Qatar Jurisdiction Addendum

To the OMNIA Inclusion Ltd Terms of Service and Data Processing Agreement

Last updated: 22 September 2026 Version: 1.0 (template draft — Qatar commercial-lawyer sign-off pending before issue to any Qatar school — see closing section)

Plain-English summary (not legally binding — the clauses below are.)

• What this is: Qatar-specific overrides that sit on top of our standard Terms + DPA when contracting with a Qatar school.
• What it changes: acknowledgement of Qatar's PDPPL (Law No. 13 of 2016), MOEHE/QNSA regulatory-compliance commitments, cross-border transfer basis, and dispute-resolution forum.
• What it does not change: the substance of the service, the DPA controller-processor split, our sub-processor list, our security commitments, or the price.
• What's unusual: Qatar's PDPPL is comparatively permissive about where data is hosted — there is no data-localisation requirement, and cross-border flow is allowed by default (§3.1). The catch is what kind of data OMNIA processes: pupil SEND records are "personal data of a special nature" under PDPPL Article 16 (data concerning children, and data concerning health or psychological condition — OMNIA's core dataset meets both limbs), which requires Competent Department permission to process at all, regardless of hosting location. See §3.2.
• Residual lawyer scope: three items — see closing section.

Important notice. This addendum has been drafted as a template based on Qatar's Law No. 13 of 2016 on Protecting Personal Data Privacy ("PDPPL"), Law No. 23 of 2015 on the Regulation of Private Schools (amended 2024), Law No. 2 of 2004 concerning the rights of persons with disabilities, the Qatar National School Accreditation (QNSA) framework operated by the Ministry of Education and Higher Education (MOEHE), and general Qatar commercial-law principles, together with published secondary legal commentary on the PDPPL (see sources listed in the closing section — the primary Arabic text of the PDPPL and its as-issued English translation should be checked against this draft before it is relied upon). It must be reviewed and approved by a qualified Qatar-admitted commercial lawyer with data-protection experience before it is sent to any Qatar school. See the closing section for the specific residual items requiring sign-off.

Section 1 — Preamble and scope

1.1 Purpose

This addendum applies where the School is located in the State of Qatar or is otherwise subject to Qatari law. It modifies and supplements the OMNIA Inclusion Ltd Terms of Service (including the Data Processing Agreement) and Subscription Agreement to address:

• Law No. 13 of 2016 on Protecting Personal Data Privacy ("PDPPL")
• Law No. 23 of 2015 on the Regulation of Private Schools (amended 2024), under which private and international schools are licensed and supervised by MOEHE's Private Education Affairs sector
• MOEHE's Qatar National School Accreditation (QNSA) framework
• Law No. 2 of 2004 concerning the rights of persons with disabilities, within the framework of Qatar National Vision 2030
• Cross-border data-transfer requirements under Qatari law
• Governing law and dispute resolution for Qatar schools

1.2 Precedence

In the event of any conflict between this addendum and the master Terms of Service or Data Processing Agreement, this addendum takes precedence for Qatar schools.

1.3 Defined terms

Terms defined in the master Terms of Service and Data Processing Agreement have the same meaning in this addendum. In addition:

• "PDPPL" means Law No. 13 of 2016 on Protecting Personal Data Privacy and any implementing regulations or Competent Department guidance issued under it.
• "Competent Department" means the competent administrative unit at the Ministry of Transport and Communications responsible for administering the PDPPL (PDPPL Article 1), to which complaints and permission requests under the PDPPL are directed (PDPPL Articles 16 and 26).
• "MOEHE" means the Ministry of Education and Higher Education, and in particular its Private Education Affairs sector (school licensing) and Department of Special Education and Inclusive Education.
• "QNSA" means the Qatar National School Accreditation framework operated by MOEHE.
• "School Regulator" means MOEHE and, where applicable, any accrediting body the School additionally holds (e.g. CIS, NEASC).

