What we collect and why
A photo of the QID front and back, plus a selfie of the professional holding the QID. We need all three to confirm identity, run the Ministry of Interior Good Conduct Certificate check, and prevent fake or stolen-identity onboarding.
We additionally collect the work-permit number and sponsorship details to verify the right to work in Qatar under local labour law.
How it is stored
All QID images are encrypted at rest using AWS KMS server-side encryption with AES-256. Encryption keys live in AWS eu-central-1 (Frankfurt) and are rotated annually.
Images live in a private S3 bucket that has no public read access. Pre-signed URLs are issued only when an authorised ops staff member needs to review a specific professional, and those URLs expire after 2 minutes.
We never store QID images on a professional's phone, our employees' laptops, email, or messaging tools. Access is from the admin panel only, behind enforced two-factor authentication and an IP-restricted VPN connecting only to the Doha office.
Who can see it
Three roles can access QID images: the verification operator who handles the professional's onboarding, the senior ops manager who approves verifications, and our compliance lead. All three are full-time Domiraqo employees based at the Doha office.
Customers never see professional QID data. The app shows a masked ID number on the professional profile (e.g. ••••• 1234) and a verification badge.
No third party (advertiser, marketer, analytics tool) ever sees a QID image or full number.
Audit logging
Every QID view is logged: which staff member, which professional record, at what time, from which IP. Logs are reviewed monthly by the compliance lead and retained for 2 years.
A professional can request a copy of who has accessed their QID record by emailing dpo@domiraqo.com. We respond within 5 working days (and within 30 days at the latest, as required under the Qatar PDPL).
Retention and deletion
Active professional: QID retained as long as the professional is active on the platform.
Deactivated professional: 1 year retention for dispute resolution and legal compliance (tax, Qatar labour law, anti-fraud), then permanently deleted.
A professional may request earlier deletion by emailing dpo@domiraqo.com, provided no open dispute or pending payment involves their record.
Sharing with authorities
We share QID data only on receipt of a legally valid request from the Qatar Ministry of Interior, the General Tax Authority, the Qatar Financial Centre Regulatory Authority, or a Qatari court. We do not share informally, and our legal team reviews every request.
When we do share, we notify the professional within 7 days unless legally restricted from doing so by a gag order or equivalent under Qatar law.