Privacy Policy

There are two kinds of personal data here, and our role differs for each.

For your own account data — the people who sign in, their names, emails and billing details — we are the controller and decide how it is used.

For the employee data you enter — names, identity numbers, passports, visas, documents — you are the controller. We are a processor acting on your instructions. You decide what to collect and why; we store and process it to run the Service for you.

Account and user data: name, email address, phone number, role, company name, commercial registration details, and login timestamps.

Employee and company records you enter, which typically include:

• names in English and Arabic, nationality, date of birth, job title and department;
• identity and immigration numbers — QID/residence permit, passport, visa — and their expiry dates;
• uploaded document files such as identity documents, passports, licences and certificates;
• company records such as commercial registration, trade licence and establishment card details.

Identity numbers, passport numbers and residence permit details are treated as data of a special nature. They are stored in a private, access-controlled database and are never written into application logs.

Uploaded documents are held in private storage. They are never publicly addressable: access is granted only through short-lived signed links issued to a signed-in user of the owning account.

To provide the Service: storing your records, showing renewals, generating letters, assigning PRO tasks, and sending the reminders you have configured.

To operate the account: authentication, capacity and storage enforcement, billing, and support you ask for.

To keep the Service secure and reliable: detecting abuse, diagnosing faults, and maintaining audit records of sensitive actions such as document downloads and letter generation.

To meet legal obligations that apply to us.

We do not sell personal data. We do not use your employee data to train models, to advertise, or for any purpose of our own beyond running the Service.

For your account and billing data, we rely on the performance of our contract with you and on our legitimate interest in securing and improving the Service.

For employee data, the lawful basis is yours to establish, not ours. You are responsible for having a proper basis to collect and store it, and for giving your employees the notice the law requires.

We use a small number of processors to run the Service, each with access limited to what their function needs:

• a cloud database, authentication and file-storage provider, which hosts your records and documents;
• a cloud application hosting provider, which serves the application;
• an email delivery provider, used to send reminders, invitations and account notices;
• a payment provider, which processes subscription payments;
• a messaging provider, used only where you connect optional notifications yourself.

Our providers may store or process data outside Qatar. Where that happens we rely on the provider's contractual data-protection commitments, and we require confidentiality and security terms at least equivalent to those in this policy.

While your subscription is active, your data is kept until you delete it. Individual documents and records you delete are removed permanently and immediately.

If a subscription lapses, data is retained for three months and may then be permanently deleted, as set out in the Terms of Use. Exporting before that point is your responsibility.

Limited billing and audit records may be kept longer where we are required to keep them.

Every record is bound to its owning account and isolated at the database level, so one account cannot read another's data. Document storage is private and reachable only through expiring signed links. Data is encrypted in transit. Sensitive actions are recorded in an audit log.

No system is perfectly secure. If a breach affects your data we will notify you without undue delay and tell you what we know and what we are doing.

In respect of the data we hold about you as our customer, you may ask us to:

• give you a copy of it, or correct it where it is wrong;
• delete it, where we are not required to keep it;
• restrict or object to a particular use;
• withdraw a consent you gave, without affecting what was done before.

Employees whose data you store should direct their requests to you, not to us — you are the controller of that data and you decide what happens to it.

If an employee contacts us directly, we will refer them to you. We will help you respond to such a request, and will act on your instruction to correct or delete a record.

The Service is not intended for children and is not designed to hold their data. Do not use it to store records about anyone under 18 except where an employment record lawfully requires it.

Q-PRO uses only the cookies it needs to sign you in and remember your interface preferences. Our Cookie Policy lists each one and explains how to change your choice.

We may update this policy as the Service or the law changes. The date at the top shows the most recent update, and we will give notice of a material change before it takes effect.

For any privacy question or request, contact Arooj trading and technology services, Qatar, using the email or phone number in the site footer.