1. Introduction
Discovery Development Co WLL (“we,” “us,” or “our”) is a construction company incorporated in the Kingdom of Bahrain. We respect your privacy and are committed to protecting Personal Data in compliance with Law No. 30 of 2018 with Respect to Personal Data Protection (“PDPL”).pdp.gov.bh
2. Scope
This Privacy Policy applies to all Personal Data we process when you:
- visit our offices or construction sites;
- engage us for construction, design, project‑management, or maintenance services;
- supply goods or services to us;
- use our website or interact with us on social media; or
- apply for employment with us.
3. Key Terms
- Personal Data: any information relating to an identified or identifiable natural person, as defined in Article 1 of the PDPL.PwC
- Data Controller: the person who alone or jointly determines purposes and means of processing Personal Data (that is us).
- Data Processor: a third party that processes Personal Data on our behalf (e.g., cloud‑hosting providers).
4. Legal Bases for Processing
We will only process Personal Data where at least one lawful basis under Article 3 of the PDPL applies, including:
| Lawful Basis | Typical Examples in Construction Context |
|---|---|
| Contractual necessity | Preparing a quotation, executing a construction contract, making supplier payments. |
| Legal obligation | Complying with health & safety, labour‑law, tax, or anti‑money‑laundering requirements. |
| Legitimate interests | Project progress photography for internal documentation, CCTV for site security (balanced against data‑subject rights). |
| Consent | Marketing emails, publication of client testimonials. |
| Vital interests | Emergency medical situations on site. |
Sensitive Personal Data (e.g., health records or biometric data) is processed only with explicit consent or where an Article 5 exception applies.DLA Piper Data Protectionclydeco.com
5. Categories of Personal Data We Collect
| Data Category | Typical Items | Source | Retention |
|---|---|---|---|
| Identity & Contact | Name, CPR/passport, address, phone, email | Data subject | 10 years post‑project or longer if required by law |
| Employment | CV, qualifications, references, payroll details | Applicant / employee | 6 years after employment ends |
| Financial | Bank account, invoicing data | Client / supplier | 10 years (Ministry of Industry & Commerce accounting rules) |
| Technical | IP address, browser, device IDs | Website analytics | 12 months |
| Visual | CCTV, site photographs | Cameras / staff | 30 days for CCTV unless incident requires longer |
6. How We Use Personal Data
We use Personal Data to:
- provide construction and related services;
- manage bids, contracts, and payments;
- ensure site security and worker safety;
- comply with legal and regulatory obligations;
- send service notices and (with consent) marketing;
- recruit, onboard, and manage employees.
We will not use Personal Data for purposes incompatible with those disclosed, in line with the principles of purpose limitation and fairness under the PDPL.tsaaro.com
7. Disclosures to Third Parties
We share Personal Data only when necessary and subject to appropriate safeguards:
- Government / regulators – Labour Market Regulatory Authority, Ministry of Works, PDPA, courts.
- Professional advisers – auditors, insurers, lawyers.
- Service providers – IT hosting, payroll, HSE consultants, subcontractors (bound by data‑processing agreements).
International transfers outside Bahrain occur only to jurisdictions that ensure adequate protection or with PDPA approval and appropriate transfer mechanisms (PDPL Articles 12–15).pdp.gov.bh
8. Data‑Subject Rights
Under Articles 19–28 of the PDPL you have the right to:
- obtain confirmation whether we process your data;
- receive a copy of your data;
- request correction, blocking, or deletion;
- object to processing for direct marketing;
- withdraw consent at any time (without affecting prior lawful processing);
- complain to the PDPA (email: info@pdpa.gov.bh).
To exercise any right, contact us via [privacy@company.bh].
9. Security Measures
We implement technical and organizational measures proportionate to risk, including access controls, encryption, safety inductions, and regular staff training, consistent with PDPA security guidelines (Resolution No. 45 of 2022).clydeco.com
10. Retention & Disposal
Records are retained only as long as necessary for the purpose collected or to meet statutory obligations, after which they are securely destroyed or anonymized.
11. Cookies
Our website uses only essential and analytics cookies. You can manage cookies in your browser settings. A cookie banner gathers consent where required.
12. Marketing Communications
We will send promotional materials only with your opt‑in consent. You may opt out at any time using the unsubscribe link or by emailing us.
13. Automated Decision‑Making
We do not engage in fully automated decision‑making that has legal or similarly significant effects on individuals.
14. Policy Updates
We may amend this Privacy Policy to reflect legal or operational changes. The latest version is always available here with the revision date.