DOHA BANK Privacy Policy

We collect information in a variety of contexts, based on our relationship or how we interact with you. This Notice applies to all Personal Data that is collected or received through the various sources.

For example, we may collect information:

• Directly from you. This includes information you give us when you apply or register for our products and services on physical or electronic forms, use our online banking services or mobile apps, communicate with us (via phone calls, emails, text and other electronic messages), respond to surveys, provide feedback, or enter contests or promotions.
• Automatically when you use our Online and Mobile Banking Services. We may collect Device Data, Online / Mobile Activity Data, and other information automatically when you interact with us online. This data may be collected through cookies, server logs or other similar technologies.

We may also collect information from other sources such as:

• From your authorized representative(s) or other individuals acting on your behalf, such as a legal guardian or power of attorney,
• From third-party data sources to support activities such as fraud prevention, identity verification, background checks, etc.
• Market research (if feedback is not provided on an anonymous basis),
• From our co-branded card or business partners,
• From publicly available data sources including social media, to the extent that you manifestly choose to make your profile publicly visible,
• Through our closed-circuit television (“CCTV”) cameras when you visit our premises and branches, and
• Data received when we acquire other companies. For clarity, when we acquire a company, their privacy policy and notices apply until such time as Doha Bank’s privacy practices are implemented.

Where you disclose Personal Data to us or our service providers on behalf of another person, you confirm that you have informed the individual and have obtained authorization from that individual to share their Personal Data for use in accordance with this Privacy Notice.

We may process different kinds of Personal Data about you, which we have grouped as follows:

• When you sign up for or use a financial product or service, we may collect:
  

  Information Type	Information Included
  Contact or identity data	such as your name, mailing address, email address, phone number, date of birth, government-issued identifier (e.g., Identification Card, tax ID number, driver’s license, or other government ID), citizenship, username and password, profile picture, and other information that directly identifies you.
  Account-related data	such as account number, credit / debit card number, account history, account balances, loan details, vehicle or property information, information about beneficiaries and joint account holders, business-related information (e.g., business name, address, revenue, and industry type), and other information related to your Doha Bank accounts, applications, or prequalification inquiries.
  Transaction data	such as credit / debit card purchases, payment or transaction history, transaction details when you transfer money to or from your Doha Bank accounts, and third-party billing information or statements.
  Credit report information	such as your credit score, credit history, and other information that we receive from credit reporting agencies.
  Demographic data	such as gender, marital status, age, household size/composition, education level, income, occupation, and employment status.

• When you browse our website or use our mobile apps, we may also collect:
  

  Information Type	Information Included
  Device data	such as your device type, internet protocol address, general location (e.g., city, state, or country), precise location (e.g., latitude / longitude to find a nearby Doha Bank branch or ATM)
  Online / mobile activity data	such as login data, search history, information about how you use and interact with our Online Services or advertising (including content viewed, links clicked, and features used), when and how often you use our Online Services, the webpage from which you clicked a link to come to our Online Services (e.g., the referrer website address (URL). Access to various device features on your permission such as Camera; Telephone; Files / Media / Storage permission; Other Permissions such as view Network / Wi-Fi connections; view Google service configuration; use fingerprint/biometric hardware; upload of user’s installed application information.

• When you interact with us, we may collect:
  

  Information Type	Information Included
  Surveillance data	such as your images, voice and other similar information or surveillance footage by CCTV cameras on our premises, branches and/or ATMs.
  Marketing data	such as your marketing preferences, information about products or services we think you might like, and inferences based on your interactions with us or our partners (e.g., Online / Mobile Activity Data used for targeted advertising).
  Communications data	such as your communication preferences and details or the content of your communications with us (e.g., chat messages).
  Survey and research data	such as your responses to questionnaires, surveys, requests for feedback, and research activities.

• If you inquire about or apply for a job at Doha Bank, we may also collect:
  

  Information Type	Information Included
  Employment application data	such as identification and contact information, professional, employment-related, and education history collected through the Online Services about job applicants, employees, associates, contractors, or other members of the Doha Bank workforce.

We use your Personal Data to provide you with our products and services, meet applicable legal and regulatory obligations, maintain our relationship with you, and to effectively manage and improve our operations.

