Privacy Policy

1. Who We Are

OIQ provides technology-enabled HR, operations and business management services to organizations.

For certain processing activities, OIQ may act as a data controller, meaning that OIQ determines the purposes and means of processing personal data.

When OIQ processes personal data submitted by a client organization solely to provide contracted services, OIQ may act as a data processor/service provider on behalf of that organization, while the client organization remains responsible for determining the purposes of that processing.

The applicable role will depend on the nature of the services and the contractual arrangements between OIQ and the relevant organization.

2. Personal Data We Collect

The personal data we collect depends on how you interact with OIQ.

2.1 Information You Provide Directly

This may include:

• full name;
• business email address;
• telephone or mobile number;
• job title and professional information;
• company or organization name;
• business address;
• information contained in enquiries and consultation requests;
• information contained in assessments;
• information provided when communicating with us;
• account registration information; and
• other information you voluntarily provide to OIQ.

You should not provide sensitive personal information through public website forms unless specifically requested or necessary for an agreed service.

2.2 Client Platform Data

When an organization uses the OIQ platform, the organization or its authorized users may upload or provide information relating to employees, contractors, managers, applicants, customers, suppliers or other individuals.

Depending on the services purchased, this information may include:

• employee and workforce information;
• organizational and departmental information;
• job and role information;
• performance and operational information;
• attendance or workforce-management information;
• survey and assessment responses;
• management reporting information;
• workflow information;
• documents and files;
• communications and notes; and
• other information determined by the client organization.

The client organization is responsible for ensuring that it has an appropriate legal basis and authorization to provide such information to OIQ.

2.3 Technical and Usage Information

We may collect technical information necessary to operate, secure and improve our website and platform, including:

• IP address;
• browser and device information;
• operating system;
• login and authentication information;
• timestamps;
• platform activity;
• security events;
• error and diagnostic information; and
• other information necessary for security and system administration.

Where practical, OIQ uses privacy-preserving analytics techniques.

2.4 Analytics

OIQ may use analytics to understand website usage and improve the service.

Our current website analytics approach uses page-view information together with a daily-rotating, non-reversible visitor identifier.

We do not use advertising cookies or sell personal information for advertising purposes.

Where applicable law requires consent for particular cookies or similar technologies, we will obtain that consent before using them.

3. How We Use Personal Data

We may process personal data for the following purposes:

Service Delivery

• provide HR, operations, consulting and automation services;
• provide access to the OIQ client platform;
• conduct assessments;
• prepare reports and management information;
• configure workflows and automations;
• communicate with clients and users;
• provide technical and customer support.

Business Operations

• respond to enquiries;
• prepare proposals and consultations;
• manage contracts and commercial relationships;
• maintain business records;
• administer accounts and subscriptions;
• process payments where applicable.

Security and Fraud Prevention

• authenticate users;
• protect accounts and systems;
• detect and investigate unauthorized activity;
• maintain audit trails;
• prevent fraud, abuse and security incidents.

Product Improvement

• understand how our services are used;
• troubleshoot technical problems;
• improve functionality, usability and reliability;
• develop and test new features.

Where possible, OIQ will use aggregated, anonymized or de-identified information for these purposes.

Legal and Regulatory Compliance

We may process personal data when reasonably necessary to:

• comply with applicable laws or regulations;
• respond to lawful requests from authorities;
• establish, exercise or defend legal claims;
• protect our rights, property and systems; or
• protect the safety and security of users and other persons.

Marketing Communications

We may send business updates, insights or marketing communications where permitted by applicable law and, where required, based on your consent.

You may withdraw consent or opt out of marketing communications at any time.

4. Legal Basis for Processing

Depending on the circumstances and applicable law, OIQ may rely on one or more lawful grounds for processing personal data, including:

• your consent;
• performance of a contract or steps taken at your request before entering into a contract;
• compliance with a legal obligation;
• a legitimate and lawful business purpose where permitted by applicable law; and
• protection of legal rights, security or other lawful interests.

Under Qatar’s Personal Data Privacy Protection Law, processing generally requires consent unless the processing is necessary for a lawful purpose of the controller or relevant recipient.

Where consent is the applicable basis, you may withdraw your consent subject to applicable legal limitations.

5. HR and Employee Data

Because OIQ provides HR and organizational services, some client data may relate to employees or other workers.

Where OIQ processes such information on behalf of a client organization:

• the client organization determines the purpose for which the information is collected and used;
• the client organization is responsible for providing appropriate notices and obtaining required permissions or consents;
• OIQ processes the information only as necessary to provide the contracted services and according to the client's documented instructions;
• OIQ implements appropriate technical and organizational safeguards; and
• OIQ does not independently use client employee data for unrelated purposes except where required or permitted by applicable law or expressly agreed with the client.

