Privacy Policy

This Privacy Policy applies to all personal data processed by Q Prime Holding and its subsidiaries and affiliates (collectively, the "Group") in the course of business operations, including:

• Visitors to our corporate website and investor relations platforms;
• Shareholders, potential investors, and institutional counterparties;
• Employees, contractors, and job applicants;
• Suppliers, service providers, and business partners;
• Participants in corporate events, surveys, and marketing communications;
• Individuals who contact us via email, telephone, or physical correspondence.

This Policy does not apply to:

• Anonymous or de-identified data that cannot reasonably be linked to an identifiable individual;
• Third-party websites or services linked from our platforms, which are governed by their own privacy policies;
• Data processed by our subsidiaries operating under independent legal frameworks, except where explicitly stated.

We collect and process categories of personal data that are necessary for the purposes outlined in this Policy. The data we collect varies depending on your relationship with us and the Services you use.

We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately using the details in Section 13.

Q Prime Holding processes your personal data for specific, explicit, and legitimate purposes. We do not process personal data in ways that are incompatible with those purposes.

Primary purposes include:

• Corporate Governance & Regulatory Compliance — To meet our obligations as a publicly listed company under QFMA and QSE regulations, including shareholder register maintenance, AGM administration, and regulatory filings.
• Investor Relations — To communicate with shareholders and potential investors, distribute annual reports, provide market updates, and respond to enquiries.
• Service Delivery — To provide the Services you request, manage your account, and process transactions.
• Security & Fraud Prevention — To verify identity, detect unauthorised activity, and protect our infrastructure and stakeholders.
• Business Operations — To manage supplier relationships, process payments, and conduct due diligence in accordance with anti-money laundering (AML) and counter-terrorism financing (CTF) laws.
• Marketing & Communications — To send you updates, event invitations, and publications where you have provided consent or where we have a legitimate interest.
• Legal Proceedings — To establish, exercise, or defend legal claims where necessary.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose.

Under the PDPPL and applicable international frameworks, we rely on the following legal bases for processing your personal data:

1. Contractual Necessity — Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g., shareholder services, employment agreements).
2. Legal Obligation — Where processing is necessary for compliance with a legal obligation to which Q Prime Holding is subject (e.g., QFMA disclosure requirements, tax regulations, AML/CTF laws).
3. Legitimate Interests — Where processing is necessary for the purposes of the legitimate interests pursued by Q Prime Holding or a third party, except where such interests are overridden by your fundamental rights and freedoms. Our legitimate interests include corporate governance, network security, and business continuity.
4. Consent — Where you have given explicit consent to the processing of your personal data for one or more specific purposes (e.g., marketing communications, participation in surveys). You have the right to withdraw consent at any time by contacting us or using the unsubscribe mechanism provided.
5. Vital Interests — In limited circumstances, where processing is necessary to protect your vital interests or those of another person.

Q Prime Holding does not sell, rent, or trade your personal data. We may share your data with the following categories of recipients under strict confidentiality and data protection obligations:

• Group Companies — Our subsidiaries and affiliates within the Q Prime Holding Group, where necessary for internal reporting, consolidated governance, and operational efficiency.
• Regulatory Authorities — The Qatar Financial Markets Authority (QFMA), Qatar Stock Exchange (QSE), Qatar Central Bank (QCB), and other governmental bodies as required by law.
• Professional Advisers — External auditors, legal counsel, financial advisers, and consultants bound by professional secrecy and contractual confidentiality.
• Service Providers — Third-party vendors who provide IT infrastructure, cloud hosting, email delivery, analytics, and investor relations platform management. These providers act as data processors under written agreements that comply with the PDPPL.
• Counterparties — In the context of mergers, acquisitions, asset sales, or corporate restructuring, your data may be transferred to the relevant successor entity under confidentiality agreements.

We require all third-party recipients to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

Your personal data is primarily stored and processed within the State of Qatar. However, as a company with international investors and service providers, your data may occasionally be transferred to countries outside Qatar.

