Privacy Policy

1. Definitions

For the purposes of this Privacy Policy:

• “We”, “us”, “our”, “Company” means Al-Hamad Company for Information Technology, Training, Human Resources Development, E-Marketing, Advertising, and General Trading – Limited Liability (operating its technology services under the brand “StartLab”), and its affiliates.
• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer, and deletion.
• “You” / “User” means any individual who accesses or uses the Services or whose Personal Data we Process.
• “Service Provider” / “Processor” means an entity that Processes Personal Data on our behalf and under our instructions.
• “Applicable Law” means the laws of the Republic of Iraq applicable to privacy and the protection of personal data, including the privacy protections under the Iraqi Constitution and Penal Code, applicable directives of the Communications and Media Commission (CMC), and any personal data protection legislation as and when it enters into force.

2. Who We Are

The entity responsible for your Personal Data is:

Al-Hamad Company for Information Technology, Training, Human Resources Development, E-Marketing, Advertising, and General Trading – Limited Liability
Trading as: StartLab
Address: Republic of Iraq, Najaf Al-Ashraf Governorate, Najaf–Kufa Street, near the Coral Building
Corporate website (company and contracts): https://startlab.uk

Privacy & Compliance Department (StartLab)
Responsible person: Mr. Ali Al-Sharhani
Email: privacy@startlab.uk

We have not appointed a representative outside Iraq, as we do not operate in jurisdictions that require one.

3. Scope of This Policy

This Privacy Policy applies to the Company's online properties and Services, including in particular:

• https://startlab.space — our platform and websites for technology and software services; and
• https://startlab.uk — our corporate website used for company information and contractual matters.

It applies to Personal Data collected through:

• Company websites and landing pages
• Mobile and web applications, software, and automation services
• Customer portals and dashboards
• Social media platforms and advertising/lead-generation campaigns
• Events, conferences, exhibitions, workshops, seminars, and webinars
• Surveys, research activities, and customer-support channels
• Business communications

This Policy does not apply to third-party services governed by their own privacy policies (see Section 17).

4. Acceptance and Consent

By using the Services, you confirm that:

• You are at or above the minimum age set out in Section 16;
• The Personal Data you provide is accurate and you are authorized to provide it; and
• You consent to the Processing described in this Policy, where consent is the applicable ground.

Where we rely on a ground other than consent (see Section 7), your use of the Services does not waive any rights granted to you under Applicable Law. You may withdraw consent at any time, without affecting Processing carried out before withdrawal.

5. Information We Collect

A. Information You Provide Directly

Full name; email address; phone number; company name; job title; business information; postal address; billing and payment information; event-registration information; survey responses; customer-service communications; and any other information you voluntarily submit.

B. Information Collected Through Digital Platforms

From platforms such as Facebook, Instagram, Messenger, WhatsApp Business, TikTok, YouTube, LinkedIn, Google services, and other digital platforms: usernames; public profile information; comments and interactions; direct-message communications; engagement metrics; campaign-participation data; lead-form submissions; and advertising-interaction data.

C. Event and Offline Information

When you attend or participate in our events: contact details; attendance and check-in records; badge and business-card information; networking and meeting information; and photographs, audio, or video recordings where permitted by law and, where required, with notice or consent.

D. Technical and Device Information

IP address; device identifiers; browser type; operating system; language settings; device characteristics; website and application usage data; log files; error reports; and network information.

E. Cookies and Similar Technologies

Cookies, pixels, tags, SDKs, and analytics and advertising technologies (see Section 9).

F. Information from Third Parties

We may also receive Personal Data from business partners, advertising and analytics providers, public sources, and referrals, which we combine with the information above.

We do not collect or classify Personal Data on the basis of religion or health, and we do not knowingly collect sensitive personal data unless strictly necessary and permitted by Applicable Law.

6. How We Use Information

We Process Personal Data to:

• Provide, operate, and maintain the Services;
• Process registrations, requests, and transactions;
• Deliver customer support and manage events and attendance;
• Send notifications, updates, and administrative messages;
• Conduct research, analytics, and business insights;
• Improve the Services and develop new features;
• Personalize user experiences;
• Deliver and measure marketing and advertising campaigns (see Section 8);
• Detect, prevent, and investigate fraud, abuse, and security incidents;
• Protect our systems, rights, and property, and enforce our agreements; and
• Comply with legal and regulatory obligations.

We will not use your Personal Data for materially different or incompatible purposes without notice and, where required, your consent.

7. Grounds for Processing

We Process Personal Data on one or more of the following grounds, consistent with Applicable Law and good-practice standards:

• Your consent (e.g., marketing, non-essential tracking);
• Performance of a contract with you (e.g., providing the Services, fulfilling requests);
• Compliance with a legal obligation;
• Our legitimate business interests (e.g., analytics, service improvement, security), balanced against your rights; and
• Protection of vital interests (an individual's life or safety).