Section 2 — Qatar data-protection law (PDPPL)

2.1 Applicability of the PDPPL

The parties acknowledge that the PDPPL applies to the processing of personal data by the School in Qatar, including the processing of pupil and staff data through the OMNIA platform. OMNIA Inclusion Ltd acknowledges its obligations as a data processor under the PDPPL where applicable.

2.2 Key differences from UK GDPR

The parties acknowledge the following key differences between the PDPPL and UK GDPR that affect the operation of this agreement.

2.2.1 No local-authority statutory plan or tribunal route. Unlike England, Qatar has no local-authority-issued statutory education, health and care plan and no tribunal route for SEND provision. Individual planning in Qatar is school-held: the School maintains an Individual Education Plan (IEP) or equivalent support plan for each pupil identified as requiring additional support, with tiered in-school support beneath it. OMNIA's International jurisdiction configuration reflects this — three school-held support tiers, with a fourth tier reserved for any external, separately funded or issued document — and does not present Qatar plans using England-specific vocabulary (EHCP, Local Authority) or imply a tribunal route that does not exist in Qatar.

2.2.2 Lawful basis. Under the PDPPL, processing of personal data generally requires the consent of the data subject (PDPPL Article 4), subject to specified exceptions (including performance of a contract to which the data subject is party, and protection of the data subject's vital interests). The School, as data controller, confirms it has an appropriate basis under the PDPPL for processing pupil and staff data through the OMNIA platform — in most cases, parental/guardian consent obtained as part of enrolment, supplemented by the School's contractual necessity in providing education and pastoral support.

2.2.3 Personal data of a special nature. Pupil SEND data, health data, and data concerning children generally constitutes "personal data of a special nature" under PDPPL Article 16, which lists data related to ethnic origin, children, health, physical or psychological condition, religious creeds, marital relations, and criminal offences. OMNIA's core dataset — pupil records concerning special educational needs, disabilities, and health or psychological condition, for pupils who are by definition children — meets this definition on at least two independent limbs. See §2.3 and §3.2 for the processing-permission and transfer implications.

2.2.4 Data-subject rights. Qatari data subjects have rights under the PDPPL, including rights to be informed, to access, and to request correction or deletion of their personal data (PDPPL Articles 9–13). These rights are substantively similar to but not identical to UK GDPR rights. OMNIA Inclusion Ltd will assist the School in responding to PDPPL data-subject-rights requests in the same manner as described in the master DPA.

2.2.5 Supervisory authority. The supervisory authority for data protection in Qatar is the Competent Department at the Ministry of Transport and Communications. This is in addition to the UK ICO as the supervisory authority for OMNIA Inclusion Ltd as a UK-registered processor.

2.3 Personal data of a special nature — processing permission

2.3.1 PDPPL Article 16 requires the prior permission of the Competent Department before personal data of a special nature is processed. Because this requirement attaches to the processing of the data — not to any particular hosting location — it applies to the School's use of the OMNIA platform to record and manage pupil SEND, health, and psychological-condition data, irrespective of where that data is stored.

2.3.2 As between the parties, the School — as the Qatar-based data controller with the direct relationship to the Competent Department — is responsible for obtaining and maintaining any Article 16 permission required for its use of the OMNIA platform to process personal data of a special nature.

2.3.3 OMNIA Inclusion Ltd will provide the School with such documentation about its processing activities, security measures, and sub-processors as the School reasonably requires to support an Article 16 permission application or renewal, and will cooperate with any related Competent Department enquiry.

2.3.4 (Residual item — see closing section.) The precise scope, application process, and processing timescale for an Article 16 permission, and whether Competent Department guidance treats a foreign SaaS processor differently from a wholly domestic one, are not yet confirmed against primary sources or Qatar-qualified counsel and must be resolved before this addendum is issued.

