GINI is an Iraqi company headquartered in Baghdad, operating in market automation and digital commerce, and connecting commercial partners, service providers, delivery companies and payment systems within a single digital ecosystem. We believe trust is the foundation of every commercial relationship, and that protecting personal data is inseparable from that trust.
This policy sets out how we collect, use, share, retain and protect personal data. It applies to gini.iq and its blog, to every platform, application, portal and programme that GINI operates or offers under its brand (together, the "Services"), and to our dealings with partners, suppliers and visitors. Some Services may carry supplementary privacy notices that apply alongside this policy and elaborate on it for that Service.
By using the Services or providing us with your data, you acknowledge that you have read this policy. If you deal with us on behalf of a business, this policy applies to the personal data of its representatives and staff processed in the course of that relationship.
Definitions
- "Personal data": any information relating to a natural person who is identified or identifiable, directly or indirectly.
- "Processing": any operation performed on personal data, such as collection, recording, storage, use, sharing and deletion.
- "User": anyone who visits or uses the Services, whether a customer, a commercial partner, a representative of an organisation or a visitor.
- "Commercial partner": any organisation or person offering products or services through the Services, or dealing with GINI under an agreement.
The data we collect
We follow the principle of data minimisation: we collect only what is needed for a specific, legitimate purpose. The data varies by Service and by the nature of your relationship with us, and generally falls within the following categories:
- Identity and contact data: name, phone number, email, address, account details and password (stored in an irreversible hashed form).
- Commercial partner data: organisation name, line of business and address, registration, licensing and identity documents where verification is required, and settlement and invoicing details.
- Transaction data: orders, contracts, amounts, status, payment method and delivery. We never store full card numbers; payments are processed by licensed payment partners under their security standards.
- Technical and usage data: device type, operating system and browser, IP address, technical identifiers, pages and features used, and performance, error and security logs.
- Location data: when you enable a feature that relies on it, with your explicit device-level permission, which you may withdraw at any time.
- Content and communications: text, images, ratings and reviews you publish or upload through the Services, and your correspondence with our support teams or with other users through the Services.
- Data from other sources: what we receive from payment, delivery and verification partners and from public authorities, to the extent the Service or the law requires.
How we collect data
- Directly from you: when you create an account, complete a transaction, fill in a form, contact us, or take part in a programme or campaign.
- Automatically as you use the Services: through cookies and similar technologies and server logs, as described in the dedicated section.
- From our partners and other legitimate sources: where necessary to deliver a Service you have subscribed to, or to verify identity and prevent fraud.
Purposes and basis of processing
We process personal data for specific, legitimate purposes and do not later use it in ways incompatible with them. Processing rests on performing a contract with you, meeting a legal obligation, a legitimate interest of GINI that is not overridden by your rights, or your consent where required.
- Providing and operating the Services: creating and managing accounts, executing transactions and orders, coordinating delivery, and providing support.
- Payments and settlements: processing payments through licensed partners, settling balances, and issuing invoices and accounting records.
- Promotional, reward and prize-draw programmes: managing participation and eligibility, calculating benefits, verifying winners and announcing results, under each programme's published rules.
- Security and fraud prevention: verifying identity, detecting fake accounts and suspicious activity, and protecting the Services and their users.
- Improvement and development: analysing usage in aggregate and, wherever possible, anonymised form to measure performance, improve the Services and launch new features.
- Communication: account, transaction and security notifications (necessary to provide the Service), and marketing messages with your consent or as permitted by law, with the ability to opt out at any time.
- Legal and regulatory compliance: keeping records required by law, responding to binding official requests, and establishing and defending legal claims.
Data security
We apply technical and organisational measures proportionate to the risk to protect data from unauthorised access, disclosure, alteration or destruction, including:
- Encryption of connections between users' devices and our systems, and encryption of sensitive data at rest where appropriate.
- Need-to-know access controls, multi-factor authentication for privileged accounts, and logging of sensitive operations.
- Periodic security reviews, vulnerability management, and a published responsible-disclosure channel via the site's security.txt file.
- Contractual obligations on service providers and partners to maintain appropriate protection standards.
No system can be absolutely secure. Should a security incident affect your personal data, we will take the necessary containment steps and notify you and the competent authorities as the law requires.
Data retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, and while your account is active or the contractual relationship continues. Once the purpose ends or the account is closed, we delete or anonymise the data within a reasonable period.
Data we are legally required to keep, such as financial, tax, transaction and anti-fraud records, is retained for the statutory period and then securely destroyed.
Your rights
You hold the following rights over your personal data, and may exercise them from within the Service where available or by contacting us. We respond within a reasonable time after verifying your identity, and do not charge for reasonable requests:
- Access your data and obtain a copy of it.
- Correct inaccurate data or complete incomplete data.
- Delete your data or close your account, subject to the legal exceptions set out in the retention section.
- Object to particular processing or ask for it to be restricted, and withdraw consent where processing relies on it, without affecting the lawfulness of prior processing.
- Opt out of marketing messages at any time, and withdraw location and notification permissions from your device settings.
- Lodge a complaint with us, or with the competent data-protection authority where one exists, if you believe our processing breaches the law.
Minors' privacy
The Services are intended for persons aged eighteen or over. Younger persons may use the Services only with a guardian's consent and under their supervision. We do not knowingly collect data from children under thirteen, and we delete it without delay if we learn we have.
Hosting and data transfers
Data may be hosted or processed on the servers of trusted providers outside the Republic of Iraq. In all cases we ensure it remains subject to contractual and technical safeguards no weaker than those described in this policy, and we do not allow any provider to use it for its own purposes.
External links and services
The Services may include links, embedded content or integrations with services provided by other parties, such as video platforms, social networks and partner services. Those services are governed by their owners' privacy policies; GINI is not responsible for their practices, and we encourage you to review their policies before use.
Updates to this policy
We review this policy periodically and may update it as our Services evolve or legal requirements change. The updated version is published on this page with its revision date, and for material changes we notify you through the Service or your registered contact details before they take effect.
Contact us
For any enquiry or request concerning your privacy or the exercise of your rights, contact us by email at info@gini.iq, by phone on 7721, or in writing to GINI — Baghdad, Republic of Iraq.
The Arabic version of this policy is the authoritative one; the English text is a courtesy translation, and the Arabic text prevails in case of any conflict.