Record of Processing Activities (ROPA)

1. Controller and Processor Information

Field	Details
Organization name	Halaqa (Nasser Al-Solaitti)
Commercial Registration	#332887
Address	Doha, Qatar
Data Protection Contact	[email protected]
Legal basis for processing	Contract performance (B2B subscribers) · Legitimate interests · Consent (where applicable)

2. Processing Activities Register

#	Processing Activity	Data Subjects	Personal Data Categories	Purpose	Legal Basis	Retention	Recipients
1	AI message processing & response generation	End customers of subscribers (patients, clients)	WhatsApp messages, phone number, name (if provided), language	Delivering AI receptionist: booking appointments, sending reminders, answering FAQs	Subscriber's legitimate interests + customer consent via WhatsApp opt-in	30–365 days (subscriber-configurable)	Meta (WhatsApp API), Telegram (escalation), cloud infrastructure (Qatar/region)
2	Appointment scheduling & calendar management	End customers of subscribers	Name, phone number, appointment date/time, service type, notes	Booking management, reminder delivery, waitlist management	Contract performance (booking confirmation)	Duration of booking + 30 days	Meta, Telegram, subscriber's calendar (if integrated)
3	Automated reminder delivery	End customers of subscribers	Phone number, appointment details, reminder status	Reduce no-shows via 24-hour WhatsApp reminders with confirm/reschedule actions	Legitimate interests (subscriber's operational efficiency)	90 days	Meta (WhatsApp API)
4	Subscriber account management	Halaqa subscribers (business owners)	Name, email, phone, business name, CR number, billing info, staff Telegram handles	Account provisioning, billing, support delivery	Contract performance	Account active + 12 months	Payment processor (Qatar bank/institution), cloud infrastructure
5	Lead capture (website forms)	Website visitors (prospective subscribers)	Name, email, phone, business type, message content	Sales follow-up, demo scheduling	Consent (form submission)	24 months or until consent withdrawn	OpenClaw/Telegram (for lead notifications to Halaqa team)
6	Support ticket handling	Halaqa subscribers	Contact details, conversation history with support team	Technical support, troubleshooting	Contract performance + legitimate interests	12 months	Support tools (internal)
7	Service improvement & analytics	End customers + subscribers	Anonymized/concatenated message patterns, timestamps, language, error rates	Product improvement, error monitoring, capacity planning	Legitimate interests (service quality)	24 months (aggregated)	Internal analytics (no personal data shared externally)
8	Security monitoring & fraud prevention	All data subjects	IP address, access timestamps, API call metadata	Detecting unauthorized access, abuse, service anomalies	Legitimate interests (security)	90 days	Cloud infrastructure provider security logs

3. Data Transfers

Personal data is primarily processed and stored on servers located in Qatar and/or the wider GCC region. Where data is processed using cloud infrastructure located outside Qatar, appropriate safeguards are in place per PDPL Article 9 requirements.

Data may be shared with Meta (WhatsApp Business API, US/Ireland servers) as required for message delivery. Meta's Data Processing Addendum applies.

4. Security Measures

Encryption at rest: AES-256 on all stored personal data
Encryption in transit: TLS 1.2+ on all connections
Access controls: Role-based access, MFA required for staff access to production systems
Key management: Secrets stored in Vault (encrypted at rest), never in code or logs
Penetration testing: Annual third-party security review
Incident response: Documented PDPL-compliant breach notification procedure (72-hour authority notification per Article 16)

5. Data Subject Rights

Data subjects (both subscribers and end customers) can exercise the following rights by contacting [email protected]:

Right	How to exercise	Response time
Access (copy of data)	Email with subject "PDPL Access Request"	30 days
Correction	Email with subject "PDPL Correction Request"	30 days
Deletion ("right to be forgotten")	Email with subject "PDPL Deletion Request"	30 days (subject to legal retention)
Objection to processing	Email with subject "PDPL Objection"	30 days
Data portability	Email with subject "PDPL Portability Request"	30 days (JSON/CSV format)

    Note: End customers (patients, clients of subscribers) should submit rights requests to the subscriber business directly. We will assist subscribers in fulfilling such requests where technically feasible.
  

6. Special Categories (Article 6 PDPL)

Halaqa processes health-related data (appointment bookings for medical/dental clinics) as part of its core service. Such data is:

Processed only on documented instructions from the subscriber (who acts as data controller)
Not used for any purpose other than delivering the AI receptionist service
Stored encrypted at all times
Retained only for the subscriber-configured period
Not shared with third parties except as required for message delivery (Meta) or urgent escalation (Telegram)

The subscriber represents and warrants that they have obtained appropriate consent or other legal basis for processing such data through Halaqa.

7. Changes to This ROPA

This ROPA is reviewed and updated at least annually or when processing activities change materially. Current version: 1.0, June 2026.