Privacy Policy

1. About this Policy

This Privacy Policy explains how personal data is processed through the Doorstone website, mobile application, web dashboard and related support services (together, the Services).

Doorstone is operated by Marvel Technology and Information Systems WLL (Marvel, Doorstone, we, us or our), with an office at Arcapita, Office 2, Bahrain Bay, Manama, Kingdom of Bahrain 346.

Doorstone is used by owners associations, developers, property managers and other organisations responsible for a property or community (each a Community Customer). The Community Customer that invited you to Doorstone is identified in the application or your invitation.

This Policy applies to residents, owners, tenants, family members, authorised community representatives, website visitors, prospects and other users. It should be read with the Doorstone Terms and Conditions and any privacy information supplied by your Community Customer.

2. Who controls your personal data?

The answer depends on the purpose for which the data is used.

2.1 Community data

Your Community Customer normally decides why and how the following data is used: your unit or community relationship; identity verification required for that relationship; service and maintenance requests; community documents and notices; invoices and dues; violations; visitors or access records; and owners-association meetings, attendance, proxies and voting records.

For that data, the Community Customer is normally the data controller and Marvel processes the data on its documented instructions as a data processor. The Community Customer is responsible for its legal authority, privacy information, user permissions and retention instructions. Marvel assists it in protecting the data and responding to your rights.

2.2 Doorstone operational data

Marvel is the data controller when it decides how data is used for:

• creating and administering your Doorstone account;
• authentication, fraud prevention, logs and platform security;
• responding directly to support requests and feedback;
• website enquiries and demo requests;
• cookie choices, service analytics and product improvement;
• optional Doorstone marketing; and
• Marvel's legal, audit and business administration.

If you are unsure who controls a particular record, contact us. We will answer the request or direct it to the appropriate Community Customer without unnecessary delay.

3. Personal data we process

Depending on the Services enabled for your community and how you use them, we process the following categories.

3.1 Account and contact data

• name, email address, mobile number and country code;
• username, password hash, one-time-password records and account status;
• preferred language, notification settings and communication choices; and
• customer, community, building, unit and user role.

3.2 Identity and eligibility data

• CPR or other identity number, identity-document type and expiry date;
• front and back images of a CPR card or passport where identity verification is required;
• name, nationality and date of birth extracted from or checked against the document;
• ownership, tenancy, occupancy, family or other relationship to a unit; and
• verification result, reviewer, date and audit record.

We treat identity documents as high-risk and restrict access to authorised personnel. Our default is to delete the document image after verification and no later than 30 days after a final verification decision, unless the Community Customer gives a documented lawful retention instruction or the image is needed for a legal claim. Necessary verified attributes may be retained separately for the relevant community relationship.

3.3 Community and property data

• property, estate, community, unit, ownership, tenancy and occupancy records;
• authorised family members, representatives and role permissions;
• service or maintenance requests, descriptions, status, appointments and communications;
• photographs, video, audio, documents and other request attachments;
• community news, notices, alerts, events, offers, surveys and acknowledgements;
• visitors, deliveries, access requests, vehicle or permit information where enabled; and
• complaints, incidents, warnings and violation records.

3.4 Owners-association and governance data

• membership, unit entitlement and meeting eligibility;
• meeting notices, attendance, proxies, nominations and participation;
• ballots, votes, voting status, results and audit events; and
• minutes, resolutions and association documents.

Where a ballot is configured as secret, access must be limited so that an individual choice is not disclosed except where technically necessary and legally authorised. The Community Customer determines the applicable voting and record rules.

3.5 Invoice and payment data

• invoices, dues, credits, balances and payment status;
• amount, currency, date, transaction reference and receipt information;
• selected payment method and limited payment-provider metadata; and
• reconciliation, refund, dispute and support records.

Complete card numbers and card verification values are collected by the identified payment provider and are not stored by Doorstone. The provider processes payment information under its own privacy terms. Doorstone receives the information needed to confirm and reconcile the transaction.

