Privacy Policy
This page describes the data QID Secure processes as part of visitor management. It is a template for your own deployment and should be reviewed and adapted by your organisation before production.
What we collect
- Identity data from the Qatar ID or passport, including name, nationality, ID number and document images.
- Visit data: purpose, host, arrival and exit times, gate and operator.
- Contact data: the visitor's phone number, where SMS is enabled.
- Audit data: who made each decision, from which device, and when.
Why we collect it
To register and verify visitors, to decide whether entry is approved, to produce a pass, to record entry and exit, and to maintain an auditable security record. SMS, where enabled, is used to deliver a profile link and pass reference.
How long we keep it
Retention is configurable. The default is 30 days for ID images, 2 years for visitor records and 2 years for audit events, after which data is purged or anonymised with a tombstone event. Your deployment may use different windows.
Who can see it
Access is role-based. Operators and hosts see masked ID numbers; supervisors and administrators see identity images and full values where required. Auditors have read-only access to the audit trail.
Sharing
Data is not sold or shared with third parties for marketing. If a cloud OCR provider is configured, document images are sent to that provider for extraction; an air-gapped deployment uses local OCR only. SMS is sent through the configured provider.
Your rights
Visitors may request access, correction or erasure of their data. The admin privacy endpoint erases a profile's documents, images and SMS rows, anonymises PII and retains metadata with a non-PII audit event. Contact your site administrator to exercise these rights.
Changes
This notice may be updated as the platform evolves. The version in force is the one published on this page at the time of processing.