Privacy Policy

Who is responsible for your data

Q8ejar operates the Services and determines the purposes and means of processing described in this policy. For questions about your personal data, or to exercise any of the rights below, contact our data-protection point of contact at the address given at the end of this policy.

Where a landlord uses Q8ejar to manage their own tenants and properties, that landlord is an independent controller of the tenant data they enter, and Q8ejar acts as their processor for that data. Q8ejar is the controller for account, billing, security, and platform-operation data.

Personal data we collect

We collect only the data needed to operate a property-management and rent-collection service. The categories are listed below.

• Account & profileName, email address, phone numbers, company details, login credentials, and language preference.
• IdentityCivil ID number and identity documents where a landlord records them for a tenancy — stored encrypted at rest.
• Tenancy & propertyLease terms, unit and building details, deposits, charges, maintenance requests, and uploaded documents.
• Payment metadataAmounts, dates, method, and gateway reference for rent and subscription payments. We never store full card numbers — card data is held by the payment gateway.
• Device & notificationsIf you use the tenant app, a device token used to deliver push notifications, and basic app/device information.
• Messages & requestsThe content of tenant–landlord chat messages and maintenance requests you send through the Services.
• Usage & security logsTechnical logs such as IP address, actions taken, and timestamps, kept to secure the Services and audit sensitive access.

Why we use your data

We use personal data to: create and secure your account; operate leases, tenancies, and the document vault; generate and deliver rent invoices, receipts, and statements; process rent and subscription payments through a licensed payment gateway; send service messages, reminders, and notifications you have not opted out of; provide tenant–landlord messaging and maintenance requests; produce reports and statutory notices; detect and prevent fraud and abuse; and comply with Kuwaiti legal and regulatory obligations.

We do not sell personal data, and we do not use it for advertising profiling.

Our legal basis for processing

We process personal data on one or more of the following bases: your consent (which you may withdraw at any time); the performance of a contract with you (for example, operating your lease or collecting rent you owe); compliance with a legal obligation under Kuwaiti law; and our legitimate interest in operating, securing, and improving the Services, balanced against your rights.

How long we keep your data

We keep personal data for as long as your account is active and for a limited period afterwards, as needed to meet legal, accounting, tax, dispute-resolution, and audit obligations, after which it is deleted or anonymised. Financial and payment records are retained for the period required by applicable Kuwaiti law. The specific retention periods are advisory pending confirmation by counsel and are documented in our internal retention schedule.

Who we share data with

We share personal data only where necessary to run the Services: with your landlord or their authorised staff (for tenant data); with our payment gateway, Tahseeel, to process rent and subscription payments (Q8ejar never stores your full card details — these are handled by the gateway); with cloud-hosting and messaging providers that operate our infrastructure and, where enabled, deliver push notifications (Firebase Cloud Messaging); and with courts, regulators, or authorities where required by Kuwaiti law. We require our service providers to protect personal data and to use it only for the purposes we specify.

Transfers outside Kuwait

Some of the providers that support the Services — in particular push-notification delivery through Firebase Cloud Messaging — may process limited data (such as a device token) on servers located outside Kuwait, including in the United States. Where personal data is transferred outside Kuwait, we take steps intended to ensure an adequate level of protection consistent with the CITRA regulation, and we maintain records of such transfers. Push notifications are optional and are only enabled if you install the tenant app and permit them.

How we protect your data

We apply technical and organisational safeguards appropriate to the sensitivity of the data. Civil ID numbers are encrypted at rest, payment-gateway credentials are stored encrypted, access is restricted and permission-gated, connections are served over HTTPS, and administrative access to tenant accounts is audited. No system is perfectly secure, but we work to protect your data and to respond quickly if an incident occurs.

Your rights

Subject to Kuwaiti law, you have rights over your personal data, listed below. To exercise any of them, contact us using the details at the end of this policy; we will respond within the period required by the applicable regulation. You may also lodge a complaint with CITRA.

• Access — ask what personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your data where no legal obligation requires us to keep it.
• Restriction & objection — ask us to limit or stop certain processing.
• Withdraw consent — where processing relies on your consent, withdraw it at any time (this does not affect processing already carried out).
• Portability — ask for a copy of certain data in a usable format.
• Complain — raise a concern with us or with CITRA.

Data-breach notification

If a personal-data breach occurs that is likely to affect your rights, we are committed to notifying CITRA and, where required, the affected individuals without undue delay and within the timeframe required by the CITRA regulation. We maintain an internal breach-response procedure covering detection, containment, assessment, notification, and record-keeping.

Children

The Services are intended for adults entering into or managing tenancy relationships. We do not knowingly collect personal data directly from children. Where a tenant record concerns a minor, it is entered and controlled by the responsible landlord or guardian.

Changes to this policy

We may update this policy as the Services and the law evolve. The version and date at the top of this page identify the current text. Material changes will be communicated through the Services.