01Purpose and Scope
This Policy explains how Malaz protects personal data handled through its websites, applications, and related services, including the Broker Company application. It applies to employees, contractors, authorized users, and service providers who handle personal data for these services.
02Personal Data Covered
Depending on the service and features used, personal data may include names, contact details, account information, property inquiries, saved listings, communications, location information, device details, and usage records. Malaz should collect and process only data reasonably required for a specified and legitimate purpose. The actual data collected must match the relevant Privacy Policy and the live application.
03Use and Access
Personal data must be used only for authorized business purposes, such as providing services, managing accounts and property inquiries, supporting users, maintaining security, and meeting legal obligations. Access must be limited to authorized personnel who need the information for their work. Users must not access, copy, disclose, or use personal data for personal or unrelated purposes.
04Security and Confidentiality
Malaz will implement appropriate technical and organizational safeguards to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the systems and risks, safeguards may include role-based access, secure authentication, encryption, system updates, security monitoring, backups, and staff confidentiality practices. The technical team must confirm which safeguards are actually implemented; this Policy is not a certification that any specific control is in place.
05Sharing and Service Providers
Personal data may be shared only where necessary for service delivery, technical support, security, legal compliance, or another lawful and disclosed purpose. Service providers that process personal data should be assessed and managed appropriately. Data must not be sold or disclosed for unrelated purposes contrary to applicable law or the relevant Privacy Policy.
06Retention and Deletion
Personal data should be retained only for as long as necessary for its stated purpose or as required by applicable law. When it is no longer needed, it should be securely deleted, anonymized, or otherwise disposed of under an approved process. Retention periods and deletion practices should be confirmed and documented by the responsible team.
07Individual Requests
Requests to access, correct, update, or erase personal data, or to exercise other rights available under applicable law, should be sent to the privacy contact below. Malaz will review and respond to valid requests in accordance with applicable legal requirements. Identity may be verified before information is disclosed or changed.
08Data Breaches and Incidents
Any suspected loss, unauthorized access, disclosure, or compromise of personal data must be reported promptly to the designated privacy or security contact. Malaz will assess the incident, take reasonable steps to contain and investigate it, document actions, and make any notifications required by applicable law or contractual obligations.
09Responsibilities and Review
Employees and contractors must follow this Policy, protect credentials, use approved systems, and promptly report suspected incidents. The designated policy owner should review this Policy periodically and when services, data practices, suppliers, security risks, or applicable laws materially change.
10Privacy Contact
11Applicable Law
Malaz will assess and comply with applicable data protection requirements, including Qatar Law No. 13 of 2016 on Protecting Personal Data Privacy where applicable. The correct legal requirements should be confirmed by qualified legal counsel based on the responsible legal entity, its place of establishment, and the services and data flows involved.