Data Protection Policy

Purpose

Marvel Technology and Information Systems WLL, operator of Doorstone (Marvel, Doorstone, we, us or our), is committed to protecting personal data across the Doorstone website, mobile application, web dashboard, support operations and corporate activities.

This Policy states the governance and minimum controls we apply throughout the data lifecycle. It supports compliance with Bahrain's Law No. 30 of 2018 Promulgating the Personal Data Protection Law (PDPL) and its executive orders. It is supplemented by the Doorstone Privacy Policy, customer and vendor data-processing agreements, security standards, retention schedule, incident-response plan and internal procedures.

1. Scope

This Policy applies to:

• all Marvel directors, officers, employees, temporary workers and contractors;
• all personal data for which Marvel is a data controller;
• all personal data processed by Marvel for a Community Customer;
• all environments, devices, databases, backups, logs and paper records used for Doorstone; and
• all vendors and subprocessors with access to personal data.

A Community Customer is an owners association, developer, property manager or other subscribing organisation responsible for a property or community. A data subject is an identifiable individual, including a resident, owner, tenant, family member, authorised representative, visitor, prospect, staff member or supplier contact.

2. Accountability and legal roles

2.1 Marvel as controller

Marvel is a data controller for purposes it determines, including Doorstone account administration, platform security, direct support, website enquiries, cookie choices, optional marketing, product administration and its own legal/business records.

2.2 Marvel as processor

A Community Customer is normally the controller of community records, including resident/unit relationships, identity verification required for access, service requests, notices, documents, invoices, violations, visitor/access records and owners-association governance. Marvel processes those records only on documented instructions and under a written data-processing agreement.

Marvel will notify the Community Customer if an instruction appears to violate applicable data-protection law and may suspend the affected processing while the issue is resolved. Marvel will not sell, independently advertise against or otherwise reuse identifiable Community Customer data for its own unrelated purposes.

2.3 Responsibility

• Management approves this Policy, provides adequate resources and accepts residual high risks.
• Privacy lead maintains the processing register, advice, rights-request process, DPIAs, transfer and vendor records, incident privacy assessment and regulatory coordination. Appointment of a statutory Data Protection Guardian will be notified where required.
• Security and engineering leads implement privacy by design, secure development, access control, logging, testing, resilience and deletion.
• Product owners document the purpose, fields, legal basis, notices, roles, recipients, retention and user controls before a feature is approved.
• Customer/support teams follow verified identity, minimum-access and escalation procedures.
• All personnel protect confidentiality, use data only for authorised work and report incidents immediately. Confidentiality continues after employment or engagement ends.

3. Data-protection principles

Doorstone applies the following principles:

• Lawfulness and fairness: every activity must have a documented legal basis and must not use data in an unexpected or unjustifiably harmful way.
• Purpose limitation: personal data is collected for specific, explicit and legitimate purposes and is not reused incompatibly.
• Data minimisation: each field, attachment and permission must be necessary and proportionate.
• Accuracy: reasonable processes allow users and authorised Community Customers to correct records.
• Storage limitation: each record category has a documented period and deletion/anonymisation action.
• Security and confidentiality: safeguards reflect data sensitivity, volume, context, available technology and potential harm.
• Transparency and choice: notices are concise, accessible and delivered when data is collected or first recorded.
• Accountability: decisions, assessments, contracts, consent, access and incidents are documented so compliance can be demonstrated.

4. Lawful processing and consent

Before collection begins, the responsible owner must document the purpose, controller, data categories, individuals, legal basis, mandatory/optional status, recipients, transfer mechanism and retention period.

Depending on the purpose, processing may rely on explicit consent, contract or pre-contract steps, legal obligation, recognised legal proceedings, vital interests or a legitimate interest that does not override individual rights.

Consent must be:

• an affirmative, written or electronic action;
• specific to a clear purpose;
• informed, unambiguous and recorded;
• freely given, without making an optional use a condition of an unrelated service; and
• as easy to withdraw as to give, without fee or liability.

Terms acceptance, operational communications and marketing consent are separate choices. Non-essential cookies, SDKs and third-party embeds are not loaded before valid consent. A person who rejects them can continue to use unrelated content and core functions.

Sensitive personal data may be processed only under an applicable statutory exception and enhanced controls. Criminal-record data, if ever required, is not processed without specific legal review.

5. Data classification and handling

Doorstone uses the following minimum classification.

Data is classified according to the highest-risk element in a record. Downloading Restricted or Confidential data to unmanaged devices, personal email, personal messaging accounts or unapproved storage is prohibited.

6. Collection and privacy by design

6.1 Product approval

A new or materially changed feature cannot process personal data until its data-design record is approved. The record must cover:

• user and business purpose;
• fields and permissions, including why each is necessary;
• controller/processor roles and customer configuration;
• lawful basis and point-of-collection notice;
• access roles and audit events;
• vendors, SDKs, countries and contracts;
• retention, deletion and backup behaviour;
• rights-request support; and
• security and abuse cases.

