About the Policy

1. The Supreme Committee for Delivery & Legacy (SC) is committed to protecting and respecting your privacy. SC was established in the State of Qatar by Emiri Decree No. (27) of 2011 as amended by Emiri Decree No. (3) of 2014 and its principal place of business is at Al Bidda Tower, P.O. Box 62022, Doha, State of Qatar. 
2. SC has previously operated the Hayya programme (Hayya) in connection with international sporting events in Qatar and processed personal information it collected in accordance with its previous privacy policy. The Hayya programme has been extended by the State of Qatar so that participants can continue to use the Hayya ID, App and Portal to attend other events and to enter Qatar, or host individuals entering Qatar for this purpose. If you use such services SC will process your personal information in accordance with this Privacy Policy.
3. This Privacy Policy sets out the basis on which we  process any personal information that we collect about you, including when you visit our Hayya Platforms or otherwise interact with us in relation to Hayya, or use our services and attend any Events we, and our partners, may be involved organising or promoting. “Hayya Platforms”, and other terms are defined in Annex A.
4. We may provide further privacy notices to you at the point we collect your personal information, which will highlight any further information relating to our use of that personal information and, where applicable, provide you with the ability to opt in or out of selected uses. If you are a volunteer, a separate privacy notice will apply to you, and these can be found on the specific website for your programme.

The information that we collect about you

1. We may collect and/or process information about you when you engage with us, in particular, when you use our App ( Annex B); or Hayya Portal ( Annex C). Details of the personal information we process, the purposes for which we do so, and the third parties we share data with, are in these annexes.
2. When you visit our Hayya Platforms, we may collect and/or process the following categories of information about you:
   1. Information that you provide to us ► This includes information you provide when filling out application, registration or contact forms on our Hayya Platforms, including to host family or friends. 
   2. Platform and communication usage ► Information that our Hayya Platforms collect about you, including details of your visits to the Hayya Platforms, your internet protocol (IP) address, domain name, browser version and operating system, traffic data, weblogs and other communication data, and the resources that you access. The Hayya Platforms may also download cookies to your device, as described in our separate Cookie Policy .
   3. Our correspondence ► If you contact us, we may keep a record of that correspondence.
   4. Your feedback ► Information which you provide to us from time to time by completing surveys or polls, and which we use to help us improve our offerings.
3. We may also receive information about you from third parties who are legally entitled to disclose that information. If you wish to know more about how these third parties handle your personal information, please contact them directly.
4. In general, we will not ask you to provide us with personal information about third parties. However, in the event that you voluntarily provide us with such information (e.g., when submitting details of your companions/ family members and dependents), you confirm that you have obtained the consent of all relevant third parties to provide us with that information.
5. We do not collect personal information from persons under the age of 18 (Minors) without their legal guardian’s consent. We take specific steps to protect the privacy of Minors who disclose their personal identifying information to us and we shall take all reasonable steps required of us to protect the rights of Minors and their privacy under applicable laws and regulations, including the laws of the State of Qatar.

What we do with your information? 

1. In this section, we set out the purposes for which we use personal information described in this Privacy Policy, and the “legal grounds” on which we rely to process your personal information for that purpose:
   1. To communicate effectively with you and conduct our operations ► To ensure that our Hayya Platforms function well, and all Events that we may be involved in organising, run smoothly; to register and manage your accounts on the Hayya Platforms; to respond to your queries; to communicate and develop our relationship with you; and to carry out our obligations arising from any arrangements between you and us.
      Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services to you)
   2. To provide you with marketing materials ► To provide you with updates and offers, where you have chosen to receive these.  We may use your information for marketing our own and our selected business partners’ products, services, events and opportunities to you by post, email, SMS, phone, in-app marketing, and through social media channels. Where required by law, we will ask for your consent at the time we collect your data to conduct any of these types of marketing. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt out by contacting us as set out in the “Marketing” section below.
      Lawful bases: consent, legitimate interests (to keep you updated with news in relation to our products, services, events and opportunities)
   3. For research and development purposes ► To analyse your personal information and use of our Hayya Platforms in order to better understand your and other visitors’ preferences and requirements, so as to better develop and organise our products, services and Events.
      Lawful bases: legitimate interests (to allow us to improve our products, services and events)
   4. To inform you of changes ► To notify you about changes to our products, services and events.
      Lawful bases: legitimate interests (to notify you about changes to our products, services and Events)
   5. To ensure Platform content is relevant ► To provide you with a personalised browsing experience when using the Hayya Platforms, including by ensuring that content from our Hayya Platforms is presented in the most effective manner for you and for your device. This may include passing your data to business partners, suppliers and/or service providers. 
      Lawful bases: legitimate interests (to allow us to provide you with relevant content and services on the Hayya Platforms)
   6. To re-organise or make changes to our business ► In the event that we undergo a re-organisation, we may need to transfer some or all of your personal data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analysing any proposed re-organisation. We may also need to transfer your personal data to that re-organised entity or third party after the reorganisation for them to use for the same purposes as set out in this policy.
      Lawful bases: legitimate interests (in order to allow us to change our business)
   7. In connection with legal or regulatory obligations ► We may process your personal information to comply with our regulatory requirements, to dialogue with regulators, or to bring and defend claims, as applicable. This may include disclosing your personal information to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so. 
      Lawful bases: legal obligations, legal claims, legitimate interests (to cooperate with law enforcement and regulatory authorities)
   8. To ensure the safety and security of our operations, premises and events ► To keep attendees of any events  safe and secure, including by investigating, preventing or taking action in relation to actual or suspected illegal activities, fraud, emergency situations involving potential threats to the physical safety of any persons or violations to our internal policies or terms of use; or to prevent the spread of viruses or infectious diseases.
      Lawful bases: legal obligations, legitimate interests (to prevent fraud and ensure physical, IT and network safety and security)

