Privacy Policy

1Introduction

This Privacy Policy governs what we can and cannot do with the information you provide. Noqoody Payment Services W.L.L. (“Noqoody”, “we”, “our”, “us”) is committed to protecting your privacy and to processing your personal data honestly, lawfully and only for the necessary purposes described here.

Noqoody complies with the applicable laws and regulations of the State of Qatar relating to the protection of personal data, including Law No. 13 of 2016 concerning Personal Data Privacy Protection (the “PDPPL”) and the guidance issued under it by the National Cyber Security Agency (“NCSA”), together with the requirements, instructions, circulars and guidelines issued by the Qatar Central Bank (“QCB”).

This Privacy Policy applies across all services we provide — our websites, merchant dashboard, hosted checkout and payment links, APIs and mobile SDK, mobile applications, POS acquiring, the Noqoody Wallet, and any other product, event or activity we may offer (together, the “Noqoody Services”).

By “personal data” we mean information that relates to an identified or identifiable individual. We do not treat properly anonymised information as personal data, because it can no longer be used to identify a specific person.

You accept this Privacy Policy when you sign up for, access or use the Noqoody Services. Where we rely on your consent, we will ask for it separately and clearly, and you may withdraw it at any time as described in section 11.

2Who We Are and Our Role

Noqoody Payment Services W.L.L. is a limited liability company incorporated in the State of Qatar under Commercial Registration No. 133834, licensed and supervised by the Qatar Central Bank as a Payment Service Provider, with its registered office at Al Reem Tower, West Bay, Zone 63, Street 841, Building 37, Floor 7, Unit 31, P.O. Box 15205, Doha, Qatar.

Our role under the PDPPL depends on whose data is involved. This distinction matters, because it determines who you should contact about your data.

Our Data Protection Officer is our representative for data protection matters and can be contacted at dpo@noqoody.com.

3Information We Collect

3.1 Information you provide to us

We collect and store the information you give us when you use the Noqoody Services — when you complete a web form, open or update an account, integrate with our APIs, take part in a chat or dispute, apply for a job, attend an event, or otherwise correspond with us. Depending on the service, this includes:

• Contact information — name, address, telephone number, email address and similar details.
• Identity information — Qatari ID or passport details, nationality, date of birth, and identification of beneficial owners and authorised signatories, as required by our regulatory obligations.
• Business information — commercial registration, trade licence, establishment card, ownership structure, business activity, website details and expected transaction volumes.
• Financial information — bank account details you nominate for settlement, and payment instrument details you use to transact.
• Transaction information — the amount, currency, date, time, merchant, payment method, and the status and outcome of each transaction.
• Correspondence — the content of your communications with our support, compliance and sales teams.

3.2 Information we collect automatically

When you use the Noqoody Services, your computer, mobile phone or other access device sends us information. This includes the pages you access, IP address, device identifier and device type, browser and connection information, mobile network information, approximate geolocation, referral URL, page-view statistics and standard web log data. We also collect information through cookies and similar technologies as described in section 17.

This information helps us troubleshoot problems, understand how our services are used, secure our platform and improve what we offer.

3.3 Information from other sources

We may obtain information about you from third parties, including credit bureaus, identity verification and screening providers, sanctions and politically-exposed-person databases, card schemes, acquiring banks, our merchants, publicly available sources, and government registries. We use this to verify the information you give us, to meet our anti-money-laundering obligations, and to assess risk.

3.4 Authentication and fraud detection

To protect you and our merchants from fraud and misuse, we collect information about you and your interactions with the Noqoody Services, and we may assess the device you are using to identify indicators of malicious software or automated activity.

3.5 Mobile devices

Where you connect to the Noqoody Services through a mobile application or a mobile-optimised site, we may receive information about your device, including a unique device identifier, and about your location. Most mobile devices let you control or disable location services in the device settings; if you are unsure how, contact your mobile carrier or device manufacturer.

3.6 Call recording

For quality, training, dispute resolution and our own protection, Noqoody may monitor or record telephone conversations with you or with anyone acting on your behalf. Where we do so, we will tell you at the start of the call.