Each use is supported by a valid reason under the applicable Privacy Law (“Lawful Basis”), such as:

• Contractual obligation: Processing the Personal Data is necessary to enter or fulfil contractual obligations;
• Legal obligation: Processing the Personal Data is necessary to comply with an applicable legal or regulatory obligation;
• Legitimate interests: Processing the Personal Data is necessary to support our business operations and maintain trusted relationships;
• Consent: Where you have given us your express authorization, for example, for direct marketing activities.

We will use your Personal Data only for the purposes stated in this Notice or for reasons communicated during collection of the data. If we need to use your data for an unrelated purpose, we will notify you and seek your consent where required.

If you choose not to provide certain Personal Data or not to allow its use, we may be unable to provide specific products or services. We will inform you when this is the case.

The different ways we use your Personal Data and the lawful reasons for the same are listed below. Please note that not all the uses below will be relevant to every individual. In some cases, more than one lawful reason will apply.

We may collect Special Nature or Sensitive Personal Data about you, such as information about race, health, physical or psychological condition, religion, marital relations, criminal offences, and data concerning children.

We will only process such data for clearly identified and lawful purposes, and after obtaining the required authorization.

We recognize the importance of protecting privacy where children or minors are involved. We do not knowingly collect Personal Data from children or minors. If we become aware that such data has been collected unintentionally, we will promptly remove it from our records.

In cases where Personal Data about a child or minor is required, for example, to provide banking products or services, or to participate in promotional awards or other activities, we only collect data that is strictly necessary. Such data is collected only from the parent or legal guardian who holds parental or legal responsibility for the child, and with their explicit consent as required by applicable Privacy Law.

As a parent or legal guardian, you have the right to request that we exercise your child’s rights in relation to the child’s Personal Data that we hold. This includes access to the Personal Data we hold about the child and what we use it for, requesting deletion, removal or suspension of processing. More information on these rights is covered in the section on ‘YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM’.

We may disclose your Personal Data to our trusted third parties providing services to us or performing services on our behalf, and with other agencies where required for legal or regulatory purposes.

These include:

• Our affiliates and subsidiaries, including for our Group-wide operations.
• Third parties under agreements that require them to protect your Personal Data to the standards provided under applicable Privacy Law. We require all third parties to keep the data confidential and restrict its disclosure, and only use it for agreed purposes including:
  
  • Delivering services related to our products and services;
  • Supporting our internal operations e.g. fraud investigation, debt recovery and skip tracing activities;
  • Carrying out our business functions e.g. Information Technology (IT) operations.
  • Facilitating transactions with financial institutions and merchants.
  • Providing emergency or disaster response services at our premises in case of an emergency.
  • Emergency and disaster response providers in case of emergency at our premises.
• Your authorized representatives, as designated by you, your agents or your affiliated entities, in connection with the relationship you have with us or the products and services we provide.
• Partners who provide us with professional advice: These include legal consultants, insurers, auditors, and legal advisors, including in connection with prospective or actual legal proceedings to establish, exercise or defend our legal rights.
• Government authorities, credit bureaus and statutory bodies: If the government, judicial, security, investigatory, regulatory authorities, statutory bodies or financial institutions seek your Personal Data, we may be required to disclose it for:
  
  • Prevention, detection, investigation and prosecution of crime in any jurisdiction (including, without limitation, money laundering, terrorism, fraud and other financial crime);
  • Identity verification, government sanctions screening and due diligence checks;
  • To comply with local or foreign law, regulations, directives, judgments or court orders, government sanctions or embargoes, reporting requirements under financial transactions legislation, and demands of any authority, regulator, tribunal, enforcement agency, or exchange body; and
  • Any purpose permitted by Law.

Please note, we do not rent or sell your Personal Data to any third parties for any purpose.

The security of Personal Data including data of special nature is a priority for Doha Bank. We take all reasonable steps to prevent the loss, misuse and unauthorized access, alteration or disclosure of the information under our control by implementing appropriate physical, logical and administrative safeguards.

