Privacy Policy (PDPPL)

PRIVACY POLICY (سياسة الخصوصية) — PDPPL

Legal entity name​ (Commercial Registration No. Commercial Registration (CR) number​)

This policy is issued under the Personal Data Privacy Protection Law (PDPPL, Law No. 13 of 2016), in force since 2017 — the first national data-protection law in the Gulf. The regulator is the National Data Privacy Office (NDPO), part of the National Cyber Security Agency (NCSA, formerly under the Compliance & Data Protection Department of MOTC).

1. DATA WE COLLECT 1.1. Categories of data collected​

2. WHY WE COLLECT IT 2.1. Purposes of processing​ 2.2. Legal basis: Legal basisConsent (default basis)Contract performanceLegal obligation — consent is the default legal basis under PDPPL; direct marketing is prohibited without prior consent.

3. RETENTION 3.1. Retention period​

4. THIRD PARTIES AND PROCESSORS 4.1. Third parties and processors​

5. CROSS-BORDER TRANSFER 5.1. Cross-border transfer​

6. DATA BREACH NOTIFICATION 6.1. Data breach notification procedure​ — regulator guidelines call for notification of a personal data breach within 72 hours.

7. CONTACT AND RIGHTS 7.1. Data protection contact: Data protection contact​. 7.2. Data subject rights and request channel: Data subject rights and request channel​. 7.3. Enhanced protection applies to children's data and other sensitive categories; violations can carry fines of up to QAR 1 million (up to QAR 5 million for sensitive data or children's data).

8. QFC NOTE 8.1. QFC carve-outNot applicable — not a QFC entityQFC entity — see QFC Data Protection Regulations instead — entities licensed in the Qatar Financial Centre (QFC) are subject to the QFC Data Protection Regulations instead of PDPPL.

Version date: Policy version date