SkyStruct QSTP-LLC is based in Doha, Qatar. Our primary local framework for in-scope personal-data processing is Qatar's Law No. 13 of 2016 concerning Personal Data Privacy Protection and applicable implementing requirements. We also address other data-protection laws where they apply to a particular service or processing activity. This page explains that approach; it is not a certification of compliance for every customer, deployment or jurisdiction.
1. Qatar first; other laws where applicable
Qatar's data-protection requirements apply to relevant electronic processing and related records. Our commitments include limiting processing to lawful purposes, protecting information appropriately, supporting individual rights and documenting the responsibilities of customers and service providers. Sector-specific requirements, contractual confidentiality duties and restrictions attached to particular data may add further obligations.
There is no single data-protection regime covering the whole Middle East. A project involving customers or individuals in another country may require additional assessment of that country's laws. Before restricted or regulated information is placed in SkyStruct, the parties must identify the applicable requirements and agree a suitable processing arrangement. Buying the software does not, by itself, make a customer's operations legally compliant.
2. When GDPR is relevant
The EU General Data Protection Regulation (GDPR) is not Qatar's domestic privacy law. It may apply where processing has the territorial connection described in GDPR Article 3, including relevant EU establishment activities or the offering of services to, or monitoring of, individuals in the EU. The nationality of an individual, on its own, does not determine applicability.
Where GDPR applies to SkyStruct's processing, we must meet the obligations applicable to our role. Where a customer is subject to GDPR and appoints SkyStruct as a processor, the DPA documents the required processing commitments and assistance. A customer's GDPR obligations do not automatically make every SkyStruct operation subject to GDPR. Any required EU representative, data-protection officer or transfer mechanism must be assessed for the actual processing; this page does not claim that such an appointment or instrument already exists.
3. Who determines how information is used
For project information uploaded and managed by a customer, the customer generally decides why it is processed and who may access it. SkyStruct normally processes that personal data on the customer's documented instructions as a processor. Where the customer itself acts for another controller, SkyStruct may be a subprocessor, subject to the necessary authority.
SkyStruct may separately act as a controller for its own customer-contact, billing, account-administration and enquiry records. Those activities are explained in our Privacy Policy and relevant collection notices. Roles are determined by the actual activity, not merely by the title of a contract. An external consultant or project participant may have its own responsibilities for information it supplies or receives.
4. Lawful purposes, consent and transparency
Personal data must have a defined, lawful purpose and be limited to what is needed. Under Qatar's law, the applicable basis includes consent unless processing is necessary for a lawful purpose as provided by that law. Where GDPR applies, a valid GDPR basis must be identified for the activity. These legal tests are not interchangeable.
Customers are responsible for providing appropriate notices and obtaining any consent, authority or regulatory permission needed for the instructions they give us. SkyStruct is responsible for its own processing duties and notices. Acceptance of the Terms is not blanket consent to all uses of personal information. Optional marketing must follow applicable consent and opt-out requirements, independently of essential service communications.
5. Special-nature and higher-risk information
Qatar's law gives additional protection to personal data concerning ethnic origin, children, health, physical or psychological condition, religious beliefs, marital relations and criminal offences, and requires permission from the competent department for processing personal data of a special nature. Other applicable laws may define protected categories differently.
Our standard service is not an unrestricted repository for these categories. Customers must not include them without prior written agreement, the necessary permissions and suitable controls. This is particularly important for injury reports, workforce health records, identity documents and photographs that reveal sensitive circumstances. Only the minimum necessary information should be included. Additional assessments and safeguards may be required for systematic monitoring or other high-risk uses.
6. Individual rights and requests
Depending on the applicable law and circumstances, individuals may request information about processing, access to their personal data, correction, withdrawal of consent, objection or deletion. GDPR may additionally provide rights such as restriction and portability, and protections concerning certain solely automated decisions. These rights are subject to their legal conditions; they do not automatically require deletion of information that must lawfully be retained.
Send a request to info@skystruct.com with the subject “Data protection request”. State the information or account concerned and the request being made. We may ask for proportionate identity or authority verification and will explain the outcome or any lawful restriction within the applicable period. Do not send a complete identity document unless specifically requested through an appropriate secure process.
For data held in a customer-controlled workspace, the customer should normally handle the decision and response. We will direct or forward the request appropriately and provide the assistance required by the DPA. A person need not identify the correct legal role before raising a concern with us.
7. Processing locations and international access
The agreed processing schedule must cover production hosting, backups, logs, subprocessors and remote access. Hosting location and support location are different issues. Qatar's general privacy law should not be read as an automatic rule that all personal data must remain in Qatar; contractual, sectoral and other legal restrictions may nevertheless require a particular location or prohibit a transfer.
Where data is transferred or accessed internationally, the parties must establish that it is lawful and that required safeguards are in place. For transfers restricted by GDPR, an appropriate lawful transfer mechanism must be implemented where required; this may include properly completed standard contractual clauses and supplementary measures. Publishing a DPA, selecting a Qatar server or accepting general website terms does not, alone, satisfy all transfer requirements.
8. Security, incidents and retention
Security controls must reflect the nature of the information and the risks to individuals. The DPA contains the contractual measures and responsibilities. Where SkyStruct acts as a processor, it must notify the customer immediately on awareness of a relevant breach of safeguards or risk threatening personal data under the applicable Qatar requirements, and without undue delay under applicable GDPR requirements. The first notification need not await a completed investigation.
The party responsible for a notification to affected individuals or an authority must assess the relevant legal trigger and deadline and act accordingly. SkyStruct will cooperate within its responsibilities. Different regimes have different notification requirements; a GDPR deadline must not be treated as a universal waiting period.
Personal data is retained for the permitted purpose and applicable legal or contractual period. Customer project data is returned or deleted under the DPA and the agreed exit schedule. Independent business records are handled under the Privacy Policy and applicable retention duties. Backups, legal holds and archived projects are not interchangeable retention categories.
9. Accountability and complaints
A customer can request the DPA and information relevant to its assessment of the proposed service. We may require confidentiality protections for sensitive technical material, but these must not obstruct mandatory rights or lawful regulatory access. We do not represent that a cloud provider's certification automatically certifies SkyStruct or that a website statement constitutes regulatory approval.
Raise a concern with info@skystruct.com, addressed to “Data Protection”. You may also complain to the competent authority, including Qatar's National Cyber Security Agency through its personal-data-privacy function where it has jurisdiction, or a competent European supervisory authority where GDPR applies. Contacting SkyStruct first is not a condition of exercising a statutory complaint right.
This page should be read alongside the Privacy Policy, Security page and DPA. It explains the legal framework and allocation of responsibility; the applicable law and the actual processing arrangements determine the obligations in each case.
Questions about this document?
Email info@skystruct.com and include the document name in the subject.
