Privacy notice

This notice explains what personal data ComplyQatar holds, why, and your choices. [Operating company legal name] is responsible for it. [The adviser to confirm our obligations under Qatar's personal data protection law (Law No. 13 of 2016) and any sector rules, and whether we act as controller, processor or both for each kind of data below.]

What we hold

• Account details: your name, work email, password (stored only as a hash by our sign-in provider) and, if you set one up, your authenticator app link.
• Your organisation's records: companies, locations, licences, permits, contracts, renewals, payments and the documents you upload. These can include people's names and reference numbers.
• Activity records: an audit log of renewals, payments, uploads, invitations and plan changes, the alert emails we sent, and security logs such as failed sign-ins.
• Billing details: your plan and subscription status. Card details are handled by our payment provider and never reach us.

Why we use it

• To run the service you signed up for: show your records, send renewal reminders and keep your account secure.
• To bill paid plans.
• To meet legal duties and handle disputes.

We do not sell personal data, use it for advertising, or run analytics trackers.

Who else sees it

• People you invite to your organisation, according to their role.
• Our service providers, only to run the service: hosting and database ([Hosting provider and data-centre region]), email delivery, and the payment provider. [List and locations to be confirmed, including any transfer of data outside Qatar.]
• Authorities, where the law requires it.

How long we keep it

[Retention periods per category to be confirmed, e.g. while the account is open plus N months; audit and billing records as the law requires.]

Your rights

You can ask to see, correct or delete your personal data, or object to how it is used, by writing to [privacy contact email]. Admins can correct most records directly in the app. [Response times and how to complain to the competent authority in Qatar to be confirmed.]

Security

Data is encrypted in transit; each organisation's records are separated by database rules; Admin and Finance users must use an authenticator app; access to records follows each person's role.

Changes

We will tell account admins before material changes to this notice take effect.