2.4 OMNIA Inclusion Ltd's PDPPL obligations as processor

OMNIA Inclusion Ltd, as data processor, shall:

a. Process personal data only on the documented instructions of the School in accordance with PDPPL requirements. b. Implement appropriate technical and organisational measures to protect personal data, consistent with the security commitments in the master DPA and security overview. c. Notify the School without undue delay of any personal-data breach affecting Qatar school data, and assist the School in meeting any notification obligations to the Competent Department. d. Not process personal data for any purpose other than providing the OMNIA platform to the School. e. Not use pupil data to train, develop, or improve any AI model without explicit consent from the School and, where required, from data subjects. f. Provide the School with all information reasonably necessary to demonstrate compliance with the PDPPL and cooperate with any audit or enquiry by the Competent Department.

2.5 School's PDPPL obligations as controller

The School, as data controller, confirms that it:

a. Has obtained, or will obtain and maintain, any Competent Department permission required under PDPPL Article 16 for processing personal data of a special nature through the OMNIA platform (see §2.3). b. Has an appropriate lawful basis under the PDPPL for all processing of personal data through the OMNIA platform, including parental/guardian consent where required. c. Has provided appropriate privacy notices to pupils, parents, and staff about the processing of their personal data through OMNIA. d. Will promptly notify OMNIA Inclusion Ltd of any data-subject-rights request received from a Qatar-based data subject in relation to data processed through the platform. e. Will cooperate with OMNIA Inclusion Ltd in responding to any enquiry or investigation by the Competent Department relating to data processed under this agreement.

Section 3 — Cross-border data transfers

3.1 General position — no data-localisation requirement

3.1.1 PDPPL Article 15 provides that a data controller "shall be forbidden from taking any decision or measure that may limit the Cross-Border Data Flow, unless the processing of such data is in breach of [the PDPPL], or where such processing may cause serious damage to the Personal Data or to the Individual's privacy." Qatar's PDPPL does not impose a general data-localisation requirement, and the Communications Regulatory Authority's 2022 Cloud Policy Framework confirms that on-premises data residency is not a general requirement, given the availability of appropriately secured regional cloud hosting.

3.1.2 On this basis, personal data entered into the OMNIA platform by a Qatar school may lawfully be stored and processed outside Qatar, including in the European Economic Area, subject to §3.2 (special-nature data) and the safeguards in §3.3.

3.2 Special-nature data and cross-border flow

3.2.1 The general permissiveness of PDPPL Article 15 does not, on its own, remove the Article 16 processing-permission requirement described in §2.3. Where the School's Article 16 permission (or the School's own assessment of its PDPPL obligations) addresses cross-border processing of special-nature data by a named processor, that permission or assessment should reference OMNIA Inclusion Ltd's hosting arrangement described in §3.3, so that the processing described in this addendum falls within its scope.

3.2.2 (Residual item — see closing section.) Whether Qatari guidance imposes any transfer-specific condition on special-nature data (as distinct from the general Article 16 domestic-processing permission) is not yet confirmed and must be resolved before this addendum is issued.

3.3 Transfer of Qatar school data to the EEA

The School acknowledges that personal data entered into the OMNIA platform is stored and processed in OMNIA Inclusion Ltd's Supabase managed PostgreSQL instance hosted in the European Economic Area (Ireland, AWS eu-west-1), via Lovable Cloud, with edge request processing through Cloudflare Workers (in-memory only, not persisted at the edge), as set out in the master DPA and the sub-processor list at omnia-inclusion.com/legal/sub-processors.

3.4 Transfer basis

The parties rely on the following basis for the transfer of personal data from Qatar to the EEA:

3.4.1 No prohibited transfer. The transfer does not breach the PDPPL and is not reasonably expected to cause serious damage to the personal data or to any individual's privacy (PDPPL Article 15) — the EEA applies the EU GDPR, which provides protections at least equivalent to those required under the PDPPL, and the transfer is subject to the contractual safeguards in §3.4.2.

3.4.2 Contractual safeguards. The master Data Processing Agreement between the parties, together with this addendum and the International Data Transfer Addendum to the DPA, provides contractual safeguards for the transferred data.

3.4.3 School consent and instruction. The School, as data controller, authorises and instructs the transfer of personal data to the EEA as a necessary part of using the OMNIA platform, and confirms this transfer is consistent with its obligations under Qatari law, including any Article 16 permission obtained under §2.3/§2.5(a).

