Privacy Policy

This Privacy Policy explains how Hinology Technology Consulting LLC ("Hinology," "we," "us," or "our") handles personal information in connection with our websites and professional services. It describes the information that may be involved, the reasons for processing it, and how individuals can contact us about their privacy rights.

1 Scope and responsibility

This policy applies to https://hinology.co and https://hinology.com.qa (the "Site"), business enquiries, and our business-to-business consulting, advisory, engineering, assessment, and related technology services. These include governance, risk and compliance, privacy and data governance, cybersecurity, AI governance, software and systems engineering, and technology strategy and integration.

Hinology has entities established in Delaware, United States, and in the Qatar Financial Centre (QFC). The applicable contracting entity is identified in the relevant proposal, statement of work, engagement letter, order form, invoice, or other written agreement. Responsibility for personal information depends on which entity handles the interaction and determines the purposes and means of processing. Contact either office listed in section 15 if you need clarification.

Where we determine why and how personal information is processed, we act as a controller or equivalent responsible organization under applicable law. Where we process personal information on behalf of a client, the client determines the purposes of that processing, and the applicable agreement, instructions, and any required Data Processing Agreement govern our responsibilities. This policy does not replace those arrangements or limit mandatory privacy rights.

2 Information that may be collected

Personal information means information relating to an identified or identifiable individual. Depending on your interaction with us and the agreed engagement, relevant categories may include:

Contact and enquiry information. Names, business contact details, organization, role, correspondence, and information supplied when requesting or discussing services.

Contract and administration information. Proposals, engagement records, billing contacts, invoices, and payment-related correspondence needed to administer the business relationship.

Engagement information. Personal information contained in client-supplied documentation, policies, records, systems, assessment evidence, or other materials to which access is provided for the agreed services.

Website information. Where collected through the Site or its supporting technologies, technical details such as IP address, browser or device information, access times, and website interactions relevant to operation and security.

Please provide only information relevant to your enquiry or engagement. Sensitive personal information should be provided only where necessary for an agreed purpose and supported by the required authority, safeguards, and applicable legal conditions.

3 How information is obtained

Information may be provided directly by you through enquiries, correspondence, meetings, or engagement documents; by a client or its authorized representatives through the delivery of services; or through access to relevant documentation and systems that a client authorizes. Technical information may also be generated automatically when the Site is used, depending on the technologies in operation. Clients must have a lawful basis and appropriate authority to provide personal information or access to it.

4 Purposes of processing

We may process relevant personal information to respond to enquiries, prepare proposals and agreements, communicate with client representatives, and perform the agreed services. Processing may also be necessary to administer engagements, invoices and payments; protect information and systems; manage confidentiality and contractual obligations; address complaints or disputes; and meet applicable legal or regulatory requirements.

The information required depends on the service and circumstances. If information necessary to respond to a request or deliver an engagement is not provided, our ability to do so may be limited. Any materially different purpose must have an appropriate legal basis and be supported by further notice or consent where required.

5 Legal bases and applicable laws

We comply with the privacy and data protection laws that apply to our role and the relevant processing. The QFC framework applies where processing falls within its scope; Qatar privacy requirements apply where relevant. United States federal and state requirements, including applicable Delaware requirements, depend on their scope and the circumstances. The governing law of a services agreement does not remove mandatory privacy protections.

Where the applicable framework requires a legal basis, processing may rely on the following grounds, to the extent recognized by that framework:

Contract. Processing needed to enter into or perform a contract with you, including steps you request before a contract is made.

Legal obligations. Processing necessary to comply with a legal obligation that applies to us.

Legitimate interests. Where permitted, processing necessary for legitimate business interests, such as managing client relationships, delivering services, securing systems, or handling legal claims, after considering the impact on individuals and their rights. For representatives of a client organization, this may be the relevant basis rather than a contract with the individual.

Consent. Where required or appropriate, processing based on your informed consent. You may withdraw consent using the contact details below, without affecting the lawfulness of processing before withdrawal.

6 Cookies and website technologies

To the extent cookies or similar technologies are used, they may support website functionality, security, or remembering preferences. Any additional uses depend on the technologies deployed and the notice and choices provided at the time. Where consent is legally required, it must be obtained before the relevant technology is used.

You can use your browser settings to manage or delete cookies and use any privacy controls made available on the Site. Blocking some technologies may affect website features. Contact us for information about the technologies relevant to your visit. This policy does not by itself constitute consent to optional cookies or tracking.

7 Sharing and service providers

Personal information may be disclosed where necessary for the relevant purpose and subject to applicable law, confidentiality obligations, and contractual requirements. Depending on the engagement, recipients may include:

Service delivery and support. Personnel, advisors, qualified subcontractors, specialist partners, technology providers, or third-party platforms that need relevant information to support the agreed services or administration.

