Skip to content 
PRIVACY POLICY
Corvista (“Corvista”, “the Company”, “we”, “us” or “our”) provides Civil, Construction, Excavation, Cleaning, and Information Technology (IT) services to clients across the State of Qatar and, where applicable, internationally.
We are committed to protecting the privacy and personal data of our clients, subcontractors, suppliers, employees, job applicants, website visitors, and all other individuals whose personal data we process (collectively, “you” or “data subjects”).
This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, store, and protect it, and what rights you have in relation to it. This Policy has been drafted to comply with the State of Qatar’s Personal Data Privacy Protection Law (Law No. 13 of 2016) (“PDPPL”) and, where relevant — such as when we deal with individuals located in the European Economic Area (EEA)/United Kingdom or process data on behalf of clients subject to EU law — the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). By using our website, engaging our services, submitting a job application, or otherwise interacting with Corvista, you acknowledge that you have read and understood this Privacy Policy.
1. Who We Are?
Corvista is the data controller responsible for your personal data described in this Policy (unless we are expressly acting as a data processor on behalf of a client, in which case the applicable service agreement will govern).
Registered office: Doha, State of Qatar.
Email: contact@corvista.qa
Phone: +974 7720 0898
For any privacy-related query, correction, complaint, or exercise of rights, you may contact our Data Protection point of contact using the details in Section 14 (Contact Us).
2. Scope of This Policy
This Policy applies to personal data we collect and process through:
- Our corporate website(s) and any online forms, quotation requests, or portals we operate;
- Our provision of civil engineering, construction, excavation, cleaning, and IT services to clients and site owners;
- Our procurement and subcontracting relationships with suppliers, vendors, and subcontractors;
- Recruitment, employment, and site-access processes for employees, workers, and site visitors;
- Any other lawful interaction where personal data is shared with us, whether in person, by phone, email, or in writing.
3. Key Definitions
“Personal Data” means any information relating to an identified or identifiable natural person, such as name, ID/passport number, contact details, photograph, location data, or online identifiers.
“Processing” means any operation performed on personal data, including collection, recording, storage, use, disclosure, or erasure.
“Data Subject” means the individual to whom the personal data relates.
“Controller” means the entity that determines the purposes and means of processing personal data (Corvista, in most cases).
“Processor” means an entity that processes personal data on behalf of the Controller (e.g. an IT hosting provider engaged by Corvista).
4. Personal Data We Collect
The categories of personal data we collect depend on your relationship with us and may include:
- Identification data: full name, national ID/QID or passport number, date of birth, nationality, photograph;
- Contact data: address, email, phone number, company name and role;
- Employment and site-access data: job title, employer/subcontractor, work permits, site induction records, attendance and access-control logs, CCTV footage at project sites and offices;
- Recruitment data: CV/resume, qualifications, references, interview notes, right-to-work documentation;
- Client and contract data: project specifications, billing and payment details, correspondence, signatures on contracts and site documents;
- Technical and IT service data: device information, login credentials, network/system logs, IP address, and diagnostic data collected in the course of providing IT support and managed services;
- Website usage data: IP address, browser type, pages visited, and cookie identifiers (see Section 10);
- Health and safety data: where legally required for site safety (e.g. fitness-to-work confirmations, incident reports), treated as sensitive data with additional safeguards.
5. How We Use Your Personal Data (Purposes)
We process personal data for the following purposes:
- To prepare quotations, negotiate, and perform civil, construction, excavation, cleaning, and IT service contracts;
- To manage subcontractor and supplier relationships, including onboarding, invoicing, and compliance checks;
- To manage recruitment, employment, payroll, and workforce administration;
- To maintain site safety, security, and access control, including CCTV monitoring at project sites and offices;
- To provide, maintain, and support IT systems and services delivered to clients;
- To comply with legal, regulatory, tax, labour, and health & safety obligations in Qatar;
- To respond to enquiries submitted via our website, email, or phone;
- To improve our services, website functionality, and internal business operations;
- To protect the rights, property, or safety of Corvista, our employees, clients, and the public.