4Our Lawful Basis for Processing

Our basis for collecting and using personal data depends on the data concerned and the context in which we collect it.

Where we rely on legitimate interests, we carry out an assessment balancing our interest against your rights, and you may object as described in section 11.

5How We Use Your Information

Subject to this Privacy Policy and your data preferences, we use the information we collect to:

1. Carry out our obligations and provide you with the agreed products and services.
2. Establish, maintain and administer your account, and verify your identity.
3. Authorise, process, settle, reconcile and refund transactions, and manage chargebacks and disputes.
4. Maintain, troubleshoot and improve our sites, platforms, applications, products and services.
5. Develop new products and services.
6. Where your preferences permit, provide recommendations and personalised products and services.
7. Measure the performance of our sites, platforms, applications, products and services.
8. Detect, investigate and prevent fraud, financial crime, security incidents and misuse, and protect you, us, our merchants and the public.
9. Meet our legal, regulatory and reporting obligations, including those owed to the QCB and the Financial Information Unit.
10. Communicate with you about the Noqoody Services — notifying you of changes and updates, alerting you to a data or security incident, and providing customer support.
11. With your explicit consent, create and send you promotional and marketing material relevant to you, and carry out quality assurance and training.
12. Promote and market ourselves and our services using non-personally-identifiable information, or personal data where you have explicitly consented.
13. Any other purpose identified to you at the time of collection, or reasonably contemplated by this Privacy Policy and our Terms & Conditions.

6Cardholder Data and Payment Security

1. Noqoody maintains compliance with the Payment Card Industry Data Security Standard (PCI DSS) at the level applicable to our processing volumes, and is assessed accordingly.
2. Card numbers we store are held in tokenised or encrypted form. We do not retain sensitive authentication data — CVV/CVC values, PINs or full magnetic-stripe or chip data — after authorisation.
3. Where a merchant offers One Click Checkout, card-on-file or recurring billing, the credential is stored by Noqoody in tokenised form. The merchant does not receive the full card number.
4. Cardholder data is shared with acquiring banks, card schemes and issuers strictly as required to authorise, clear, settle or dispute a transaction.
5. Merchants are separately responsible for their own PCI DSS compliance and for the security of any data held in their own environment.

7eKYC, Facial Biometrics and Video Verification

In accordance with the PDPPL and the QCB’s eKYC Regulation, we may collect and process biometric data, including facial recognition data, as part of our electronic Know Your Customer procedures.

1. This includes the capture of facial images, live video verification and liveness detection, used to verify and authenticate the identity of an applicant or an authorised individual.
2. Biometric data is processed solely for identity verification, fraud prevention, and compliance with our legal and regulatory obligations. It is not used for marketing, advertising, surveillance or any unrelated purpose.
3. Because of its sensitivity, biometric data receives enhanced protection: strict role-based access controls, encryption in transit and at rest, segregated storage, and logging of every access.
4. We collect and process biometric data on the basis of your explicit consent, except where processing is required to comply with an applicable legal or regulatory obligation. Where you do not consent, we will offer an alternative verification route where one is available to us; if none is available, we may be unable to complete onboarding.
5. Biometric templates are retained only for as long as necessary for verification and for the regulatory record-keeping period in section 15, and are then securely deleted.

8Special Nature Personal Data

Under Article 16 of Law No. 13 of 2016, certain categories of personal data are of a special nature — data relating to ethnic origin, children, health or physical and psychological condition, religious beliefs, marital relations, and criminal offences.

1. Noqoody does not seek out special nature personal data and does not require it to provide the Noqoody Services.
2. Where processing such data is unavoidable, we do so only after obtaining your explicit consent and, where the law requires it, the prior permission of the Competent Department at the National Cyber Security Agency.
3. All such data is encrypted and subject to additional safeguards, access restrictions and audit logging.
4. As a matter of policy, we apply the same enhanced safeguards to biometric and facial recognition data used for eKYC, whether or not it falls within Article 16.
5. If you send us special nature data we did not ask for — for example in a support message — we will not use it for any purpose and will delete it where we are able to do so.