Authorized recipients. Authorized client representatives and other recipients the client or individual has appropriately authorized, where disclosure is necessary for the engagement.

Legal and regulatory recipients. Courts, regulators, government bodies, competent authorities, or professional advisors where disclosure is required by law or necessary and legally permitted in connection with legal proceedings or the protection of rights.

Business transfers. A relevant successor or receiving entity in connection with a merger, restructuring, acquisition, or transfer of the business or engagement, subject to applicable law and contractual obligations.

Where a provider processes personal information on our behalf, its access and use must be limited to the relevant purpose and governed by appropriate data protection, confidentiality, and security requirements. The use of a third-party platform does not authorize unrestricted disclosure of client information.

8 International transfers

Depending on the engagement and the parties involved, handling personal information may involve access or processing in the United States, Qatar, or another relevant jurisdiction. Privacy laws and protections may differ between jurisdictions.

Where a transfer is subject to legal restrictions, the applicable transfer requirements must be met. Depending on the relevant law, this may involve an adequacy determination, approved contractual safeguards, another recognized safeguard, or a legally permitted exception. Contact us for information about transfer arrangements relevant to your personal information.

9 Security and confidentiality

We use reasonable administrative, organizational, and technical measures appropriate to the nature of the services and information handled. Confidential information is protected through reasonable safeguards and disclosure limited to those who need it for the engagement and are subject to appropriate confidentiality obligations.

No system, network, platform, or method of transfer can be guaranteed to be completely secure. Clients remain responsible for the security of their own systems, accounts, credentials, and environments. Any incident response or notification obligations will be addressed in accordance with applicable law and the relevant contractual responsibilities.

10 Retention

Personal information should be retained only for as long as necessary for the purposes for which it is handled, taking account of the engagement, applicable legal and regulatory requirements, recordkeeping needs, and the establishment, exercise, or defense of legal claims. Retention therefore varies by information type and circumstances.

When information is no longer needed, it should be deleted, returned, or anonymized as appropriate, subject to lawful retention requirements. Where we act on a client's behalf, retention and return or deletion are governed by the client's lawful instructions, the applicable agreement, and any legal obligations.

11 Individual privacy rights

Depending on the applicable law, our role, and the circumstances, you may have rights to obtain information about processing; access and receive a copy of your personal information; correct inaccurate or incomplete information; request deletion or restriction; object to certain processing; receive information in a portable format; or withdraw consent.

Where applicable law provides them, you may also have rights concerning direct marketing, sale of personal information, targeted advertising, or decisions based solely on automated processing that have legal or similarly significant effects. The availability of a right depends on the relevant processing and legal conditions.

To make a request, contact us using either email address in section 15. Describe the right you wish to exercise and the relevant interaction or engagement. We may request information reasonably necessary to verify your identity or your authority to act for someone else. We will address requests within the periods required by applicable law and explain any lawful limitation or refusal.

If we process the information on behalf of a client, you may need to direct your request to that client; we will assist as required by our obligations. Where an appeal right applies, you can ask us to review a refusal by contacting us again and identifying the decision you wish to appeal. You may also complain to the competent privacy authority, including the QFC Data Protection Office for matters within its remit, or the relevant Qatar or United States authority. These options do not limit other remedies available under applicable law.

12 Third party links and services

The Site or engagement materials may refer or link to external websites, platforms, or services. Their operators are responsible for their own privacy practices. Review the relevant privacy notices before providing information to them. Our obligations for information that we disclose remain subject to applicable law and the relevant agreement.

13 Children

The Site and services are intended for business users. Our Terms of Service require users to be at least 18 years old and to have the legal capacity to enter into an agreement. Children should not submit personal information through the Site. If you believe a child has provided personal information to us, contact us so that we can assess the circumstances and take appropriate steps under applicable law.

14 Updates to this policy

We may update this policy to reflect changes in the Site, services, or applicable requirements. The updated policy will be made available on the Site with a revised last updated date. Additional notice or consent will be provided or obtained where required by law. Continued use of the Site does not replace consent where consent is required for a particular use of personal information.

15 Contact details

For privacy enquiries, requests, or complaints, contact Hinology Technology Consulting LLC at either email address below. Identify the relevant website, office, or engagement where possible so that your request can be directed appropriately.

Email: [email protected] | [email protected]

USA Office
Hinology Technology Consulting LLC
1111B S Governors Ave, STE 29928
Dover, DE 19904
United States

Qatar Office
Hinology Technology Consulting LLC
QFC Tower 1, 9th Floor, Office No. 1
Balishtoor Street, Diplomatic Area, West Bay
Doha, Qatar - P.O. Box 23245