Privacy Policy

Last updated: 10 May 2026

1. Introduction

Red Sea Wind Energy S.A.E. ("RSWE", "we", "us", or "our") is the project company developing and operating the 650 MW Ras Ghareb wind farm in the Gulf of Suez, Egypt. This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you visit rswe.co (the "Site") or interact with the forms hosted on it.

This policy is issued in compliance with the Egyptian Personal Data Protection Law No. 151 of 2020 ("Law 151/2020") and reflects internationally accepted disclosure practices, including the IFC Performance Standards and the Equator Principles, which apply to our project's environmental and social commitments.

By using the Site or submitting any form, you acknowledge the practices described below. If you do not agree, please do not use the Site or submit personal data through it.

2. Information We Collect

2.1 Information you provide directly

We collect personal data only when you choose to submit it through one of the forms on the Site:

Contact form — full name, email address, optional telephone number, optional company or organisation, subject line, and the body of your message.
Grievance form — submitted under our project grievance mechanism. You may submit anonymously. Optional fields include name, email, telephone, postal address, the date and location of the incident, the type of grievance, a free-text description, your desired resolution, and up to three file attachments (each up to 10 MB). Where you submit anonymously, no identifiers are collected; a reference number is generated so you can follow up.
Newsletter and lifecycle subscriber form — email address, name, organisation, and your selected alert preferences. Subscriptions use a double opt-in: a confirmation email is sent and your address is recorded only after you confirm.

2.2 Information collected automatically

When you browse the Site, the following information is collected automatically:

Server log data — IP address (truncated for analytics), user-agent string, referring URL, requested URL, response status, and timestamp. Logs are kept for security, fraud prevention, and abuse monitoring.
Analytics — Google Analytics 4 ("GA4") with IP anonymisation enabled. GA4 sets first-party cookies to measure aggregate page views, session duration, traffic sources, and approximate geography (country / region only). We do not use GA4 for advertising and have not enabled Google Signals.
Map tiles — Mapbox GL is used to render the project location map. Loading map tiles transmits standard request metadata to Mapbox; we do not pass any form-submitted personal data to Mapbox.
Anti-abuse — Cloudflare Turnstile is used on form submissions to distinguish humans from automated traffic. Turnstile is privacy-preserving and does not set tracking cookies. Submission rates are limited via Upstash Redis using a hashed identifier derived from your IP address; the identifier is not retained beyond the rate-limit window.

3. How We Use Your Information

We use personal data only for the purposes for which it was collected, namely:

To respond to enquiries received through the contact form, including routing the message to the correct internal team.
To register, investigate, track, and resolve grievances submitted through the grievance mechanism in line with our Stakeholder Engagement Plan and the IFC Performance Standard 1 grievance requirements.
To deliver newsletters, project updates, and lifecycle disclosures to subscribers who have opted in, and to honour unsubscribe requests promptly.
To operate, secure, and improve the Site, including diagnosing technical issues and protecting against abuse.
To produce aggregate, non-identifying analytics that help us understand which pages and disclosures are useful to stakeholders.
To comply with legal, regulatory, and lender disclosure obligations under Egyptian law and the Equator Principles.

We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

4. Legal Bases for Processing

Under Law 151/2020 and aligned international standards, we rely on the following legal bases:

Consent — for newsletter subscriptions (collected via double opt-in) and for any optional fields you choose to complete.
Performance of a task in the legitimate interest of the controller — for handling unsolicited contact-form enquiries, operating Site security, and producing aggregate analytics, where such interests are not overridden by your rights and freedoms.
Compliance with a legal obligation — for retaining grievance records to satisfy lender and regulatory disclosure requirements, for tax and corporate record-keeping, and for responding to lawful requests from competent authorities.
Vital or public interest — where, in the context of a grievance, processing is necessary to investigate or prevent harm to persons or the environment.