6. Sensitive Personal Data

Certain categories of personal information may require additional protection under applicable law.

Depending on the service, client information may potentially contain information relating to health, physical or psychological condition, religion, marital status, criminal matters, children or other sensitive categories.

Qatar's Personal Data Privacy Protection Law specifically identifies several such categories as personal data of a special nature and provides for additional requirements relating to their processing.

OIQ will not intentionally request sensitive personal data through ordinary website enquiry forms unless reasonably necessary.

Where OIQ processes sensitive personal data as part of a contracted service, the processing will be subject to appropriate contractual, technical, organizational and legal safeguards.

Clients are responsible for ensuring that sensitive information is provided to OIQ only where necessary and where the client has an appropriate legal basis and authorization to do so.

7. Artificial Intelligence and Automated Processing

OIQ may use artificial intelligence (“AI”) and machine-learning technologies to assist in delivering services.

Examples may include:

• summarizing assessment information;
• organizing or categorizing information;
• identifying operational patterns;
• assisting with management reporting;
• generating draft recommendations;
• supporting workflow automation; and
• assisting OIQ personnel with analysis and documentation.

7.1 Human Oversight

AI-generated outputs may contain errors or inaccuracies.

AI outputs used in OIQ services are therefore intended to support professional analysis and decision-making rather than replace appropriate human judgment.

Where OIQ uses AI to assist with assessments or recommendations, appropriate human review will be applied before the output is relied upon for material client decisions.

7.2 No Solely Automated Significant Decisions

OIQ does not intend to make decisions producing legal or similarly significant effects concerning individuals solely through automated processing.

Where applicable, meaningful human review will be maintained.

7.3 Data Minimization for AI

Before personal information is submitted to an external AI provider, OIQ will apply appropriate data-minimization measures where reasonably practicable.

These measures may include:

• removing direct identifiers;
• pseudonymizing information;
• redacting names, email addresses and telephone numbers;
• removing unnecessary identifying information from free text; and
• limiting the information sent to the minimum reasonably necessary for the intended processing.

However, de-identification does not guarantee that information can never be re-identified. OIQ will therefore continue to apply appropriate safeguards to AI-related processing.

7.4 AI Training

Unless expressly agreed otherwise in writing with the relevant client, OIQ will not use confidential client data or client-provided personal data to train general-purpose AI models.

Where an AI provider processes information on OIQ's behalf, OIQ will seek contractual protections appropriate to the nature of the processing, including restrictions on unauthorized use of client information.

8. Sharing of Personal Data

OIQ does not sell personal data.

We may disclose personal data to the following categories of recipients where reasonably necessary:

Service Providers

We may use third-party providers for:

• cloud hosting;
• infrastructure;
• cybersecurity;
• email delivery;
• authentication;
• analytics;
• customer support;
• document storage;
• payment processing;
• AI processing; and
• other technology services.

These providers may process personal data only as necessary to provide services to OIQ or the relevant client and subject to appropriate contractual and security requirements.

Legal and Regulatory Authorities

We may disclose personal data where required by applicable law, court order, regulatory requirement or lawful governmental request.

Professional Advisers

We may disclose information to lawyers, auditors, accountants, insurers or other professional advisers where reasonably necessary for legitimate business or legal purposes and subject to appropriate confidentiality obligations.

Corporate Transactions

If OIQ is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be transferred as part of that transaction subject to applicable confidentiality and data protection requirements.

9. International Data Transfers

Some OIQ service providers or technology infrastructure may be located outside Qatar or outside the country in which you are located.

As a result, personal data may be accessed, processed or stored across national borders.

Where international transfers occur, OIQ will take reasonable and appropriate steps to ensure that the transfer and subsequent processing are conducted in accordance with applicable data protection requirements and contractual obligations.

Where required, OIQ will implement appropriate contractual, technical or organizational safeguards for international transfers.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by applicable law.

Enquiries and Prospective Clients

Enquiry and consultation information may normally be retained for up to 24 months after our last meaningful interaction, unless:

• a client relationship begins;
• a longer period is required for legal or regulatory purposes;
• the information is required to establish or defend legal claims; or
• another lawful basis for continued retention exists.

Client Data

Client data is retained for the duration of the applicable engagement and for a reasonable period thereafter where necessary for:

• contractual obligations;
• legal or regulatory requirements;
• dispute resolution;
• security and audit purposes; or
• legitimate business recordkeeping.

When information is no longer required, OIQ will delete, securely destroy or anonymize it, subject to applicable legal and contractual requirements.

11. Data Security

OIQ maintains technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction.

