Privacy Policy

1. Data Controller Identification

This Privacy Policy governs the processing of personal data collected through the ZaytoonPay digital platform, operated by Zaytoon Technologies W.L.L., a limited liability company organized under the commercial laws of the State of Qatar, having its registered operational address in Doha, Qatar. For all inquiries relating to data protection, our dedicated compliance office can be reached at support@zaytoonpay.qa.

2. Scope of Policy

This document details our operational practices concerning the collection, storage, transfer, and utilization of personal data pertaining to users engaging our Qatar mobile phone balance top-up and related airtime distribution services.

3. Categories of Data Collected

We process information in three distinct functional categories:

• Information Provided Directly: User full name, email contact, mobile telephone number (+974 and recipient numbers), preferred mobile network operator (e.g., Ooredoo Qatar, Vodafone Qatar), and direct communication messages submitted through contact and support webforms.
• Automatically Generated Technical Data: Internet Protocol (IP) addresses, browser specification strings, hardware device types, operating system telemetry, referring URLs, request timestamps, and transaction identifier codes.
• Analytics & Behavioral Telemetry: Aggregated browsing flow, transaction completion milestones, and interaction logs captured via Google Consent Mode v2 infrastructure.

4. Processing Purposes & Legal Grounds (Qatar PDPPL)

The following table summarizes our lawful processing grounds in strict compliance with Qatar Law No. 13 of 2016 (PDPPL):

5. Cookies & Google Consent Mode v2 Framework

ZaytoonPay uses cookie identifiers to guarantee transactional stability and adhere to Google Consent Mode v2 standards. By default, prior to positive user selection on our cookie consent banner, non-essential data signals (advertising, analytics, user data sharing) remain strictly set to denied. Users retain the perpetual right to update, modify, or revoke consent at any time via the "Cookie Settings" mechanism present in our footer.

6. Third-Party Disclosures & Non-Sale of Data

We do not sell, rent, trade, or monetize personal user records under any circumstances. Personal data is strictly shared with verified service providers necessary to fulfill customer recharges, including licensed payment gateways, Qatar telecommunications operators (Ooredoo Qatar, Vodafone Qatar) to dispatch balance adjustments, and cloud hosting infrastructure providers operating under strict confidentiality contracts.

7. International Cross-Border Transfers

Where processing tasks require routing encrypted telemetry to international cloud servers (such as analytical engines or payment verification clusters), ZaytoonPay implements standard contractual clauses and rigorous technical encryption safeguards adhering to the international transfer requirements of Qatar PDPPL.

8. Retention Policies

Transactional records, including telephone numbers recharged and electronic invoice copies, are retained for a statutory period required by Qatari commercial and tax bookkeeping laws (ordinarily five years). Purely functional analytical telemetry is purged or fully anonymized on a 14-month rolling schedule.

9. User Rights under Qatar PDPPL

Pursuant to Chapter Two of Qatar Law No. 13 of 2016, individuals within Qatar possess enforceable statutory entitlements:

• Right of Access: You may request full confirmation of whether your data is being processed and obtain an electronic copy.
• Right to Rectification: You may demand correction of erroneous, incomplete, or outdated phone records.
• Right to Erasure: You may request deletion of your information when it is no longer required for statutory tax or transactional fulfillment.
• Right to Object & Revoke Consent: You may withdraw your consent for non-essential processing at any stage.
• Supervisory Authority: You maintain the legal right to submit a grievance to the National Cyber Security Agency (NCSA) / Compliance and Data Protection (CDP) Department in the State of Qatar.

10. Data Security Protocols

We deploy robust organizational, administrative, and technological security controls including TLS 1.3 encryption, network firewalls, strict role-based access restrictions, and zero permanent local storage of full credit card primary account numbers (PANs).

11. Children's Privacy

Under Qatari legal context, our services are aimed at consumers having legal contractual capacity. We do not intentionally solicit or process personal records of children under 18 years of age without parental or guardian authorization.

12. External Website Links

Our website may feature links to external websites, including official Qatar regulatory portals or telecom carrier dashboards. We disclaim responsibility for the independent privacy measures of external entities.

13. Policy Modifications

We reserve the authority to amend this Privacy Policy periodically. Any updates will be displayed directly upon this URL with an updated revision date.

14. Privacy Office Contact

For inquiries, rights enforcement requests, or compliance clarifications, contact our data protection team exclusively via email at support@zaytoonpay.qa.