Sharing with third parties

1. We may share your personal information with third parties and affiliates for the purposes we explain in this Privacy Policy. These third parties include those listed below but may include other entities provided we are sharing for the purposes explained in this Privacy Policy:
1. our service providers, such as those which host the Hayya Platforms or other information technology systems, or who otherwise hold or process your personal information on our behalf;
2. contractors, agents, or advisors (e.g.  legal, financial, business or other advisors) that perform activities on our behalf;
3. government agencies, including the Ministry of Public Health, Ministry of Interior and the Ministry of Communications and Information Technology, so that they may carry out any checks required to ensure the safety and security of  the Events;
4. to carefully selected organisers of events in Qatar;
5. to banks and payment service providers, who process your payment of any visa fees as part of your application for a Hayya ID. We do not receive or store your payment details, and any queries relating to payments should be directed to the relevant bank/ payment service provider. We will only provide your details where necessary in order to process a refund; and
6. any organisation which takes over our operations, or relevant parts of them. 
2. In exceptional circumstances, we may be under a duty to disclose or share your personal information in order to comply with any legal obligation (including responding to requests from law enforcement authorities either within or outside of the State of Qatar) or in order to enforce or apply our Terms of Use, or the terms of other agreements that we are party to; or to protect our rights, property, or safety, or that of our partners, or other relevant third parties and affiliates. This includes exchanging information with other organisations for the purposes of fraud protection.
3. The Hayya Platforms may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal information.  Please check these policies before you submit any personal information to such third party websites.

Marketing

1. As mentioned, we may use your data, or permit selected third parties or affiliates to use your data, to provide you with information about goods and services which may be of interest to you and we or they may contact you about these by post, email, SMS, phone, in-app marketing or through social media channels, provided that you give us consent for this (where consent is required by law). 
2. If, at any time after you have given us consent to do so, you no longer want us to use your data in this way, or to pass your details on to third parties or affiliates for marketing purposes, please  get in touch with us using the details in the “Contacting us” section below.

Profiling and automated decision making

1. The advertisements and recommendations which we show you on our Hayya Platforms are chosen by analysing the personal information you provide to us, including information provided in your Hayya application, information you have provided about your preferences, your attendance at Events, the way in which you interact with our Hayya Platforms, and previous advertisements which you have clicked on. To choose advertisements which are tailored and most likely to be of interest to you, we compile and analyse information received from all our users to gain a better understanding of your preferences from users similar to you. 

Storage and security

1. All information you provide to us is stored on our subcontractors’ secure servers and accessed and used subject to our security policies and standards. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Hayya Platforms, you are responsible for keeping this password confidential and for complying with any other security procedures that we notify you of. We ask you not to share a password with anyone. 
2. No data transmission over the Internet or website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal information in accordance with data protection legislative requirements.

International transfer of your information

1. Your personal information may be transferred to and/or stored in Qatar, or at another destination located outside of your country. Such data may also be processed by persons operating overseas who work for us, or by our affiliates or one of our third party service providers.
2. This may include transfers to countries whose privacy laws may be of a lower standard than those in your country. In those cases, we will ensure that our arrangements with our service providers or other third parties are governed by appropriate safeguards or agreements. Where we are required by law to do so we will provide a copy of such safeguards.

Retention and deletion of your information

1. Our retention periods for personal information are based on business needs and legal requirements. We retain personal information for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. For example, we may retain a copy of your Hayya application form and correspondence even if you are not granted a Hayya ID, until the time limit for claims arising from your application has expired, or to comply with regulatory requirements regarding the retention of such data. When personal information is no longer needed, we either irreversibly anonymise the information (and we may further retain and use the anonymised information) or securely destroy the information.

