and systems are built with the controls that Egypt's Personal Data Protection Law expects. This page describes practice; the binding terms for each project are in its signed contract. Page last reviewed: 31 October 2026.
Accounts in your name
Gateway, SMS, WhatsApp and store accounts are opened for your company, so the contracts and the money stay with you.
Sandbox first
Every integration and payment gateway is exercised in the provider's test environment before it goes live.
No card data
Payments run through licensed gateways. Card numbers never pass through or rest on our servers.
Your data stays yours
Data belongs to the client in all cases and is exported in a usable format on request.
Integrations we build
These are the providers named across our service pages. If a system has a documented API, we can usually connect to it; the technical estimate names each integration, its build cost and its running cost at the provider.
| Category | Providers | Typical use |
|---|---|---|
| Payments, Egypt | Paymob, Fawry, Kashier, Geidea, Easykash, Valu | Cards, wallets, reference-code payments, instalments |
| Payments, Gulf | MyFatoorah, PayTabs, Moyasar, HyperPay; Mada, Apple Pay, STC Pay; Tabby, Tamara | Local cards and wallets, buy now pay later |
| Payments, international | Stripe, PayPal | Cards and subscriptions for clients outside the region |
| E-invoicing | Egyptian Tax Authority (ETA), Saudi ZATCA | Electronic invoices issued from your ERP, POS or store |
| Messaging | WhatsApp Business API, SMS gateways, Firebase push notifications, email | Order updates, reminders, one-time passwords |
| Maps and sign-in | Google Maps, Google and Apple sign-in | Addresses, delivery tracking, one-tap login |
| Voice and video | Agora, Zoom | In-app calls and consultations |
| ERP and business systems | ERPNext, Odoo, custom ERP, helpdesks | Stock, invoices, customers and orders kept in sync |
| AI | Models from Anthropic, OpenAI and Google | Assistants and agents connected to your own data |
| Cloud and analytics | AWS, Google Cloud, Azure, Cloudflare, Google Analytics 4 | Hosting in your account, CDN and firewall, measurement |
How every integration is built
Keys outside the code
API keys and gateway secrets live in server environment configuration, never in the repository or an admin screen. Staging never carries production keys.
Verified callbacks
Payment callbacks are checked for authenticity and amount before an order is treated as paid.
Tested before launch
Each integration is run in the provider's sandbox, then with a real transaction on launch day.
Provider fees paid directly
Gateway commissions, SMS and WhatsApp message fees are paid by you to the provider. We do not resell them.
Documented
Endpoints, credentials locations and failure handling are written into the handover documentation.
Change of provider
Switching gateway or SMS provider later is a scoped change request, not a rebuild.
Egypt's Personal Data Protection Law (Law 151 of 2020)
Egypt's Personal Data Protection Law, Law No. 151 of 2020, governs how personal data of people in Egypt is collected, processed, stored and transferred. Its Executive Regulations were issued by Prime Ministerial Decree No. 816 of 2025 in November 2025, with a one-year transition period for existing processing, so the obligations now apply in full. The supervisory body is the Personal Data Protection Center.
In most projects you are the controller (you decide why the data is collected) and Web Pioneer is a processor while we build, host or operate the system for you. Licences and registrations with the Center are the controller's obligation, decided with your legal adviser. We are a software company, not a law firm, and this page is not legal advice. What we provide is a system whose design makes compliance practical.
What we build into a system that handles personal data
- Consent and notice: consent captured and stored with its date and the text the user agreed to, plus a privacy notice. Our app privacy policy template is a starting point for your lawyer.
- Data minimisation: only the fields the purpose needs, and the minimum stored on the device in mobile apps.
- Role-based access: each user sees only what their role requires; authorisation is checked on the server on every request.
- Access and change logs: who viewed or changed sensitive records, where the scope calls for it.
- Data subject requests: export of a person's data and deletion or anonymisation on request, as admin functions rather than manual database work.
- Encryption: TLS on all public traffic, passwords hashed with modern algorithms, encrypted backups.
- Retention: deletion or archiving rules per record type, agreed in the scope.
Which of these a project needs is decided in the written scope, so you see each one and its cost before signing.
Where your data is hosted
You choose. Systems we host today run in a European Union data centre in France, on servers we manage. If your data must stay in a specific country, or your policy requires your own cloud account, we deploy in the account and region you choose, including AWS, Google Cloud, Azure or a local provider, with billing and ownership staying with you.
Under Egypt's law, moving personal data outside Egypt is subject to conditions set by the law and its regulations. Tell us your requirement before the estimate and the hosting plan is written around it. For Saudi and UAE clients the same applies to Saudi Arabia's Personal Data Protection Law and the UAE's federal data protection law: in-country hosting is available when your obligations require it.
Confidentiality, incidents and the end of an engagement
- A non-disclosure agreement is signed before we receive any sensitive material, and confidentiality binds everyone working on the project.
- We sign the data processing agreement or data-handling undertaking your procurement process requires.
- Production data is not copied into development environments unless personal data has been masked first.
- Each client runs in a separate database and server account; client data is never commingled.
- A suspected incident follows our seven-step path: detect, triage, contain, resolve, verify, review, prevent. The client is told when an incident affecting personal data is confirmed, so the controller can meet the law's notification duties, which include notifying the Center within 72 hours of a breach.
- At the end of an engagement we hand over the data and delete our copies on your instruction.
The full list of controls is on the Trust Center.
Common questions
Which payment gateways can you integrate in Egypt?
Paymob, Fawry, Kashier, Geidea, Easykash and Valu are the ones we name on our service pages. The gateway account is opened in your company name and every gateway is tested in its sandbox before launch.
Do you integrate with the Egyptian Tax Authority e-invoicing system?
Yes. ETA e-invoicing is connected to your ERP, POS or store, and the integration is quoted in writing within one business day based on your current system. Saudi ZATCA e-invoicing is also supported.
Does Web Pioneer store our customers' card data?
No. Payment runs through a licensed gateway. Card numbers and security codes are never stored, never logged and never pass through our servers; we keep the transaction reference and status only.
Is our system compliant with Egypt's data protection law?
Compliance is the controller's obligation, decided with a legal adviser. We build the technical side the law expects: consent records, role-based access, logs, data export and deletion, encryption and agreed retention. We are not a law firm and do not give legal advice.
Where will our data be hosted?
In the account and region you choose. Systems we host today run in an EU data centre in France; if your data must stay in a specific country, we deploy in your own cloud account or with a local provider there.
Will you sign our data processing agreement?
Yes. We sign the confidentiality and data-handling undertakings your procurement process requires, and an NDA before any sensitive material is shared.
Have a compliance requirement?
Raise it on the discovery call. The written scope lists every integration and data control, with its cost, before you sign.