9Sharing Your Information

Personal data we collect stays within Noqoody, except in the following circumstances:

1. Where you give us explicit consent to share it.
2. With acquiring banks, card schemes and issuing institutions, as necessary to authorise, clear, settle, refund or dispute a transaction, and to meet scheme rules.
3. With the merchant you are paying, to the extent needed to identify the transaction, deliver the goods or services, and handle refunds and disputes.
4. With our affiliates and with partners and trusted organisations we work with to deliver products and services to you.
5. With service providers and processors acting on our instructions — including data centres, hosting and cloud providers, customer support platforms, identity verification and screening providers, fraud prevention services, communications providers, debt collectors, accountants, auditors and insurers. All are bound by written contracts requiring confidentiality and appropriate security, and may use the data only for the purposes we specify.
6. With regulators, supervisory bodies and law enforcement — including the Qatar Central Bank, the Financial Information Unit, the National Cyber Security Agency, tax authorities, courts and other competent authorities — for legal or contractual compliance and reporting, or where we believe in good faith that disclosure is reasonably necessary to protect our rights or property, or the rights of third parties or the public.
7. With prospective sellers or buyers of our business or assets, as described in section 19.

We do not sell your personal data, and we do not share it with third parties for their own independent marketing purposes.

10International Transfers

1. Your information may be processed outside the country where you live. Wherever we use, process or store your data, we apply the protections set out in this Privacy Policy and required by applicable law.
2. Where we transfer personal data outside the State of Qatar, we put appropriate safeguards in place in accordance with the PDPPL, NCSA guidance, and the Qatar Central Bank’s data residency, outsourcing and cloud computing requirements.
3. Those safeguards include contractual protections with the recipient, an assessment of the legal regime in the destination country, encryption in transit and at rest, and restrictions on onward transfer.
4. Certain categories of data are subject to residency requirements under QCB rules and are held within Qatar. We do not transfer such data abroad except where the QCB permits it.

11Your Rights

It is your personal data, and you have rights over it. Under the PDPPL you have the right to:

• Be informed of the purposes for which your data is processed, at or before the point of collection.
• Access your personal data and request a copy of it.
• Rectify data that is inaccurate, incomplete or out of date.
• Erase your data where processing is no longer necessary or is unlawful.
• Object to processing that is unnecessary, unfair, or that we base on legitimate interests.
• Restrict processing in certain circumstances.
• Withdraw consent at any time, where our processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Opt out of direct marketing at any time.
• Complain to us and to the supervisory authority.

How to exercise your rights

1. Email dpo@noqoody.com. We will verify your identity before acting on a request, to make sure we do not disclose your data to someone else.
2. We aim to respond within 30 calendar days. Where a request is complex or we receive several from you, we may extend this and will tell you if we do.
3. We do not normally charge for reasonable requests. Where a request is manifestly excessive or repetitive, or requires disproportionate effort, we may charge a reasonable fee, which we will tell you about before proceeding.
4. To unsubscribe from marketing, use the unsubscribe link at the bottom of our emails or email dpo@noqoody.com.
5. You may update much of your own information directly in the Noqoody merchant dashboard under Settings.

12Accuracy

We take all reasonable steps within our control to ensure the personal data we hold about you is accurate, complete and up to date. We also rely on you to tell us about changes — in particular changes to your ownership, authorised signatories, business activity, bank account and contact details. If we become aware that data we have disclosed was inaccurate, we will notify you without undue delay and take corrective action.

13Security

1. We are committed to protecting your personal data and have implemented technical and organisational measures to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks.
2. These measures include encryption in transit and at rest, network segmentation, role-based access control on a least-privilege basis, multi-factor authentication for administrative access, logging and monitoring, vulnerability management and penetration testing, secure development practices, staff screening and mandatory training.
3. We apply privacy and security by design: we assess data protection implications when we design, develop or materially change any system or service that processes personal data.
4. Although we work to create a safe and secure environment, no system can be guaranteed impenetrable. To the extent permitted by applicable law, we exclude liability arising from unauthorised access to your personal data that occurs despite our having taken appropriate measures.
5. Please contact us at security@noqoody.com immediately if you become aware of any unauthorised use of your account or any other breach of security. If you are a security researcher, please follow our Responsible Disclosure Policy.