6. Legal Basis for Processing
Where the PDPPL applies, we process personal data on the basis of your consent, the necessity of processing for performance of a contract to which you are a party, or compliance with a legal obligation under Qatari law.
- Where the GDPR applies (for example, where we deal with individuals in the EEA/UK, or process data for a client subject to EU law), our legal bases include:
Performance of a contract with you or steps taken at your request prior to entering a contract (Art. 6(1)(b) GDPR); - Compliance with a legal obligation (Art. 6(1)(c) GDPR);
- Our legitimate interests, such as business administration, IT security, and fraud prevention, provided these are not overridden by your interests or fundamental rights (Art. 6(1)(f) GDPR);
- Your explicit consent, where required — for example, for certain marketing communications or processing of sensitive categories of data (Art. 6(1)(a) and Art. 9 GDPR).
7. Sharing and Disclosure of Personal Data
We do not sell your personal data. We may share personal data, on a need-to-know basis and under appropriate confidentiality and data protection obligations, with:
- Group companies, affiliates, and joint-venture partners involved in delivering a project;
- Subcontractors, suppliers, and consultants engaged to perform part of the works or services;
- IT infrastructure, hosting, cloud, and software providers that support our systems;
- Professional advisers, auditors, insurers, and banks;
- Government ministries, regulators, law enforcement, and courts in Qatar (or elsewhere), where required by law or to protect vital interests;
- A buyer or successor entity in the event of a merger, acquisition, or restructuring of Corvista’s business.
- Any third party processing personal data on our behalf is bound by written data protection and confidentiality obligations consistent with this Policy.
8. International Data Transfers
As Corvista may work with international clients, subcontractors, and cloud-based IT service providers, personal data may occasionally be transferred outside Qatar, including to the EEA/UK or other jurisdictions.
Where such a transfer takes place, we take reasonable steps to ensure an adequate level of protection, which may include contractual safeguards such as Standard Contractual Clauses (where GDPR applies), confirmation of an adequacy decision, or your explicit consent, together with appropriate technical and organizational security measures.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including satisfying any legal, accounting, tax, contractual, or reporting requirements under Qatari law (and, where applicable, the statutory limitation periods under EU/member state law).
Project, contract, and financial records are typically retained for the duration of the contractual relationship plus the period required by applicable statutes of limitation. Recruitment data of unsuccessful candidates is generally retained for a limited period to support future opportunities, unless you request earlier deletion. CCTV footage is retained only for a limited operational period unless required for an investigation or legal claim.
10. Cookies and Similar Technologies
Our website may use cookies and similar technologies to ensure proper functioning, remember your preferences, and understand how visitors use our site.
- Strictly necessary cookies: required for core website functionality; these cannot be disabled.
- Performance/analytics cookies: help us understand site usage so we can improve content and navigation.
- Functionality cookies: remember choices you make (e.g. language) to provide a more personalized experience.
You can control or delete cookies through your browser settings at any time. Disabling certain cookies may affect the functionality of our website.
11. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction, including access controls, encryption where appropriate, secure IT systems, staff confidentiality obligations, and physical security at our offices and project sites.
While we take data security seriously, no method of transmission or storage is completely secure.
We continually review and update our safeguards in line with evolving best practice and regulatory expectations.
12. Your Privacy Rights
Subject to applicable law (PDPPL and/or GDPR, as relevant to your circumstances), you may have the right to:
- Be informed about how your personal data is processed;
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request erasure of your personal data, subject to legal and contractual retention requirements;
- Restrict or object to certain processing, including for direct marketing;
- Request data portability, where technically feasible;
- Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
- Lodge a complaint with the competent supervisory authority (see Section 15).
To exercise any of these rights, please contact us using the details in Section 14. We aim to respond within one (1) month of receiving a verified request; this may be extended where requests are complex, in which case we will inform you of the reason and expected timeframe.
13. Changes to This Privacy Policy
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
Corvista — Doha, State of Qatar
Email: contact@corvista.qa
Phone: +974 7720 0898