Your rights

1. Where processing of your personal information is based on your consent, you have the right to withdraw it at any time. Please note that the withdrawal of your consent will not affect the lawfulness of processing based on your consent as carried out before such withdrawal. 
2. We will use reasonable endeavours to ensure that your personal information is accurate.  In order to assist us with this, you should notify us of any changes to the personal information that you have provided to us by contacting us as set out in the “Contacting Us” section below.
3. Under certain conditions, you may have the right to require us to: 
1. provide you with a copy of information that you have provided to us;
2. update any inaccuracies in the personal information we hold (please see paragraph 10.2 above);
3. delete any personal information we no longer have a lawful ground to use;
4. where processing is based on consent, to withdraw your consent so that we stop that particular processing (see paragraph 5 above in relation to marketing);
5. to ask us to transmit the personal information you have provided to us and we still hold about you to a third party electronically;
6. object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and
7. restrict how we use your information whilst a complaint is being investigated.
4. Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g.  the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege).  If you exercise any of these rights, please contact us (details in the “Contacting Us” section below). We will check your entitlement and respond in most cases within a month. 
5. You can also lodge a complaint about our processing of your personal information with the appropriate data protection authority in Qatar if you consider that the processing of your personal information infringes applicable law. In Qatar this is the competent department at the National Cyber Security Agency. In the UK it is the Information Commissioner’s Office, and a list of supervisory authorities in the EU can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en 

Changes to this policy

1. Any changes we make to this Privacy Policy in the future will be posted to the Hayya Platform(s) and are also available if you contact us. Please check back frequently to see any changes. If we change this Privacy Policy or our Cookies Policy, we will update the date it was last changed below.  If these changes are material, we will indicate this clearly on our Hayya Platform(s).

Contacting us

1. If you have any questions in relation to this policy, please email 
   1. For general enquiries relating to the Hayya programme: info@hayya.qa 
   2. To change your preferences or withdraw your consent to marketing: Privacy@hayya.qa  

ANNEX A

Definitions

1. In this Privacy Policy, the following words shall have the following meanings:
1. App means the Hayya mobile application which is available at the App Store with the name Hayya to Qatar.
2. Events means events SC is involved in organising or promoting. 
3. Hayya ID means the digital identity  issued to you upon approval of your application for a Hayya ID.
4. Hayya Portal means the website through which applications for a Hayya ID can be submitted, and which is hosted at https://www.Hayya.qa
5. Hayya Platform means the App and  the Hayya Portal and any other platforms which SC may offer from time to time for the purposes of Hayya; and Platforms means two or more of these platforms (as the context requires).

ANNEX B

App

1. Additional information that we collect about you
   When you register for an account to use the App, we may collect:
1. Basic information about yourself, such as your name, date of birth, address, email address, telephone or mobile number;
2. Information about your preferences, such as tourist attractions you might like to visit whilst you are in Qatar;
3. Location data, if you have enabled location tracking within the App; 
4. Sensitive personal information, for example, information relating to your needs at any Events (e.g. requests for disabled access), should you choose to provide us with that information; and
5. Details of your travel journeys made using your Hayya ID (e.g. mode of transport and time of journey)
   We may collect this information both by way of you providing it to us (for example, through forms and questionnaires on the App), or through your browsing history on the App.
2. Additional purposes of use
1. To provide you with updates and recommendations ► To provide you with information about recommended travel routes (e.g. based on traffic and crowding), and other information relevant to your stay in Qatar and attendance at the Event(s). Separately, we may provide you with marketing materials where you have chosen to receive these (see the section titled “What we do with your information?” in the main Privacy Policy).
   Lawful bases: consent, legitimate interests (to keep you updated with news in relation to Qatar and Events in Qatar)
2. To verify your identity and access rights ► When you scan or present your Hayya ID,  we will use that data to confirm that you have a valid access to the Event in question , or to access public transport. 
   Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services to you) 
3. For crowd control and tournament management purposes ► We may combine location data from your Hayya ID data with that of other visitors to identify areas which are at risk of overcrowding, and release announcements recommending that visitors avoid those areas or use alternative routes.
   Lawful bases: legitimate interests (to ensure the safety and security of attendees at the Events)      

ANNEX C

Hayya Portal

1. Additional information that we collect about you
   When you use the Hayya Portal to apply for a Hayya ID, we may ask you to provide:
1. Basic information about yourself, such as your name, date of birth, address, email address, telephone or mobile number;
2. Details about your nationality, passport and Qatar Identity Document (e.g., passport number, expiry date);
3. Details of any ticket(s) you may have an Event;
4. Sensitive personal information, for example, information about whether you have any symptoms of an infectious disease, particularly where there is an ongoing epidemic or pandemic. We may also collect biometric information in your passport as needed to apply for an entry visa on your behalf. If you provide us with information relating to your needs at any Events (e.g., requests for disabled access), we will also keep a record of that information.
   
   We may also receive information about you from the following third parties:
   
   
1. Immigration information ► The Qatar Ministry of Interior (http://www.moi.gov.qa) may send us information that may inform our decision on whether to accept or reject your application for a Hayya ID; and
2. Ticket information ►  our partners and appointed ticketing agencies may share with us information about the ticket(s) which you have purchased to the Events, including ticket number and information about you as the purchaser of the ticket.
2. Additional purposes of use
1. To consider your application for a Hayya ID ► To carry out all necessary checks regarding your application; to liaise with relevant government agencies to obtain approval for your visit to Qatar; to issue and deliver your Hayya ID.
   Lawful bases: contract performance, legitimate interests (to enable us to consider your application and provide our services to you)