14Personal Data Breaches

1. We maintain an incident response process covering detection, containment, assessment, notification and remediation.
2. Where a personal data breach occurs that causes or is likely to cause serious damage, we will notify the Competent Department at the National Cyber Security Agency within 72 hours of becoming aware of it, in line with NCSA guidance.
3. We will notify affected individuals without undue delay where the breach poses a risk to their rights and freedoms. We may not need to notify you where the risk is low — for example, where the affected data was strongly encrypted and the keys were not compromised.
4. Where we act as a processor for a merchant, we will notify that merchant without undue delay so it can meet its own obligations.
5. We will also notify the Qatar Central Bank, card schemes, acquiring banks and other parties where our regulatory or contractual obligations require it.

15How Long We Keep Your Data

How long we keep personal data depends on what it is and whether we have an ongoing business or legal need to retain it.

Where a longer period is required by law, by a regulator or by an ongoing investigation or legal claim, we retain the data for that longer period. Once no purpose remains, we securely delete or anonymise it.

16Children

The Noqoody Services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. Data relating to children is special nature data under Article 16 of the PDPPL and receives the additional protections described in section 8. If we become aware that we have collected a child’s data without the appropriate consent, we will delete it promptly. If you believe we hold such data, contact dpo@noqoody.com.

17Cookies

To make our sites work properly, we sometimes place small data files called cookies on your device. A cookie is a small text file a website stores on a visitor’s device and that the browser returns each time the visitor comes back. It lets the site remember your actions and preferences — login, language, display settings — so you do not have to re-enter them.

Third parties — including advertising networks and analytics providers — may also set cookies we do not control. You can control and delete cookies through your browser settings, and you can set most browsers to block them. If you do, you may need to adjust preferences on each visit, and some functionality may not work.

18Marketing Communications

1. We send marketing communications only where you have consented, or where we are otherwise permitted by law to contact you about services similar to those you already receive.
2. Every marketing email contains an unsubscribe link. You can also opt out at any time by emailing dpo@noqoody.com.
3. Opting out of marketing does not stop service messages — transaction alerts, settlement notices, security warnings, policy changes and other operational communications, which we must send you.

19Business Transfer

If Noqoody, or substantially all of its assets, were acquired, or if we ceased business or entered insolvency, user information would be one of the assets transferred or acquired. Any such transfer would require the prior approval of the Qatar Central Bank. You acknowledge that an acquirer of our business may continue to use your personal data as set out in this Privacy Policy, and we would notify you of any material change in how it is used.

20Links to Third-Party Websites

Our sites may contain links to and from third-party websites, including merchant websites. If you follow such a link you do so at your own risk and subject to that site’s own privacy policy and terms. We have no control over, and are not responsible or liable for, the content, privacy practices or terms of those sites, or for any information you provide to them. Please read their privacy policies before providing personal data.

21Changes to This Policy

1. We may amend this Privacy Policy at any time by posting a revised version on noqoody.com. The revised version takes effect when posted.
2. Where a revision involves a substantial change, we will give you at least 30 days’ prior notice by posting a notice on our website and, where we hold your contact details, by email.
3. If we intend to use your personal data in a materially different way from that described here, we will notify you and, where consent is the basis, give you the choice whether to permit it.
4. Continued use of the Noqoody Services after a revision takes effect indicates your acceptance of it. We encourage you to check this page periodically for the current version.

22Contact Us and Complaints

If you have questions, feedback or a complaint about this Privacy Policy or how we handle your data, please contact us.

We will review and investigate your complaint and aim to respond within 30 calendar days. If you are not satisfied with our response, you have the right to complain to the Personal Data Privacy Protection Department at the National Cyber Security Agency, the supervisory authority for Law No. 13 of 2016. Where your complaint concerns a payment service, you may also escalate it to the Qatar Central Bank.