Depending on the service and risk involved, these measures may include:

• encryption in transit;
• encryption at rest;
• role-based access controls;
• authentication controls;
• logical separation of client environments;
• least-privilege access;
• audit logging;
• security monitoring;
• backup and recovery controls;
• vulnerability management; and
• confidentiality obligations for personnel and service providers.

Important system and administrative actions may be recorded in protected audit logs designed to reduce unauthorized alteration.

No method of transmission or storage is completely secure. Accordingly, OIQ cannot guarantee absolute security, but we continuously work to maintain appropriate safeguards.

12. Data Breaches and Security Incidents

OIQ maintains procedures for identifying, investigating, containing and responding to suspected security incidents.

Where a security incident affects personal data, OIQ will assess the incident and take appropriate remedial and notification measures as required by applicable law and contractual obligations.

Where OIQ acts as a processor for a client organization, OIQ will notify the relevant client in accordance with the applicable agreement and applicable legal requirements.

13. Your Privacy Rights

Depending on your jurisdiction and the circumstances of the processing, you may have rights including:

• the right to know whether we process your personal data;
• the right to access your personal data;
• the right to request correction of inaccurate information;
• the right to request deletion or erasure where legally applicable;
• the right to object to certain processing;
• the right to restrict certain processing;
• the right to withdraw consent where processing is based on consent;
• the right to request portability where applicable; and
• the right to raise a complaint with the relevant competent authority.

Qatar's Personal Data Privacy Protection Law expressly provides individuals with rights including withdrawal of consent, objection in certain circumstances, deletion, correction and access to their personal data.

Some rights may be subject to legal limitations.

Where OIQ processes personal data solely on behalf of a client organization, we may refer your request to that organization where it is the appropriate data controller.

14. How to Exercise Your Rights

To submit a privacy request, contact:

Privacy Contact: privacy@oiq.lt

Please include:

• your name;
• organization, where applicable;
• the nature of your request;
• sufficient information to help us identify the relevant data; and
• information reasonably necessary to verify your identity.

We will take reasonable measures to verify requests before disclosing, changing or deleting personal data.

15. Children's Data

The OIQ website and client platform are intended primarily for business and professional users and are not directed toward children.

OIQ does not knowingly collect personal data directly from children through ordinary website services.

Where a client organization provides information relating to children as part of a contracted service, the client is responsible for ensuring that such processing is lawful and appropriately authorized.

Where required by applicable law, OIQ will apply additional safeguards to children's data.

16. Cookies and Similar Technologies

OIQ may use cookies or similar technologies that are necessary to operate and secure the website and platform.

We may also use privacy-preserving analytics to understand website performance and usage.

OIQ does not use advertising cookies for behavioral advertising and does not sell personal information to advertisers.

Where applicable law requires consent for non-essential cookies or similar technologies, OIQ will request consent before activating them.

17. Third-Party Websites and Services

The OIQ website or platform may contain links to websites or services operated by third parties.

OIQ is not responsible for the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy policy of any third-party service before providing personal information.

18. Client Responsibilities

Organizations using OIQ services are responsible for:

• ensuring that information supplied to OIQ is collected and provided lawfully;
• providing appropriate privacy notices to individuals;
• obtaining required consents or authorizations;
• limiting information supplied to OIQ to what is reasonably necessary;
• ensuring appropriate permissions for sensitive personal data;
• managing user access within their organization; and
• complying with applicable employment, privacy and data protection requirements.

OIQ does not provide legal advice to clients concerning their independent obligations as employers or data controllers unless expressly engaged to provide such advice.

19. Confidentiality

OIQ treats client information as confidential and uses it only for authorized business purposes.

Confidentiality obligations may also be governed by a separate contract, statement of work, master services agreement, non-disclosure agreement or data processing agreement.

Where there is a conflict between this Privacy Policy and a specific written agreement concerning the processing of client data, the applicable agreement will govern to the extent permitted by law.

20. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our services, technology, legal requirements or privacy practices.

When we make material changes, we may provide an appropriate notice through the website, platform or other reasonable communication channel.

The “Last Updated” date at the top of this Policy indicates when it was most recently revised.

21. Contact OIQ

If you have questions, concerns or requests concerning this Privacy Policy or the processing of your personal data, contact:

• OIQ
• Country: State of Qatar
• Privacy / Data Protection Contact: privacy@oiq.lt

22. Governing Requirements

This Privacy Policy is intended to describe OIQ's general privacy practices.

The specific legal requirements applicable to a particular individual, client or processing activity may vary depending on:

• the individual's location;
• the client's location;
• the type of personal data involved;
• the services being provided;
• applicable employment laws;
• contractual requirements; and
• applicable data protection legislation.

Nothing in this Privacy Policy limits any rights that cannot lawfully be excluded under applicable law.