3.4.4 Revisit on regulatory change. On issuance of implementing regulations, or of formal Competent Department guidance on cross-border transfer mechanisms, the parties will revisit this section and amend it as necessary.

3.5 Sub-processor locations

OMNIA Inclusion Ltd's sub-processors and the locations where they process data are set out in the sub-processors list at omnia-inclusion.com/legal/sub-processors. The School acknowledges and consents to processing by these sub-processors at the locations specified.

Section 4 — MOEHE, QNSA, and School Regulator obligations

4.1 School regulatory compliance

The School is responsible for ensuring its use of OMNIA complies with all applicable MOEHE requirements, including any MOEHE or QNSA guidance on the use of third-party technology platforms, the processing and retention of pupil data (including special-nature data), and parental-consent requirements for use of pupil data in third-party platforms. These requirements include obligations relating to:

a. Approval, due-diligence, and parental-notification requirements for third-party technology platforms used by the School. b. The processing, storage, and retention of pupil data, including special-nature data. c. Any data-localisation or hosting requirement that MOEHE or the Competent Department may apply to school data specifically (see §4.3).

4.2 OMNIA Inclusion Ltd's cooperation

OMNIA Inclusion Ltd will:

a. Provide the School with documentation, security information, and evidence of compliance as reasonably requested to support the School's MOEHE/QNSA compliance obligations, including MOEHE support-category recording, IEP review-cycle evidence, and QNSA evidence tagging as generated by the platform's Qatar compliance module. b. Cooperate with any audit or inspection by MOEHE, QNSA, or another School Regulator relating to the School's use of the OMNIA platform. c. Notify the School promptly if OMNIA Inclusion Ltd becomes aware of any regulatory requirement that may affect the School's use of the platform.

4.3 Data localisation

As at the date of this addendum, neither the PDPPL nor published MOEHE guidance imposes a general data-localisation requirement for private SEND data of the kind processed through OMNIA (§3.1). If a mandatory data-localisation requirement is introduced by the Competent Department, MOEHE, or another School Regulator that would require pupil data to be stored within Qatar, OMNIA Inclusion Ltd will notify the School and the parties will work in good faith to identify a compliant solution. If a compliant solution cannot be implemented within 90 days, either party may terminate the subscription without penalty and OMNIA will return or delete the School's data in accordance with the master DPA.

4.4 SEND data and pupil welfare

The parties acknowledge that OMNIA processes sensitive data about pupils' special educational needs, disabilities, and health conditions. Both parties commit to:

a. Treating such data with the highest level of confidentiality and care. b. Ensuring access to such data is restricted to authorised school staff only. c. Not disclosing such data to any third party, including parents, without appropriate authorisation from the School. d. Complying with any MOEHE or QNSA guidance on the handling of pupil-welfare data.

Section 5 — Governing law and dispute resolution

5.1 Governing law

The master Terms of Service and Data Processing Agreement are governed by English law. This addendum is governed by English law, with the variations to dispute resolution set out in clause 5.2.

The parties acknowledge that Qatari law and MOEHE regulations apply to the School's operations in Qatar and to certain aspects of the processing of Qatar pupil data, and nothing in this addendum limits the School's obligations under Qatari law.

5.2 Dispute resolution

Notwithstanding the governing-law clause in the master Terms of Service, the parties agree that disputes arising under this addendum or relating to Qatar school contracts will be resolved as follows.

5.2.1 Good-faith negotiation. The parties will first attempt to resolve any dispute through good-faith negotiation for a period of 30 days from written notice of the dispute.

5.2.2 Mediation. If the dispute is not resolved through negotiation, either party may refer it to mediation, using reasonable endeavours to agree on a mediator.

