1. Introduction and Commitment

Albedo Tech (“we,” “us,” or “our”), an ICT solutions provider based in Erbil, is committed to the robust protection of Personal Data for our clients and users. This policy outlines our data processing methods with a focus on transparency, security, and accountability, aligning with global data protection best practices.

1. Information Collected (Data Minimization)

We collect Personal Data solely to fulfill our contractual and service obligations. This includes two categories:

• A. Personal Identification Data: Name, Job Title, Company affiliation, Email, and Phone Numbers (collected via agreements and direct inquiries).
• B. Technical & Operational Data: IP Addresses, device and browser information, System Logs, and Network Traffic Data (collected from managed networks, security systems, and web analytics for monitoring and proactive security).

1. Purpose of Data Processing

Data is processed exclusively for legitimate business needs, ensuring our services are functional, secure, and tailored to client needs:

• Service Delivery: Executing contracts for Enterprise Software (ERP/HRMS), Network Infrastructure, and Mobile Application Development.
• Security & Optimization: Utilizing technical data for Network Security Monitoring, system performance analysis, and zero-downtime maintenance.
• Communication: Providing critical service updates, technical support, billing information, and responding to inquiries.

1. Data Sharing and Disclosure

We do not sell Personal Data. Information is only shared under conditions of strict confidentiality for the following reasons:

• Trusted Service Providers: With third-party partners (e.g., cloud hosting, analytics) who are contractually obliged to adhere to our security and privacy standards.
• System Integration: Data transfer necessary for integrating our software with client ERP/CRM systems, strictly controlled and authorized by the client.
• Legal Obligation: Where required by law or binding legal processes in the Kurdistan Region and Iraq.

1. Data Security (Security by Design)

Security is paramount in our ICT operations. We apply advanced, multi-layered security measures to protect data integrity, confidentiality, and availability:

• Encryption: Data is encrypted both in transit (TLS/SSL) and at rest (AES-256) to prevent unauthorized access.
• Access Control: Strict Need-to-Know principles are enforced internally, and access to sensitive data is limited to authorized personnel.
• Proactive Monitoring: We leverage our expertise to continuously monitor managed networks, ensuring rapid incident response and system hardening.

1. Data Retention Policy

We retain Personal Data only for the duration necessary to fulfill the purposes outlined in this Policy, or as required by legal, accounting, or regulatory obligations. Upon expiry of the retention period, data is securely destroyed or permanently anonymized.

1. User Rights and Choices

Users retain control over their Personal Data and have the right to:

• Access: Request a copy of the Personal Data we hold.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request the deletion of Personal Data, subject to legal and operational requirements.
• Object: Object to the processing of data for specific purposes (e.g., marketing).

1. Policy Updates and Contact

This policy is subject to periodic review and update to remain compliant with evolving regulatory landscapes. We will revise the “Last Updated” date accordingly.

For any questions regarding this Privacy Policy or to exercise your data rights, please refer to the primary contact information provided on our main website.