Default settings must be privacy protective. Optional fields and sharing are off by default unless the user or authorised Community Customer chooses them.

6.2 Data protection impact assessment

A DPIA must be completed before high-risk processing, including:

• systematic or large-scale sensitive-data processing;
• central facial recognition or other biometric identification;
• large-scale monitoring of publicly accessible areas;
• extensive automated evaluation or profiling with significant effects;
• linking identifiable files from unrelated controllers for different purposes;
• identity-document processing at material scale;
• resident scoring, violations or other processing likely to cause material harm; or
• a new technology or use that materially changes reasonable expectations.

The DPIA describes necessity, proportionality, risks, safeguards, consultation, residual risk and approvals. Processing that needs PDPA notification or prior authorisation will not begin until that step is complete.

7. Special Doorstone controls

7.1 Identity documents

• The Community Customer must document why identity verification is necessary and what evidence is proportionate.
• Where a lower-risk method is sufficient, Doorstone will avoid collecting a full document image.
• The image is separated from ordinary profile views and made accessible only to authorised verification roles.
• Every view, change, export and deletion of an identity document is logged.
• By default, the image is deleted once verification is final and no later than 30 days afterwards. A longer period requires documented customer instruction, lawful basis and expiry date.
• Verified attributes are limited to those needed for account/community eligibility.
• Demo, training and public documentation must use synthetic identity data.

7.2 Device biometrics

Doorstone's approved architecture uses the device operating system for Face ID/fingerprint matching and receives only an authentication result. Doorstone does not receive a raw face/fingerprint or template. Any proposal to change this architecture requires a DPIA, explicit privacy review, enhanced security and any required prior authorisation before development data is collected.

7.3 Owners-association meetings and voting

• The Community Customer configures eligibility, entitlement, notice, quorum, proxy and ballot rules and remains responsible for their legality.
• Doorstone records the system events needed to evidence participation and result integrity.
• Administrative access to ballots and audit events is restricted and logged.
• Secret-ballot choices are not exposed to the Community Customer or other users unless the configured legal process requires and authorises access.
• Test ballots and production ballots are separated.
• A correction never silently overwrites the original governance event; the audit trail records the authorised change and reason.
• Doorstone does not certify that a meeting, vote or resolution is legally valid.

7.4 Invoices and payments

• The Community Customer is responsible for the invoice, amount and entitlement to collect it.
• Complete card number and CVV collection is handled by an approved payment provider, not stored by Doorstone.
• Doorstone retains limited transaction, status and reconciliation data and restricts access by finance role.
• Payment pages identify the collecting entity/provider, amount, currency and confirmation route.
• Refunds, chargebacks and disputes follow documented customer/provider procedures.

7.5 Violations, complaints and service content

Violations and complaints may affect a person's reputation or community rights. They are visible only to roles with an operational need, must identify the source/status where appropriate, and must support correction, response and escalation. Service-request attachments are not reused for demonstrations, training or marketing without separate authority.

8. Access management

Access is based on least privilege, community boundary, job role and current need.

• Unique user IDs are mandatory; shared administrative accounts are prohibited except for controlled technical accounts.
• Privileged access requires strong authentication and is reviewed at least quarterly.
• Joiner, mover and leaver events trigger prompt access changes.
• Community Customer administrators may grant only documented roles within their community.
• Production access by support/engineering requires an approved support or incident purpose and is logged.
• Access to identity images, violations, invoices, voting records and exports receives enhanced monitoring.
• Inactive accounts and credentials are disabled under the applicable access standard.

9. Security and resilience

Doorstone maintains a risk-based information-security programme that includes:

• secure configuration and change management;
• encryption in transit and appropriate encryption at rest with controlled keys;
• strong authentication, password protection and secret management;
• application, network, endpoint and malware protections;
• input validation, dependency management and secure development review;
• central security/audit logging protected against unauthorised alteration;
• vulnerability scanning and independent penetration testing at least annually and after material high-risk changes;
• encrypted, access-controlled backups and tested restoration;
• business-continuity and disaster-recovery plans;
• vendor security due diligence and contractual controls; and
• secure deletion or irreversible anonymisation at end of retention.

Security testing and monitoring are performed in a way that minimises live personal data. Production data is not copied to development or test environments unless strictly necessary, approved and protected to an equivalent standard; synthetic data is the default.

10. Vendors and Community Customers

Before a vendor processes personal data, Doorstone assesses its capability, security, countries, subprocessors and breach/rights support. The written contract must cover:

• documented instructions and purpose limits;
• confidentiality and personnel controls;
• technical and organisational safeguards;
• subprocessor approval and equivalent obligations;
• overseas-transfer requirements;
• prompt incident notice and cooperation;
• assistance with rights, DPIAs and regulators;
• return/deletion at end of service; and
• evidence, audit and remediation rights proportionate to risk.

