Privacy Notice

1. Who We Are

Al Hayir LLC is a strategic advisory firm registered with the Qatar Financial Centre (License No. 03401), with offices at P.O. Box 11239, West Bay Business District, Doha, State of Qatar.

We act as data controller for personal data we collect in the course of our advisory operations. Questions about this notice or our data practices should be directed to: [email protected]

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

• —Contact information: name, email address, telephone number, job title, and organisation name provided when making an enquiry or entering an advisory engagement.
• —Correspondence: the content of communications exchanged with Al Hayir LLC by email or other written means.
• —Professional information: details relevant to the scope of an advisory engagement, provided by or on behalf of the engaging institution.
• —Technical data: IP addresses and server logs retained by our hosting infrastructure for security and operational purposes.

We do not collect sensitive personal data as defined under the QFC Data Protection Regulations 2021, except where explicitly required by an engagement and subject to separate written agreement.

3. Legal Basis for Processing

We process personal data on the following lawful bases under the QFC Data Protection Regulations 2021:

• —Performance of a contract or pre-contractual steps: where processing is necessary to enter into or execute an advisory engagement agreement.
• —Legitimate interests: where we have a legitimate operational or security interest in processing, balanced against your privacy rights. This includes maintaining records of professional correspondence and operating secure infrastructure.
• —Compliance with legal obligations: where processing is required by applicable law, including QFC regulations and Qatar domestic law.
• —Consent: where you have given clear consent for a specific processing purpose, which may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

4. How We Use Personal Data

We use personal data only for the purposes for which it was collected:

• —To respond to enquiries and manage advisory engagement relationships.
• —To fulfil contractual obligations under advisory engagement agreements.
• —To maintain the security and integrity of our systems and communications.
• —To comply with our legal and regulatory obligations as a QFC-registered entity.
• —To communicate relevant professional information where you have requested or consented to receive it.

5. Data Sharing and Third Parties

We do not sell, rent, or share personal data with third parties for commercial purposes.

We engage the following categories of third-party processors in the course of our operations, each subject to contractual data protection obligations:

• —Cloud infrastructure and hosting providers.
• —Secure email and communications services.
• —Content management and publishing platforms.

We require all processors to implement technical and organisational measures to protect personal data consistent with QFC Data Protection Regulations 2021 requirements.

We will disclose personal data to regulatory or law enforcement authorities only where required to do so by applicable law or QFC regulatory obligation.

6. Cross-Border Data Transfers

As a QFC-registered entity, we are subject to the cross-border data transfer provisions of the QFC Data Protection Regulations 2021. Where personal data is transferred outside the Qatar Financial Centre to third-party processors, we ensure that adequate protections are in place, including:

• —Transfers to jurisdictions assessed as providing adequate data protection.
• —Standard contractual clauses or equivalent safeguards where required.
• —Specific permission from the QFC Data Protection Office where applicable.

Details of the safeguards applicable to specific transfers are available on request from [email protected]

7. Your Data Subject Rights

Under the QFC Data Protection Regulations 2021, you have the following rights in relation to your personal data:

8. Exercising Your Rights

To exercise any of the above rights, contact us at: [email protected]

We will acknowledge your request within five business days and respond fully within thirty days. Where requests are complex or numerous, we may extend this period by a further thirty days and will notify you accordingly.

You may also submit a complaint to the QFC Data Protection Office:

Qatar Financial Centre Authority
P.O. Box 22989, Doha, State of Qatar
www.qfc.qa

9. Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfaction of any legal, regulatory, or contractual retention requirements.

Advisory engagement records are retained for a period consistent with applicable professional obligations and limitation periods under QFC and Qatar law. Technical logs are retained for a period proportionate to legitimate security and operational requirements.

On expiry of applicable retention periods, personal data is securely deleted or anonymised.

10. Security

We maintain technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures are implemented in accordance with our Information Security Management System, aligned with ISO/IEC 27001:2022 (certification in progress with BSI) and the NCSA National Information Assurance Framework.

To report a security concern, contact: [email protected]

11. Changes to This Notice

We review this notice at minimum annually and following any material change to our data processing activities or applicable regulatory requirements. The current version is published at alhayir.com.qa/privacy.