GCC Portal Privacy Policy and Terms of Use
Privacy Policy
Last Updated: 25-Aug-2026
Gulf Contracting Co. W.L.L. ("Gulf Contracting Co.", "we", "our", or "us") respects the privacy and confidentiality of personal data processed through the GCC Portal (the "Portal"). This Privacy Policy explains what personal data we collect, why we process it, how it is protected, how long it is retained, when it may be disclosed, and how users may exercise applicable privacy rights.
This Policy applies to the Portal and its related employment and internal-support functions. It is intended to be read together with applicable company policies and Qatar's applicable personal data protection requirements, including Law No. (13) of 2016 on Protecting Personal Data Privacy, as applicable.
1. Data Controller
The data controller for personal data processed through the Portal is:
Gulf Contracting Co. W.L.L.
Address: 309, C Ring Road, New Salata, Doha
Email: itsupport@gulfcontracting.com
Phone: +974-44994499
2. Who Can Access the GCC Portal
The GCC Portal is an internal platform intended for authorized employees, staff, and operatives of Gulf Contracting Co. Access is restricted and requires valid authentication credentials. Users must not permit another person to use their account.
3. Personal Data We Collect
Depending on the Portal features used and the user's employment relationship, we may process the following categories of personal data:
Identity information: full name, Employee ID and other identifiers required for account administration.
Contact information: work email address and contact number.
Employment information: designation, department, employment status and other employment-related information required for Portal services.
Account and authentication information: user ID, authentication records and password-related information. Passwords should be stored in protected/hashed form and should not be stored as plain text.
Portal usage and security information: IP address, login/logout times, device/browser information where collected, access logs, and activity required for security, troubleshooting and auditing.
HR/service information: information displayed or submitted through Portal functions such as payslips, leave balances, HR records and IT helpdesk requests.
4. How We Obtain Personal Data
Personal data may be obtained directly from users when they log in, update their profile, submit an IT helpdesk request, or use Portal services. We may also receive or maintain personal data from authorized internal company systems, including HR or payroll systems, where necessary to provide the Portal's employment-related services.
5. Purposes of Processing
We process personal data only for legitimate and specified purposes, including:
Authenticating users and controlling access to the Portal;
Providing access to employment-related services such as payslips and leave balances;
Providing IT helpdesk and technical support;
Maintaining accurate HR, employment and IT records;
Protecting the Portal, users and company systems against unauthorized access, fraud, misuse and security incidents;
Monitoring and auditing Portal activity for security and compliance purposes;
Investigating and responding to incidents, complaints and support requests; and
Complying with applicable legal, regulatory, contractual and legitimate business requirements.
6. Legal Basis / Authorization for Processing
Personal data will be processed on an applicable lawful basis, including where processing is necessary for a legitimate purpose of Gulf Contracting Co., necessary for the employment or provision of internal services, required by applicable law, or based on the user's consent where consent is required.
Where processing relies on consent, users may withdraw consent as permitted by applicable law. Withdrawal of consent does not affect processing that was lawfully carried out before withdrawal or processing that may continue on another lawful basis.
7. Data Minimization and Accuracy
We aim to collect personal data that is relevant and reasonably necessary for the stated purposes. We take reasonable steps to keep personal data accurate, complete and up to date for the purposes for which it is processed. Users should notify the appropriate company department if their information needs to be corrected.
8. Data Sharing, Disclosure and Service Providers
Personal data is not sold or disclosed for unrelated commercial purposes.
Personal data may be accessed or disclosed where necessary to operate the Portal, provide internal services, protect company systems, comply with law, investigate security incidents, or meet other legitimate purposes described in this Policy. This may include authorized employees, HR/IT personnel, professional advisers, auditors, technology providers, hosting providers, or other service providers acting on behalf of Gulf Contracting Co.
9. International / Cross-Border Transfers
If personal data is transferred outside Qatar, Gulf Contracting Co. will apply the safeguards and requirements required by applicable law and will provide the relevant information where required.
10. Cookies and Similar Technologies
The Portal may use essential cookies or similar technologies required for authentication, session management, security and Portal functionality.
11. Data Security
We implement reasonable administrative, technical and organizational safeguards appropriate to the nature and sensitivity of personal data. These may include:
Encrypted HTTPS connections;
Access controls and role-based permissions;
Authentication and password security controls;
Security monitoring, logging and auditing;
Regular security reviews and maintenance;
Controls designed to prevent unauthorized access, alteration, disclosure, loss or destruction of personal data; and
Appropriate procedures for responding to suspected security incidents.
