Privacy Notice

1. Who is responsible

MAS - Mashael Al Sulaiti Legal Advocacy & Arbitration operates the System and decides how personal data in it is used. Questions, requests and complaints go to the MAS ERP Administrator.

2. What the System holds

For clients: name in English and Arabic, Qatar ID or passport details, email, telephone numbers, address, the matters the Firm handles for you, documents you or the Firm upload, quotations, invoices, payment records and payment evidence, appointments and any feedback you submit. For Firm personnel: employment record, identity and visa documents, attendance, leave, payroll and performance records, training and certifications. For everyone: sign-in records, IP address, device and browser information, and an audit trail of what was viewed or changed.

3. Why the System holds it

To provide legal services and administer matters; to identify you and verify your identity at sign-in; to bill and to collect payment; to communicate with you about your matter; to run the Firm's human resources and payroll; to keep the accounting, audit and compliance records the Firm is required to keep; and to keep the System secure and detect misuse.

4. Emails the System sends

The System emails one-time passwords, quotations and invoices (with PDF copies attached), payment confirmations, appointment and hearing reminders, and internal notifications. Documents attached to these emails may contain confidential information about your matter - keep them secure and do not forward them to anyone who should not see them.

5. Who else sees it

Access inside the Firm is limited by role: staff see only what their role requires, and lawyers are not shown client financial detail. Data is shared outside the Firm only where necessary - with the Firm's hosting and email providers acting on the Firm's instructions, with banks and payment providers to process payments, with courts, opposing parties and government bodies where a matter requires it, and with auditors or regulators where the Firm is obliged to disclose. Personal data in the System is never sold, and it is not used for advertising.

6. Where it is kept

The System and its backups are hosted on cloud infrastructure, which may mean data is stored or processed outside Qatar. The Firm applies the same confidentiality and security requirements to that infrastructure as it does to its own premises.

7. How long it is kept

Matter files, financial records and their audit trails are retained for as long as the Firm is required to keep them under Qatari law and its professional obligations, and then disposed of securely. Sign-in and security logs are kept for a shorter period. Deleting a record in the System is normally a soft delete: it is hidden from day-to-day use but retained in the audit trail.

8. How it is protected

Access requires a one-time password sent to a registered address. Permissions are enforced per role and per module. Actions are logged. Traffic is encrypted in transit, sensitive fields are encrypted at rest, uploaded files are stored outside the public web root, and backups are taken regularly.

9. Your rights

You may ask what personal data the System holds about you, ask for it to be corrected if it is wrong, and ask about how long it is kept. Some data cannot be deleted on request where the Firm is legally required to retain it - for example accounting records and matter files. Contact the MAS ERP Administrator to make a request.

10. Changes to this notice

This notice may be updated. The date at the top shows when it was last changed.