Privacy Policy

Effective date: 01/09/2026
Last updated: 19/09/2026

1. Who we are

This website, ahaiqtech.com, is operated by Al Haboor AIQ (also trading as AHAIQ Tech), the technology division of Al Haboor Trading Establishment, a commercial establishment registered in the Sultanate of Oman under Commercial Registration No. 5010357.

For the purposes of the Personal Data Protection Law issued by Royal Decree No. 6/2022 (the "PDPL") and its Executive Regulations issued under Ministerial Decision No. 34/2024, Al Haboor AIQ is the Controller of the personal data described in this Policy.

Registered office: Adam, Al Dakhiliyah Governorate, Sultanate of Oman
Muscat office: Adam, Al Dakhiliyah Governorate, Sultanate of Oman
Email: contact@ahaiqtech.com
Telephone / WhatsApp: +968 9593 0567 · +968 9012 0230

2. Scope of this Policy

This Policy explains how we collect, use, disclose, transfer, retain and protect personal data when you:

• visit or browse ahaiqtech.com;
• submit our contact or "Book an AI Readiness Review" form;
• complete the AI Readiness Assessment on this website;
• contact us by email, telephone or WhatsApp; or
• engage with us as a client, supplier, partner or prospective employee.

This Policy does not apply to third-party websites we may link to. It does not apply to personal data we process on behalf of a client under a services agreement — in that case the client is the Controller and we act as Processor. See §14.

3. Legal basis for processing

Under the PDPL, we process your personal data on the basis of your explicit, informed and freely given consent, obtained before collection. Where the PDPL permits processing without consent — including where processing is necessary to comply with a legal obligation, to perform a contract to which you are a party, or to protect vital interests — we rely on that basis and identify it on request.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide the service you requested.

4. Personal data we collect

a) Data you give us directly

Through our contact form, review-booking form and direct correspondence:

b) AI Readiness Assessment

The assessment asks four questions about your organisation's data, workflows, systems and AI ownership. The responses relate to your organisation, not to you personally. Where you submit your assessment result together with your contact details, we hold the two together and treat the combined record as personal data.

c) Technical data collected automatically

IP address, browser type and version, device type, operating system, language preference, pages viewed, time and duration of visit, and the referring website. This is collected through [ANALYTICS TOOL] and our hosting provider's server logs.

d) Data we do not collect

We do not knowingly collect, and ask that you do not send us, sensitive personal data — meaning data revealing genetic data, biometric data, health data, racial or ethnic origin, sexual life, political or religious opinions or beliefs, criminal convictions, or data relating to security measures. Under Article 5 of the PDPL, processing such data requires a prior permit from the Ministry of Transport, Communications and Information Technology. Where a client engagement requires us to process such data, we will do so only under a written agreement and only after the required permit has been obtained by the party legally responsible for obtaining it.

5. Why we use your personal data

We use personal data only for the purposes for which it was collected, namely to:

1. respond to your enquiry and arrange the technology or AI readiness review you requested;
2. prepare and deliver proposals, quotations, scopes of work and contracts;
3. deliver, support and maintain the services you engage us for;
4. manage our commercial relationship, including invoicing, collection and record-keeping;
5. send you information about our services where you have consented to receive it;
6. operate, secure, maintain and improve this website;
7. assess applications for employment or training programmes; and
8. comply with our obligations under Omani law, including commercial, tax, labour and regulatory requirements.

We do not sell personal data. We do not use your personal data to train artificial-intelligence models, and we do not submit personal data you send us into any AI system for that purpose.

6. Cookies and similar technologies

This website uses cookies and similar technologies to operate correctly, remember your language preference (Arabic or English), and understand how the site is used.

• Strictly necessary cookies — required for the site to function, including security and language selection. These operate without consent as they are essential to delivering the service you requested.
• Analytics cookies — set by [ANALYTICS TOOL] to measure traffic and page performance. These are set only after you consent through our cookie banner.

You may refuse or withdraw consent to non-essential cookies at any time through the cookie banner or your browser settings. Refusing analytics cookies does not affect your access to any part of this website.

7. Who we share personal data with

We disclose personal data only where necessary, and only to:

• Our technology delivery partners. Our engagement model uses a global technology delivery partner network to engineer and deliver client solutions. Where your data is needed for scoping or delivery, it is shared with the relevant partner under a written agreement imposing confidentiality and data-protection obligations no less protective than the PDPL.
• Service providers acting on our instructions — website hosting, email, customer-relationship management, communications and accounting providers.
• Professional advisers — legal, audit and accounting advisers, under duties of confidentiality.
• Competent Omani authorities, where disclosure is required by law, court order, or a lawful request from a regulatory or judicial body.