8. Marketing Communications

We may use Personal Data to send newsletters, offers, promotions, and product announcements; conduct outreach; perform audience segmentation; and deliver personalized marketing.

Where required, we will obtain your consent before sending marketing communications. You may opt out at any time via the unsubscribe link in any message or by contacting privacy@startlab.uk. Opting out of marketing does not affect non-promotional communications necessary to provide the Services.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, analyze performance, improve user experience, personalize content, measure advertising effectiveness, and prevent fraud.

You can control or disable cookies through your browser or device settings. Disabling certain cookies may affect the functionality of the Services. By continuing to use the Services with cookies enabled, you consent to our use of cookies as described in this Policy.

10. How We Share Information

We do not sell your Personal Data. We may disclose Personal Data to the following categories of recipients:

• Service providers and processors (e.g., cloud hosting, IT, customer support);
• Analytics and marketing platform providers;
• Payment processors;
• Event partners and co-organizers;
• Professional advisors and auditors;
• Acquirers or successors in connection with a merger, acquisition, financing, or sale of assets; and
• Government, regulatory, or law-enforcement authorities where required by law or legal process, or to protect rights, safety, or property.

All processors are bound by agreements requiring them to Process Personal Data only on our instructions and to maintain appropriate confidentiality and security measures.

11. International Data Transfers

Some of our service providers and digital platforms (such as cloud hosting, analytics, and social-media providers) operate outside Iraq. As a result, your Personal Data may be transferred to, stored in, or accessed from countries other than Iraq.

Where we transfer Personal Data internationally, we take reasonable steps to ensure it is protected by appropriate contractual and technical safeguards and is handled consistently with this Policy and Applicable Law.

12. Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected.

As a general rule, we retain Personal Data for 90 days after the relevant purpose has been fulfilled or the relationship has ended, after which it is securely deleted or anonymized.

This 90-day rule does not apply where a longer retention period is required to comply with legal, tax, accounting, or regulatory obligations, or to establish, exercise, or defend legal claims. In those cases, the relevant Personal Data is retained for the period required by Applicable Law.

13. Data Security and Breach Handling

We implement technical, administrative, and organizational measures designed to protect Personal Data against unauthorized access, accidental loss, misuse, disclosure, alteration, and destruction. These measures may include encryption, access controls, and ongoing monitoring.

No system can guarantee absolute security. In the event of a Personal Data breach likely to affect your rights, we will take appropriate remedial steps and notify affected individuals and the relevant authorities where required by Applicable Law.

14. Automated Processing and Profiling

We may use automated processing, including profiling, to personalize content, deliver targeted advertising, and detect fraud. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate human oversight.

15. Your Rights

As a matter of our policy, and to the extent provided by Applicable Law, you may:

• Access the Personal Data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your Personal Data;
• Object to or request restriction of Processing;
• Withdraw consent at any time;
• Request a copy of your data in a portable format; and
• Opt out of marketing communications.

To exercise your rights, contact us at privacy@startlab.uk. We will respond within 30 days of receiving a verifiable request, extendable where reasonably necessary. We may need to verify your identity before acting on a request. You will not be subject to any detriment for exercising your rights.

16. Children's Privacy

The Services are not directed to children under the age of 13. We do not knowingly collect Personal Data from children under 13 without verifiable parental or guardian consent. If you believe a child under 13 has provided us Personal Data, please contact privacy@startlab.uk, and we will take appropriate steps to delete it.

17. Third-Party Services and Links

The Services may integrate with or link to third-party platforms, including Meta Platforms (Facebook, Instagram, Messenger, WhatsApp), TikTok, Google, YouTube, LinkedIn, Microsoft, and other technology and marketing providers. We are not responsible for the privacy practices of these third parties. Your use of those platforms is governed by their respective privacy policies and terms.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes become effective when published on our website or otherwise communicated. For material changes, we will provide prominent notice and, where required, obtain renewed consent. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

19. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Republic of Iraq. Any dispute arising out of or relating to this Policy shall be subject to the jurisdiction of the competent courts of Najaf, Republic of Iraq.

20. Contact Us and Complaints

StartLab — Privacy & Compliance Department
Al-Hamad Company L.L.C.

• Responsible person: Mr. Ali Al-Sharhani
• Privacy requests: privacy@startlab.uk
• General support: support@startlab.uk
• Websites: https://startlab.space (technology & software services) · https://startlab.uk (company & contracts)
• Address: Republic of Iraq, Najaf Al-Ashraf Governorate, Najaf–Kufa Street, near the Coral Building

If you are not satisfied with our response, you may raise your concern with the competent authority in Iraq.