We share personal data only with the following categories of recipients, and only to the extent necessary:

Infrastructure and platform providers — Supabase (database and storage, hosted in the EU-West region), Netlify (Site hosting and global CDN), Mapbox (map tiles), Google Analytics (aggregate measurement), Cloudflare (Turnstile anti-abuse), Upstash (Redis-based rate limiting), and our transactional email relay (used to send notification and confirmation emails).
Project consortium and lenders — where strictly necessary to investigate a grievance, we may share relevant details with our shareholders, the project lenders, and their independent monitors, under confidentiality obligations consistent with the Equator Principles.
Professional advisers — legal, audit, environmental, and social consultants engaged by RSWE under written confidentiality obligations.
Competent authorities — where required by Egyptian law, by court order, or by a binding regulatory request.

We never sell, rent, or trade personal data to advertisers or data brokers.

6. International Data Transfers

Our primary database is hosted in the European Union (Supabase EU-West-1, Ireland). Personal data submitted from Egypt or any other country is therefore transferred to and stored in the EU. Some service providers (for example, Google Analytics) may also process limited data in the United States.

Cross-border transfers from Egypt are made in accordance with Article 14 of Law 151/2020 and are protected by a combination of: (i) contractual confidentiality and data-protection clauses with each provider; (ii) the EU's general data-protection regime applicable to data stored in the EU; and (iii) where applicable, transfer mechanisms recognised by the European Commission. By submitting personal data through the Site, you acknowledge that your data may be processed in the EU and, in limited cases, in other jurisdictions identified above.

7. Data Retention

Contact-form submissions — retained for 24 months from the date of last correspondence, then deleted or fully anonymised.
Grievance records — retained for 7 years following closure of the grievance, in line with the record-keeping expectations of the project's Environmental and Social Impact Assessment ("ESIA") and lender requirements. Anonymous submissions are retained on the same schedule with no identifying information.
Newsletter subscriptions — retained for as long as you remain subscribed, plus 12 months after unsubscribe to evidence the unsubscribe and prevent re-enrolment in error.
Server logs — retained for up to 90 days, except where a longer period is necessary to investigate a security incident.
Analytics — Google Analytics 4 user-level and event-level data are retained for the GA4 default of 26 months, after which Google deletes them automatically.

8. Cookies and Similar Technologies

The Site uses a small number of cookies and similar technologies:

Strictly necessary cookies — used for language preference, session continuity, and Cloudflare Turnstile anti-abuse. These do not require consent and cannot be switched off through the Site.
Analytics cookies — set by Google Analytics 4 to measure aggregate Site usage. IP addresses are anonymised and Google Signals is disabled.

You can block or delete cookies through your browser settings; doing so may degrade some functionality. The Site does not display advertising and does not load advertising or social-media tracking pixels. We honour the "Global Privacy Control" and "Do Not Track" browser signals where they are sent: when received, analytics cookies are not loaded for that visit.

9. Your Rights

Subject to Law 151/2020 and applicable local law, you have the following rights with respect to personal data we hold about you:

Access — to obtain confirmation of whether we process your data and a copy of it.
Rectification — to correct inaccurate or incomplete data.
Erasure — to request deletion where the data is no longer necessary or where you withdraw consent (subject to overriding legal-retention obligations, particularly for grievance records).
Portability — to receive your data in a structured, commonly used, machine-readable format.
Objection — to object to processing carried out on the basis of legitimate interest.
Withdrawal of consent — to withdraw consent at any time, with effect from the date of withdrawal.
Complaint — to lodge a complaint with the Egyptian Personal Data Protection Centre ("PDPC") or with another competent supervisory authority.

To exercise any of these rights, email info@rswe.co with the subject line "Data Subject Request". We will acknowledge your request promptly and respond substantively within 30 days. We may need to verify your identity before acting on a request.

10. Children's Privacy

The Site is not directed at children under the age of 18, and we do not knowingly collect personal data from minors. If you believe that a child has submitted personal data to us, please contact info@rswe.co and we will delete the data without undue delay.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in technology, or in applicable law. The "Last updated" date at the top of this page shows when the policy was last revised. Material changes will be highlighted on the Site for a reasonable period before they take effect. Your continued use of the Site after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

For any question about this Privacy Policy or about how we handle personal data, please contact:

Red Sea Wind Energy S.A.E. (شركة البحر الأحمر لطاقة الرياح ش.م.م.)
The NOX, Plot 341 to 345, 2nd Floor, 5th Settlement, 11835 New Cairo, Egypt
Email: info@rswe.co
Or use our contact form.