The Community Customer DPA contains equivalent terms and clearly allocates the controller's legal duties and Marvel's processor assistance. Doorstone maintains an approved vendor and subprocessor register.

11. Disclosures and international transfers

Personal data is disclosed only to authorised recipients for a documented purpose and minimum scope. Requests from authorities are verified, recorded and reviewed for legal basis and proportionality unless law prohibits notice or review.

Before data leaves Bahrain, Doorstone records the data, exporter, importer, countries, purpose, onward transfers and legal mechanism. Direct transfer may be made to a destination recognised by the Bahrain PDPA as adequate. Other transfers require applicable prior authorisation or a statutory exception plus the necessary contract and safeguards. Transfer status is reassessed when a vendor, country or law changes.

12. Accuracy, retention and deletion

Product owners and Community Customers must provide a way to correct data and define the authoritative source for key identity, unit, invoice and voting fields. Material corrections are logged.

Doorstone maintains a record-level retention schedule aligned with the public Privacy Policy. Every period has a trigger, owner, legal/business justification, disposal action and exception process. Indefinite retention is prohibited.

Legal holds are documented, limited to relevant records and reviewed at least every six months. When a hold ends, the ordinary schedule resumes. Deletion must cover active copies, search indexes and exports under Doorstone's control; protected backups expire on the documented overwrite cycle and are not restored to ordinary use.

Aggregated information may be kept longer only if it has been tested so that an individual cannot reasonably be re-identified. Pseudonymisation alone is not anonymisation.

13. Individual rights

Doorstone provides a monitored electronic route for access, correction, blocking, erasure, objection, consent withdrawal, marketing opt-out and automated-decision requests.

The privacy team will:

• log the request and identify the relevant controller;
• verify identity using proportionate information and avoid requesting a new ID image where a safer method works;
• acknowledge and route Community Customer requests promptly;
• search all relevant systems and vendors;
• apply legal exceptions narrowly and record the reason;
• respond within the applicable Bahrain period-normally 15 working days for access and 10 working days for valid correction, blocking, erasure or direct-marketing objection; and
• propagate an accepted correction, blocking or erasure to relevant recipients as required.

No person is penalised for making a privacy request. Ordinary requests are handled free of charge unless Bahrain law permits otherwise.

14. Direct marketing and operational messages

Operational notices necessary for security, invoices, service requests, meetings or community administration are distinguished from promotions. Doorstone marketing requires the appropriate consent and always includes a simple opt-out. An opt-out is applied across the relevant channel without unnecessary delay and within the legal deadline. Suppression data is retained only to honour the choice.

Community Customers may not use Doorstone data for unrelated marketing unless they independently establish and document a lawful basis and provide the required notice and choice.

15. Personal-data incidents

Anyone who suspects loss, unauthorised access, disclosure, alteration, unavailability or improper processing must immediately report it through Doorstone's incident channel. Personnel must preserve evidence and must not investigate by copying or circulating data beyond the response team.

The incident team will:

• contain the event and protect affected individuals;
• establish what happened, when, systems, countries, data categories and approximate people/records affected;
• identify the controller and notify affected Community Customers without undue delay, with an internal target of no later than 24 hours after awareness;
• assess likely harm and document the decision;
• support notice to the Bahrain PDPA within 72 hours where required, explaining any delay;
• notify affected individuals without undue delay where the breach is likely to create high risk, unless a legal exception applies;
• document mitigation, recovery and recurrence-prevention measures; and
• retain the incident record and evidence under restricted access.

No public statement about an incident may be misleading or delay a legally required notice.

16. Training, assurance and improvement

• Personnel complete privacy and security training at onboarding and at least annually.
• Higher-risk roles receive role-specific training for identity documents, support, production access, payments, governance and incident handling.
• Compliance with this Policy, rights timelines, privileged access, vendor status, deletion jobs and consent controls is reviewed periodically.
• Material findings have a named owner, due date and management escalation.
• This Policy and related risks are reviewed at least annually and after material product, vendor, law or incident changes.

Violation of this Policy may lead to access removal, disciplinary or contractual action and, where appropriate, reporting to a Community Customer, regulator or law-enforcement authority.

17. Governing law and courts

These Terms and any non-contractual dispute connected with them are governed by the laws of the Kingdom of Bahrain, without limiting mandatory rights you have under applicable law.

The competent courts of the Kingdom of Bahrain have jurisdiction, subject to any mandatory consumer forum or dispute right that cannot lawfully be excluded.

18. Questions and complaints

Questions, rights requests or complaints may be submitted to:

Marvel Technology and Information Systems WLL (Doorstone)

Arcapita, Office 2

Bahrain Bay, Manama 346

Kingdom of Bahrain

Privacy: info@marvel-technology.com

Support: hello@doorstone.co

Individuals may also complain to the Bahrain Personal Data Protection Authority.