Where we transfer your personal data internationally, we ensure that appropriate safeguards are in place, including:

• Adequacy Decisions — Transfers to jurisdictions deemed by the Qatari authorities to provide an adequate level of data protection.
• Standard Contractual Clauses — The use of Qatar-approved standard contractual clauses or equivalent data transfer agreements with recipients.
• Intra-Group Agreements — Binding corporate rules and data processing agreements between Q Prime Holding and its international affiliates.

If you are located in the European Economic Area (EEA) and we transfer your data outside the EEA, we implement additional safeguards in accordance with GDPR Chapter V requirements.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

Retention periods are determined based on:

• The amount, nature, and sensitivity of the personal data;
• The potential risk of harm from unauthorised use or disclosure;
• The purposes for which we process your data and whether we can achieve those purposes through other means;
• Applicable legal and regulatory retention requirements (e.g., QFMA record-keeping rules, tax legislation).

Typical retention periods include:

• Shareholder records: 10 years from cessation of shareholding;
• Employee and applicant data: 7 years from end of employment or application;
• Website analytics and logs: 24 months;
• Marketing consent records: 5 years from withdrawal of consent or last interaction.

Upon expiry of the retention period, your personal data is securely deleted, anonymised, or pseudonymised in accordance with our data destruction protocols.

Under the Personal Data Privacy Protection Law (Law No. 13 of 2016), you have the following rights in relation to your personal data:

• Right to Access — You have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of that data and information about the processing.
• Right to Rectification — You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten") — You have the right to request deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to Restrict Processing — You have the right to request that we suspend the processing of your personal data in specific circumstances.
• Right to Object — You have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to Data Portability — Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent — Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 13. We will respond to your request within 30 days of receipt, in accordance with the PDPPL. We may request additional information to verify your identity before fulfilling your request.

Our website uses cookies and similar tracking technologies to distinguish you from other users, enhance your browsing experience, and analyse site usage.

Types of cookies we use:

• Strictly Necessary Cookies — Essential for the operation of our website. These cannot be disabled in our systems. They are typically set only in response to actions you take, such as setting privacy preferences, logging in, or filling forms.
• Performance & Analytics Cookies — Allow us to count visits and traffic sources so we can measure and improve the performance of our site. All information collected is aggregated and therefore anonymous.
• Functional Cookies — Enable the website to provide enhanced functionality and personalisation. They may be set by us or by third-party providers whose services we have added to our pages.
• Targeting & Marketing Cookies — May be set through our site by our advertising partners to build a profile of your interests and show you relevant content. They do not store directly personal information but are based on uniquely identifying your browser and device.

You can manage your cookie preferences at any time by clicking "Cookie Settings" in the footer of our website or by adjusting your browser settings. For detailed information, please refer to our Cookie Policy at /legal/cookie-policy.

Q Prime Holding implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security framework aligns with ISO/IEC 27001 standards and QFMA cybersecurity guidelines.

Measures include:

• Encryption — All data in transit is protected using TLS 1.3 encryption. Sensitive data at rest is encrypted using AES-256.
• Access Controls — Role-based access control (RBAC) restricts data access to authorised personnel with a legitimate business need. Multi-factor authentication (MFA) is mandatory for all systems processing personal data.
• Network Security — Firewalls, intrusion detection systems, and regular vulnerability assessments protect our network perimeter.
• Physical Security — Data centres and physical records are secured with access control, surveillance, and environmental controls.
• Incident Response — We maintain a documented data breach response plan in accordance with PDPPL notification requirements. In the event of a breach likely to result in high risk to your rights and freedoms, we will notify you and the relevant authorities without undue delay.
• Staff Training — All employees with access to personal data receive regular data protection and information security training.

While we take every reasonable precaution, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Any changes will be posted on this page with an updated "Last updated" date.

Material changes that affect your rights or our processing activities will be communicated to you directly where required by law, including via email (if you have provided contact details) or through a prominent notice on our website.

We encourage you to review this Policy periodically. Continued use of our Services after any changes constitutes acceptance of the revised Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our Data Protection Officer ("DPO"):

For formal complaints under the PDPPL, you may also contact:

We aim to respond to all enquiries within 5 business days.