• People who can access your Personal Data. Your Personal Data is accessed only by authorized staff, agents or third parties, on a need to know basis, and for specific identified purposes. Our personnel are required to comply with strict data safeguards including agreeing to confidentiality obligations. When we contract with third parties, we require that they have appropriate security, confidentiality and privacy measures in place to ensure that Personal Data is handled safely.
• Measures taken in operating environments. We handle and store your Personal Data in secure environments. We have put in place appropriate internal policies and security standards to ensure the confidentiality, integrity and availability of Personal Data. We continue to review our security controls and related policies and procedures to ensure that your information remains secure.

Please note, however, that these protections do not apply to information you choose to share in public areas, such as third-party social networks. Moreover, while we take reasonable steps to protect Personal Data during transmission, no method of internet is completely secure, and we cannot guarantee absolute security when you transmit your Personal Data to us over the internet or similar connection.

You are responsible for complying with any security requirements we inform you of, such as keeping your passwords, PINs and other login information private and not sharing them. Please reach out to us immediately if you suspect there is unauthorized access or use of your details.

We may sometimes need to transfer your Personal Data outside the country’s borders when dealing with our international partners to provide services to you, such as cloud service providers, or as part of our Group obligations and operations. Any transfer or transmission of your Personal Data to, and/or storage at a location outside country borders will be in accordance with applicable Privacy Law.

We will only share or store the data outside borders where necessary, with appropriate and adequate safeguards in place, and with parties who are bound to protect your Personal Data with the same level of care and security as required under applicable Privacy Law.

Depending on the relationship you have with us, we will retain your Personal Data for as long it is needed to fulfil the purposes it was collected for, and for any additional period that is required to meet our legal, regulatory or legitimate business requirements. For example, where it is relevant to a complaint, to protect our legal right, or if we reasonably believe there is a prospect of legal action in connection with our relationship with you.

During this retention period, your data will continue to be stored securely and in accordance with applicable Privacy Law and this Notice.

We may use your Personal Data to:

• Keep you updated about our products and services;
• Share information about our discounts, offers, rewards, promotional campaigns, events, lucky draws that may be relevant and beneficial to you;
• Invite you to participate in market research or surveys, to provide your feedback with the aim of improving our offerings and customer experience.

We will not contact you for these purposes if you have specifically asked us not to do so. You have the right to opt out of receiving such communication at any time, and your choice will apply to future communications. To do so please contact your branch or our Customer Service at, +965 22917222 or e-mail us at hellodoha@dohabank.com.qa.

The Doha Bank Website uses cookies, which are small pieces of information that are automatically downloaded to your device when you visit a website. Cookies help improve your browsing experience and allow us to understand how our website is used. This information may include your preferences and settings, website usage, for instance, how often you visit pages, number of visitors and their behaviour, targeted advertising, and information for authentication.

You have the option to accept or decline cookies by:

• Changing your browser settings to notify you when you when a cookie is sent, so you can choose whether to accept it.
• Setting your browser to automatically block cookies.

Subject to applicable laws and regulations, you may have the right to invoke your rights in relation to your Personal Data being processed by us.

The rights that you can invoke as an individual can be:

You can submit a request to exercise any of these rights by sending us an e-mail at hellodoha@dohabank.com.qa or calling us at +965 22917222 attaching a copy of your ID or equivalent details (where requested by us and permitted by law).

If the request is submitted by a person other than you, without providing evidence that the request is legitimately made on your behalf with your authorization, the request will be rejected. We may also reject a request where the request is deemed excessive or malicious, or if an exemption applies.

Please note that any identification information provided to us will only be processed in accordance with, and to the extent permitted by applicable laws.

We shall provide information on action taken on a request pertaining to the rights above without undue delay and in any event within 30 calendar days of receipt of the request.

If you have any questions or comments about our privacy practices, or you wish to exercise your privacy rights, you can always reach out to us via email at hellodoha@dohabank.com.qa.

We will acknowledge and investigate any grievance or complaint about the way we manage your Personal Data as expeditiously as possible.

If you are unhappy about the way in which we handle your request or issue, you have a right to raise a concern with the regulatory or supervisory authority in charge of data protection issues.

This Notice is subject to change and may be updated periodically to reflect any amendments in the applicable privacy laws, any change in the way we handle your Personal Data and based on your feedback wherever applicable, any other required changes. The updated Notice will be posted on this website. By continuing to use our website and to interact with us, you are confirming that you have read and understood the latest version of our Privacy Notice.