5.2.3 Arbitration. (Residual item — see closing section.) If the dispute is not resolved through mediation within 60 days of the mediator's appointment, it will be referred to and finally resolved by arbitration under the rules of the Qatar International Center for Conciliation and Arbitration (QICCA), seated in Doha, with English as the language of proceedings, before this addendum is issued. This mirrors the structure used in OMNIA's UAE addendum (DIAC, seated DIFC) but has not yet been confirmed as the right venue/rules choice with Qatar-qualified counsel — Qatar's Ministry of Commerce and Industry and the Qatar Financial Centre (QFC) Civil and Commercial Court are possible alternative or complementary fora depending on how the contracting School is structured, and the choice should be confirmed before this addendum is finalised.

5.2.4 Urgent relief. Nothing in this clause prevents either party from seeking urgent injunctive or other interim relief from any court of competent jurisdiction.

5.3 Service of process

For Qatar schools, service of any legal process in connection with this addendum may be made to the School's address specified in the Order Form.

Section 6 — Additional Qatar-specific provisions

6.1 Anti-bribery and corruption

The parties confirm compliance with Qatar's anti-bribery and anti-corruption laws (Law No. 11 of 2004 issuing the Penal Code, as amended, and related legislation) and — given that OMNIA Inclusion Ltd is incorporated in England and Wales and the UK Bribery Act has extraterritorial effect — the UK Bribery Act 2010. Neither party will offer, give, or accept any bribe or improper inducement in connection with this agreement.

6.2 Language

This addendum is executed in English. If a translation into Arabic is required for any regulatory purpose, the English version shall prevail in the event of any conflict, except where mandatory provisions of Qatari law require otherwise.

6.3 Sanctions compliance

OMNIA Inclusion Ltd confirms that it is not subject to any Qatar, UK, US, EU, or UN sanctions that would prevent it from providing services to the School.

6.4 Regulatory changes

Qatar's data-protection and school-regulatory landscape continues to evolve. OMNIA Inclusion Ltd will monitor material regulatory changes that may affect this addendum and will notify the School of any changes that require amendment. The parties agree to negotiate in good faith any amendments required to maintain compliance with applicable Qatari law.

Section 7 — Execution

7.1 Incorporation

This addendum is incorporated into and forms part of the agreement between OMNIA Inclusion Ltd and the School. It must be signed by both parties before any Qatar school data is entered into the OMNIA platform.

7.2 Relationship to master documents

This addendum supplements and, where specified, modifies the master Terms of Service, Data Processing Agreement, and Subscription Agreement. All other provisions of those documents continue in full force and effect.

7.3 Review

The parties agree to review this addendum within 12 months of the date of signing, on issuance of material implementing regulations or Competent Department guidance, and whenever there is a material change to Qatari data-protection law or school-regulatory requirements.

Notice — residual items requiring Qatar-lawyer sign-off before issue

Unlike the UAE addendum (down to two residual items after several review cycles), this is a first-draft template and carries three open items that must be resolved before it is sent to any Qatar school:

1. Article 16 permission process. Confirmation of how the PDPPL Article 16 "prior permission of the Competent Department" requirement for personal-data-of-a-special-nature is actually obtained in practice by a private school, whether MOEHE licensing already covers it for a school's ordinary pupil-welfare records, and whether a foreign SaaS processor changes the analysis (§2.3.4, §3.2.2).
2. Arbitration forum. Confirmation of QICCA (seated Doha) as the right venue and rules edition, or whether the QFC Civil and Commercial Court or another forum is more appropriate for a SaaS contract of this size (§5.2.3).
3. Foreign-processor obligations. Confirmation of whether OMNIA Inclusion Ltd, as a foreign processor with no Qatar establishment, has any registration or local-representative obligation under the PDPPL or sector guidance (no equivalent clause has been drafted yet — the UAE addendum's §2.5 is the template to adapt once this is confirmed).

Recommended lawyer profile. A commercial lawyer at a Qatar-licensed firm with PDPPL expertise and, ideally, EdTech/SaaS or QFC experience.

Primary sources to verify against before reliance: the PDPPL's as-published Arabic text and official English translation (this draft was prepared from the English translation and secondary commentary — see version-history sources below); current Competent Department guidance, if published, on Article 16 permissions; current MOEHE/QNSA guidance on third-party platform approval.

Version history