We do not disclose personal data to any other party for marketing purposes.

8. Transfers of personal data outside Oman

Some of our delivery partners, service providers and hosting infrastructure are located outside the Sultanate of Oman, including in India and other jurisdictions.

In accordance with the PDPL and Chapter VIII of the Executive Regulations, we transfer personal data outside Oman only where all of the following apply:

1. you have given your explicit consent to the transfer;
2. the transfer does not prejudice national security or the higher interests of the Sultanate of Oman;
3. we have assessed the level of protection provided by the recipient and satisfied ourselves that it is not less than the level required by the PDPL and its Executive Regulations; and
4. the recipient is bound by written contractual obligations of confidentiality, security, purpose limitation and onward-transfer control.

Where sensitive personal data would be transferred, we will additionally obtain any approval required from the Cyber Defence Centre before the transfer takes place.

If you do not consent to transfer outside Oman, tell us at [DPO EMAIL]. We will tell you whether we can still deliver the service you requested on an Oman-only basis.

9. Children's data

This website and our services are directed at organisations and are not intended for individuals under the age of 18. Where we deliver training programmes to schools or universities involving participants under 18, personal data is processed under a written agreement with the educational institution and in accordance with the specific protections for children's personal data set out in the Executive Regulations, including the consent of a parent or legal guardian where required.

10. How long we keep personal data

When a retention period ends, personal data is securely deleted or irreversibly anonymised.

11. How we protect personal data

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access control on a least-privilege basis, authentication controls on administrative accounts, audit logging, secured hosting, written confidentiality obligations for staff and partners, and periodic review of our security controls.

No system is entirely secure. Where a personal data breach occurs that may pose a risk to your rights, we will notify the Ministry of Transport, Communications and Information Technology within 72 hours of becoming aware of it, and will notify you directly within the same period where the breach is likely to cause you serious harm or high risk.

12. Your rights under the PDPL

As a data subject, you have the right to:

• be informed of the identity of the Controller, the purpose and nature of processing, and the source of your personal data;
• withdraw consent to processing at any time;
• obtain a copy of your personal data held by us, in a clear and readable format;
• request correction or updating of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request transfer (portability) of your personal data to another controller, where technically feasible;
• object to or request suspension of processing in the circumstances permitted by the PDPL; and
• be notified of any breach or violation affecting your personal data.

How to exercise a right. Send a written request to [DPO EMAIL] or the postal address in §1. We may ask for proof of identity before acting. We will respond within 45 days of receiving your written request. We may suspend the relevant processing while the request is being handled. If we refuse a request — which we may do only in the limited circumstances allowed by the PDPL — we will tell you the reasons in writing.

Exercising these rights is free of charge.

13. Data Protection Officer

We have appointed a Personal Data Protection Officer as required by the Executive Regulations. The DPO is the point of contact for you and for the regulator on all matters relating to your personal data.

Personal Data Protection Officer: [DPO NAME]
Email: [DPO EMAIL]
Address: Adam, Al Dakhiliyah Governorate, Sultanate of Oman

14. Where we act as Processor for a client

When we deliver AI, software, integration, IoT or managed services, we may process personal data held by our client — for example, their employees', customers' or patients' data. In those engagements:

• the client is the Controller and determines the purpose and means of processing;
• we act as Processor and process personal data only on the client's documented instructions;
• our obligations are set out in a written data-processing agreement covering confidentiality, security, sub-processor approval, cross-border transfer, breach notification, and return or deletion on termination; and
• if you are an individual whose data we process for a client, please direct your rights requests to that client. We will support them in responding.

15. Complaints

If you believe we have processed your personal data in breach of the PDPL, contact our DPO first at [DPO EMAIL] — we would prefer the chance to resolve it.

You also have the right to complain directly to the regulator:

Ministry of Transport, Communications and Information Technology
Personal Data Protection Department
Sultanate of Oman
mtcit.gov.om

16. Changes to this Policy

We may update this Policy. The "Last updated" date at the top will change, and where a change materially affects how we use your personal data we will notify you and, where the PDPL requires it, obtain fresh consent.

17. Governing law

This Policy is governed by the laws of the Sultanate of Oman, including the Personal Data Protection Law issued by Royal Decree No. 6/2022 and its Executive Regulations issued under Ministerial Decision No. 34/2024. The courts of the Sultanate of Oman have exclusive jurisdiction over any dispute arising from it.

In the event of any inconsistency between the Arabic and English versions of this Policy, the Arabic version prevails.