3.6 Device, usage and technical data

• IP address, device and application identifiers, browser, operating system and app version;
• login, authentication, consent, change and security audit events;
• pages, screens, functions and timestamps associated with your use;
• diagnostic, performance and crash information; and
• approximate location inferred from an IP address, where used for security.

3.7 App permissions

The app may request access to camera or photo storage to scan an identity document or attach evidence, notifications to send alerts, and other device functions required for a feature you choose. The operating system lets you grant or withdraw permissions. Refusing an optional permission affects only the feature that needs it.

Face ID and device biometrics: when you enable biometric login, your device operating system performs the biometric match. Doorstone receives an authentication result and does not receive or store your face image, fingerprint or biometric template.

3.8 Website enquiry, cookie and marketing data

• company, mobile number and enquiry content;
• cookie consent and preference records;
• website analytics and interaction data where permitted; and
• subscription, campaign and opt-out records.

3.9 Sensitive data

A request, attachment, violation, visitor record or other user-submitted content may incidentally contain health, religious, criminal-record or other sensitive personal data. Do not submit sensitive information unless it is necessary and you or the Community Customer has lawful authority to do so. We apply enhanced access and security controls where we are instructed to process such data.

4. How we receive personal data

We receive data:

• from you when you register, verify your identity, use a feature, make a payment or contact us;
• from your Community Customer, owner, landlord, authorised representative or property records used to invite or validate you;
• from your device and use of the Services;
• from payment, messaging, identity-verification and support providers; and
• from competent authorities or public records where authorised by law.

When a Community Customer supplies your data, it is responsible for giving you the privacy information required by law. We also make this Policy available at registration and in the Services.

5. Why we use personal data and our legal basis

Where we rely on legitimate interests, we assess the necessity, expected benefit, impact on you and safeguards. You may object as described below.

6. Is providing data mandatory?

Fields are identified as required or optional at collection.

• Without required contact and account data, we cannot create or secure your account.
• Without evidence needed to validate your relationship to a unit, the Community Customer may be unable to approve community access.
• Without transaction information, a payment cannot be completed or reconciled.
• Optional profile fields, app permissions, marketing and non-essential cookies can be refused without losing unrelated core functions.

7. When we disclose personal data

We disclose only what is necessary to:

• Your Community Customer and authorised users. Authorised association board members, property/community managers, staff, contractors or service providers may access information needed for their role. The Community Customer controls these roles for community data.
• Service providers. This may include cloud hosting and backup, identity/OCR verification, email/SMS/push delivery, customer support, security monitoring, error reporting, analytics and payment providers. They are contractually restricted and assessed for privacy and security.
• A person you authorise. For example, a family member, representative or service provider you choose, subject to role controls.
• Authorities and legal advisers. We may disclose data where required by a valid law, court or regulatory request; to establish, exercise or defend legal rights; or to protect people and the Services.
• A corporate transaction. Data may be disclosed under confidentiality in a merger, financing, restructuring or sale, with notice and protection as required by law.

We do not sell personal data. We do not disclose identifiable community data to third parties for their independent advertising. A community offer or external service remains subject to the provider's own terms and privacy notice when you choose to engage with it.

8. International transfers

Some providers or their support teams may process data outside Bahrain. Before a transfer, the responsible controller assesses the destination, vendor and legal mechanism. Transfers are made to destinations recognised by the Bahrain PDPA as providing adequate protection or under an applicable authorisation, statutory exception and safeguards required by Bahrain law.

Contact us for information about the safeguards relevant to your data. We may withhold details that would compromise security or another person's rights.

9. Retention and deletion

We keep personal data only for a documented purpose and period. Where Marvel acts as processor, the Community Customer sets the period in its instructions, subject to law. Where Marvel acts as controller, the following operational defaults apply unless a longer period is required for law, fraud prevention, dispute resolution or a legal hold.

