Privacy Policy

1. Introduction
   Ajyal Fintech Solution LLC (Wafir) prioritizes the protection of personal data as a cornerstone of its
   operations. This policy outlines Wafir’s commitment to safeguarding customer and organizational
   information while ensuring compliance with Qatar’s Personal Data Privacy Law, Qatar Central Bank
   (QCB) regulations, and international standards like GDPR.
   By embedding data protection into its processes and systems, Wafir fosters trust, ensures operational
   transparency, and upholds the privacy rights of its stakeholders.
2. Policy Objectives
   The objectives of this policy are to:

• Establish a framework for the lawful, ethical, and secure handling of personal data.
• Protect personal data from unauthorized access, breaches, and misuse.
• Ensure compliance with relevant regulatory and legal requirements.
• Promote a culture of accountability and transparency in data processing.
• Support Wafir’s strategic goals by integrating privacy into its business processes.

1. Policy Scope
   This policy applies to:

• Personal Data: Information such as names, contact details, financial records, transaction histories,
  and identification documents.
• Stakeholders: Customers, employees, contractors, and third-party service providers.
• Processes: Collection, storage, processing, sharing, and deletion of data.
• Technologies: Cloud platforms, mobile applications, AI-driven solutions, and blockchain systems.

1. Policy Application
   This policy governs:

• Data Collection: Ensuring that data is collected lawfully, with user consent where required.
• Data Processing: Processing data only for legitimate business purposes and in compliance with
  regulatory guidelines.
• Data Sharing: Establishing clear protocols for data sharing with third parties and regulatory
  authorities.
• Data Retention: Retaining data only as long as necessary for business or regulatory purposes.
• Data Disposal: Securely disposing of data once it is no longer needed.

1. Policy Ownership
   Responsibility for the implementation and monitoring of this policy is distributed as follows:

• Board of Directors: Provide strategic oversight and ensure policy alignment with Wafir’s goals.
• Data Protection Officer (DPO): Manage data protection compliance, oversee audits, and respond to data
  breaches.
• IT and Security Teams: Implement technical measures to safeguard data and maintain system integrity.
• Employees and Contractors: Adhere to the policy and report any potential violations or risks.

1. Policy Exemptions
   Exemptions to this policy may be granted under specific conditions:

• Approval Process: All exemption requests must be reviewed by the DPO and approved by the Board.
• Documentation: Detailed justification and mitigation measures must be documented for all exemptions.
• Periodic Review: Exemptions are subject to periodic evaluations to ensure compliance and relevance.

1. The Significance of Compliance
   Compliance with this policy is critical for:

• Regulatory Adherence: Avoiding penalties by meeting QCB and legal requirements.
• Risk Mitigation: Reducing vulnerabilities to breaches and unauthorized data access.
• Stakeholder Trust: Building confidence among customers, regulators, and partners.
• Operational Integrity: Ensuring uninterrupted service delivery by safeguarding data.

1. Key Elements
   8.1. Data Collection and Consent

• Collect data transparently, ensuring users are informed about its purpose and usage.
• Obtain explicit consent where required, particularly for sensitive data.
  8.2. Data Processing
• Process data only for specified, lawful purposes, ensuring minimal and relevant data use.
  8.3. Data Sharing
• Share data with third parties only under contractual agreements or regulatory obligations.
• Ensure third-party compliance with Wafir’s privacy standards.

8.4. Data Retention and Disposal

• Retain data in line with business needs and legal requirements.
• Securely delete or anonymize data when no longer required.

1. Integration with WAFIR’s Business Model
   Data protection is embedded into Wafir’s business processes, including:

• Customer Onboarding: Ensuring secure collection and verification of customer information.
• Transaction Processing: Protecting financial and transactional data through encryption and secure
  storage.
• Product Development: Integrating privacy-by-design principles into all technological solutions.

1. Technological Enhancement
   Wafir employs advanced technologies to safeguard personal data:

• Encryption: Data is encrypted at rest and in transit using AES-256.
• Access Controls: Multi-factor authentication (MFA) and role-based access ensure restricted data access.
• Monitoring Tools: Real-time monitoring detects and mitigates security threats.

1. Continuous Improvements
   Wafir regularly reviews and updates its data protection policies and practices to:

• Incorporate changes in regulations and technologies.
• Address findings from internal and external audits.
• Enhance safeguards against emerging threats.

1. Governance
   Wafir’s governance framework ensures accountability at all levels:

• The Board oversees the effectiveness of data protection measures.
• The DPO ensures compliance with laws and regulations.
• Regular audits and reviews identify and address potential risks.

1. Staff Training and Communication
   Wafir provides regular training programs to:

• Educate employees about data protection laws, policies, and procedures.
• Conduct scenario-based simulations to enhance incident response capabilities.
• Ensure employees understand their roles in maintaining data privacy.

1. Independent Audits
   Independent audits are conducted to:

• Validate compliance with regulatory requirements and internal policies.
• Identify areas for improvement in data protection practices.
• Ensure transparency and accountability in Wafir’s data management processes.

1. Ethical Commitment
   Wafir is committed to ethical data practices that prioritize user privacy and trust. By embedding ethical
   considerations into its operations, Wafir ensures that data protection remains a core value, supporting its
   mission to deliver secure, innovative, and user-centric financial services.