Access to personal data is limited to personnel and service providers who require it for authorized purposes.
12. Security Incidents and Data Breaches
If a personal data security incident occurs, Gulf Contracting Co. will assess and respond to the incident in accordance with its incident-response procedures and applicable legal requirements, including any required notifications to affected individuals or the competent authority.
Users should report suspected unauthorized access, loss, disclosure, or other security incidents immediately to the IT/Privacy contact listed in Section 1.
13. Data Retention
We retain personal data only for as long as it is necessary for the purposes for which it was collected or processed, or for as long as required or permitted by applicable law, contractual obligations, legitimate business requirements, security, audit, dispute resolution, or record-keeping requirements.
Active employee/account data: generally retained while the user's employment or authorized Portal access remains active.
HR and employment records: retained according to Gulf Contracting Co.'s applicable HR/legal record-retention schedule.
Security and audit logs: retained for the period defined in the company's security/log-retention schedule and only as long as reasonably necessary for security, investigation, audit and compliance purposes.
Helpdesk/support records: retained according to the company's IT/service-record retention schedule.
When personal data is no longer required, it will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable law and the company's retention and disposal procedures.
14. Data Deletion Requests
Subject to applicable law and legitimate retention requirements, users may request deletion or erasure of personal data where they have a legal right to do so, including where the purpose for processing has ended or there is no longer a lawful reason to retain the data.
To submit a request, contact the Gulf Contracting Co. Privacy/IT contact identified in Section 1. The request should include:
Full name;
Employee ID or other account identifier;
Email address associated with the Portal account; and
A description of the personal data or processing activity concerned and the action requested.
We may request reasonable information to verify the requester's identity and authority before processing the request. If data cannot be deleted because retention is required or permitted by law, employment obligations, security requirements, legal claims, or other applicable requirements, we will retain only what is necessary and explain the applicable limitation where appropriate.
15. Your Privacy Rights
Subject to applicable law, users may have rights including:
To be informed about processing of their personal data;
To access and review their personal data;
To request correction of inaccurate or incomplete data;
To request deletion or erasure where legally applicable;
To object to certain processing where legally applicable;
To withdraw consent where processing is based on consent; and
To submit a complaint or seek a remedy through the applicable competent authority or legal process.
16. Complaints and Requests
Privacy requests, complaints and questions should be submitted using the contact details in Section 1. Gulf Contracting Co. will review and handle such requests in accordance with applicable law and its internal privacy procedures.
17. Children's Data
The GCC Portal is an employment platform and is not intended for children. Gulf Contracting Co. does not knowingly provide Portal accounts to children.
18. Changes to This Privacy Policy
We may update this Privacy Policy when our Portal, processing activities, legal requirements, or internal procedures change. The updated version will be published through the Portal or the applicable company communication channel, together with a revised "Last Updated" date where appropriate.
19. Contact Us
For privacy questions, access/correction/deletion requests, complaints, or security concerns, please contact:
Gulf Contracting Co. – IT / Privacy Department
Email: itsupport@gulfcontracting.com
Phone: +974-44994499
Address: 309, C Ring Road, New Salata, Doha
Terms of Use
By registering for, accessing, or using the GCC Portal, you agree to comply with these Terms of Use and applicable Gulf Contracting Co. policies.
Authorized Access Only: You confirm that you are an authorized employee, staff member, or operative of Gulf Contracting Co. and will use only the account assigned to you.
Use of Information: You will use the Portal only for legitimate employment-related, HR, IT support, and other authorized company purposes.
Credential Security: You must keep your credentials confidential, use appropriate password practices, and immediately report suspected compromise.
Accuracy: You should provide accurate information when using Portal services and promptly report information that requires correction.
Prohibited Activities: You must not attempt to bypass security controls, access another user's account, copy or disclose information without authorization, introduce malicious software, interfere with Portal availability, or use the Portal for unlawful or unauthorized purposes.
Monitoring and Logging: Portal access and activity may be logged and monitored for security, support, auditing and compliance purposes as described in the Privacy Policy.
Availability: Gulf Contracting Co. may temporarily suspend or restrict access where necessary for maintenance, security, investigation, or other legitimate operational reasons.
Misuse: Unauthorized use or misuse may result in suspension or termination of access, disciplinary action, and/or legal action where applicable.