Your data,
handled with care.

1. Who is responsible

DAC for General Trading Ltd., Mekhmour Str., Building 83, 44000 Erbil, Kurdistan Region, Iraq, is the controller of the personal data described here. Questions and requests: [email protected] or +964 750 707 9112.

2. What we collect, and why

• Requests for quotation (website form, email, WhatsApp): name, company, email, phone, the parts and quantities you request, your message and any files you attach (BOQ or tender documents). Used to prepare and follow up quotations, process orders, arrange delivery and keep the commercial record the law requires.
• Job applications (careers form, email, WhatsApp): name, email, phone, city, position, experience, links to your CV or profile and your message. Used solely to evaluate your application and to contact you about it.
• Correspondence: emails and WhatsApp messages you send us, kept as part of the business relationship.
• Technical data: when you visit the site, our hosting provider and content-delivery network process your IP address, browser type and the pages requested to deliver the site securely and defend it against abuse.
• Submission log: our form backend keeps a server-side log of each request for quotation and each application (reference number, name, company, email, phone, category, page and attachment names — the message text only if the email could not be delivered). It is stored outside the web root, is covered by the retention periods and deletion rights below, and never contains your IP address.

3. Analytics and cookies

We use Cloudflare Web Analytics, which is privacy-first and does not use cookies, fingerprinting or cross-site tracking; it shows us aggregate page views and performance. We also use Google Analytics 4 to understand which pages and brands lead to enquiries. It is active on this site: it records page views and interactions such as quotation requests, applications and clicks on WhatsApp, phone and email links, sets cookies and processes data on Google's servers, with IP addresses anonymised. It is not loaded at all if your browser sends a Do-Not-Track signal or has data saving switched on. The site stores your language preference in your browser (local storage) so the page opens in English, Arabic or Kurdish as you last chose; no personal data is involved.

4. WhatsApp, social and third-party links

Our WhatsApp button opens a chat with our business number directly in your WhatsApp app. Once you message us on WhatsApp, Meta's terms and privacy policy apply to the transmission. Links to Instagram, Facebook and manufacturer websites lead to services we do not control.

5. Legal basis

We process data to perform or prepare a contract with you (quotations, orders, deliveries, applications), to comply with legal and tax obligations in Iraq and the Kurdistan Region, and on the basis of our legitimate interest in running, securing and improving this website and our business. Where visitors from the European Economic Area are concerned, these bases correspond to Article 6(1)(b), (c) and (f) GDPR; analytics cookies are used only where permitted.

6. Who receives data

• Service providers that host and protect this site (web hosting in Germany, Cloudflare for DNS, security and analytics), email providers, and Google Analytics.
• Logistics partners such as DHL Express and freight forwarders receive the name, address and phone needed to deliver your order.
• Manufacturers and distributors may receive technical details of your request when we source material on your behalf, never more than needed to quote.
• Authorities, where the law requires it.

We do not sell personal data and do not use it for third-party advertising.

7. How long we keep it

• Quotations, orders and related correspondence: for the duration of the business relationship and the statutory retention periods for commercial records.
• Job applications: up to 12 months after the decision, so we can contact you about future roles; deleted earlier on request.
• Technical logs: typically 30 days or less.
• Submission log: kept for the same period as the request or application it belongs to and removed together with it.

8. Your rights

You can ask us at any time what data we hold about you, request correction or deletion, object to processing based on legitimate interest, ask us to restrict processing, or withdraw a consent you have given. Write to [email protected]; we answer within 30 days. EEA residents may also complain to their local data-protection authority.

9. Security

The site is served over HTTPS through Cloudflare, forms are protected against automated abuse, and access to enquiry and application data is limited to the DAC team members who need it. No method of transmission is perfectly secure; we work to keep the risk low and will inform you if a breach affects your data.

10. Children

This website addresses businesses and professionals. We do not knowingly collect data from persons under 18.

11. Changes

We update this policy when our practices or the law change; the effective date above tells you the current version. Material changes are announced on this page.