1.1. Account security
Mandatory multi-factor authentication for administrator accounts, optional TOTP for all users, new-device detection, session monitoring with remote revocation, and step-up verification before sensitive actions.
2.2. Data security
Row-level security on all user data, least-privilege service credentials, encryption in transit, restricted administrative tooling and immutable audit logging of privileged actions.
3.3. Responsible disclosure
Report suspected vulnerabilities to security@emkay.world with reproduction steps. Do not access other users' data, degrade the service, or disclose publicly before we have responded.
We acknowledge within 3 business days and will not pursue action against good-faith researchers who follow this policy.
4.4. Incident response
Confirmed incidents are triaged, contained and logged. Affected users and the competent authority are notified where required by Qatari law.
5.Governing law & jurisdiction
This policy and any dispute or claim arising out of or in connection with it are governed by the laws of the State of Qatar.
The courts of the State of Qatar have exclusive jurisdiction to settle any dispute or claim, without prejudice to any mandatory consumer rights available to you.
Where a provision is found unenforceable under Qatari law, it is severed and the remaining provisions continue in full force.
6.How to contact us
Legal & compliance enquiries: legal@emkay.world
Privacy and data-protection requests: privacy@emkay.world
Complaints, disputes and safety reports: support@emkay.world or the in-platform complaint form.
Postal enquiries may be sent to EMKAY Luxury Living, Doha, State of Qatar.