Deletion from an active system does not always remove a record immediately from a protected backup. Backup data is not restored to ordinary use and is overwritten according to the cycle above. We securely delete or irreversibly anonymise data when its period ends.

10. Cookies and third-party content

We use strictly necessary storage to operate security, login and privacy choices. Analytics, advertising and third-party media/map cookies are disabled until you make an affirmative choice where consent is required.

Our preference panel provides Accept All, Reject All and category-level controls. You can withdraw or change consent at any time using Cookie Settings in the website footer. Refusing non-essential cookies does not prevent access to ordinary website content; a specific embedded video, map or audio player may remain unavailable until you choose to load it.

Third-party content may include services such as YouTube, Vimeo, Google Maps, Spotify or SoundCloud. When enabled, the relevant provider may receive your IP address, device data and its own cookie information under its privacy terms.

11. Your rights

Subject to Bahrain law and applicable exceptions, you may:

• ask whether your personal data is processed and obtain access to it;
• ask for inaccurate, incomplete or outdated data to be corrected;
• ask for unlawful data to be blocked or erased;
• object to processing that causes substantial material or moral harm;
• object at any time to direct marketing;
• withdraw consent, without affecting earlier lawful processing;
• ask for human reconsideration of certain decisions made solely by automated processing; and
• complain to Bahrain's Personal Data Protection Authority.

Access requests are normally answered free of charge within 15 working days. Valid correction, blocking, erasure and direct-marketing objections are normally handled within 10 working days. We may request proportionate proof of identity and authority. We may refuse or limit a request only where law permits and will explain the reason.

For community data, we may send the request to the relevant Community Customer and assist it. To submit a request, email info@marvel-technology.com with the subject "Privacy Request" or use the in-app support channel.

You may complain to the Bahrain Personal Data Protection Authority. We would appreciate the opportunity to address the issue first, but this does not limit your right to contact the PDPA.

12. Automated decisions

Doorstone does not use your personal data to make a solely automated decision that has a legal or similarly significant effect on you. Rules may flag an account or transaction for security review, but an authorised person must review any material restriction. If this changes, we will provide the required information and rights before the processing begins.

13. Security

We use risk-based technical and organisational safeguards designed to protect confidentiality, integrity and availability. These include access based on job role, authentication controls, encryption in transit and appropriate encryption at rest, audit logging, protected backups, secure development and change controls, vendor review, vulnerability management, staff confidentiality and incident response.

No internet service is completely secure. Keep your credentials confidential, enable device security and promptly report suspected unauthorised access to hello@doorstone.co.

If a personal-data breach is likely to create a high risk to you, the responsible controller will inform you as required by Bahrain law and explain the nature, likely effects and protective steps.

14. Children and dependent family members

An individual must be at least 18 and have legal capacity to create and accept a Doorstone account unless a legally authorised guardian or representative acts for them. The Services are not directed to children for independent account creation.

A Community Customer or authorised adult may add limited information about a minor or dependent family member where necessary for a lawful community purpose. The person adding it must have authority and should provide only the minimum information. Contact us if you believe a minor's data was added without authority.

15. Changes to this Policy

We may update this Policy to reflect changes in law, Services or processing. We will post the new version with its effective date and give reasonable advance notice of material changes. Where law requires consent, we will request it before the new processing begins. Earlier versions will be available on request.

16. Governing law and courts

These Terms and any non-contractual dispute connected with them are governed by the laws of the Kingdom of Bahrain, without limiting mandatory rights you have under applicable law.

The competent courts of the Kingdom of Bahrain have jurisdiction, subject to any mandatory consumer forum or dispute right that cannot lawfully be excluded.

17. Contact us

Marvel Technology and Information Systems WLL (Doorstone)

Arcapita, Office 2

Bahrain Bay, Manama 346

Kingdom of Bahrain

Privacy requests: info@marvel-technology.com

General support: hello@doorstone.co