Privacy notice

01Data Controller and Corporate Structure

ALFA TELECOM LIMITED (incorporated in England and Wales, Company No. 13123886, D-U-N-S® No. 227594393) is the Data Controller responsible for personal data processed under this Privacy Notice. Our regional engineering affiliate under common ownership and control, ALFA COMMUNICATIONS AND INFORMATION TECHNOLOGY SERVICES LLC (registered in Baghdad, Iraq, Registration No. 14174, D-U-N-S® No. 850388044), assists in technical scoping, systems engineering, and operational support on our behalf under strict intra-group data protection obligations. All inquiries regarding data protection should be directed to [email protected].

02Categories of Personal Data Collected

We adhere to the principle of data minimisation under Article 5(1)(c) of the UK GDPR, collecting only personal data that is strictly necessary for technical scoping, contractual performance, and system security:

• Business Enquiries and Technical Briefs: When you submit a contact or quotation form, we collect your full name, work email address, and message content, alongside optional parameters you provide (telephone number, organisation name, country code, required engineering disciplines, budget range, timeline, and specification attachments), together with the submission locale and referral metadata.
• Direct Correspondence: When you communicate with our engineering or legal endpoints via email, we retain your email address, message payload, attachments, and routing headers.
• Client Portal Operations: For authorised client users, we process your name, work email address, cryptographic password hashes or WebAuthn passkey public keys, multi-factor authentication state, locale and timezone preferences, session activity timestamps, and project governance records (milestone sign-offs, change requests, comments, and associated IP/user-agent audit logs).
• Network & Security Telemetry: When you access the Website or Portal, our infrastructure processes transient connection metadata—specifically your IP address, TLS cipher parameters, HTTP request headers, and an encrypted session identifier—to route traffic and defend against automated abuse.

03Purposes of Processing and Lawful Bases (Article 6 UK GDPR)

We process personal data strictly for the explicit purposes set out below. We do not sell personal data, monetise user profiles, or engage in automated decision-making or profiling:

• Technical Scoping and Pre-Contractual Evaluation: To evaluate your engineering brief and prepare a technical specification or commercial quotation, relying on Article 6(1)(b) (steps prior to entering into a contract) and Article 6(1)(f) (legitimate interest in responding to B2B enquiries).
• Contractual Delivery and Portal Administration: To authenticate authorised users, manage project milestones, and deliver contracted services under Article 6(1)(b) (performance of a contract) and Article 6(1)(f) (legitimate interest in facilitating B2B client collaboration).
• Immutable Audit Trails: To maintain cryptographic and timestamped records of deliverable approvals and configuration changes under Article 6(1)(f) (legitimate interest in maintaining verifiable governance records).
• Infrastructure Security and Abuse Prevention: To detect anomalous traffic, mitigate denial-of-service attacks, and enforce access controls under Article 6(1)(f) (legitimate interest in securing network and information systems).
• Aggregate Performance Telemetry: To measure page load performance and route usage via cookie-free telemetry that neither tracks individuals nor stores personal identifiers under Article 6(1)(f).
• Statutory and Tax Compliance: To maintain corporate accounting, tax, and regulatory records under Article 6(1)(c) (compliance with a legal obligation under UK law).

04Cookies and Local Browser Storage

The Website and Portal set only strictly necessary first-party cookies required for technical operation and security: an encrypted session cookie, a cross-site request forgery protection token (XSRF-TOKEN), and a language preference cookie (locale). Authenticated Portal users may additionally receive a persistent authentication cookie and display-preference cookies. Our edge network provider may set a transient security cookie to distinguish human users from automated bot traffic. Local browser storage is used solely on your device to remember your selected footer region and banner dismissal state. Because we deploy zero advertising trackers or cross-site profiling cookies, the Website complies fully with the UK Privacy and Electronic Communications Regulations (PECR).

05Categories of Recipients and Sub-Processors

Personal data is disclosed only to vetted infrastructure sub-processors bound by written data processing agreements under Article 28 of the UK GDPR, acting strictly on our instructions:

• Cloud compute and dedicated server hosting providers;
• Edge network, DDoS mitigation, and encrypted object storage providers;
• Transactional and corporate email delivery infrastructure;
• Application error monitoring services (configured to scrub IP addresses and authentication payloads prior to ingestion);
• Cookie-free aggregate analytics processors;
• Competent regulatory, tax, or law enforcement authorities where disclosure is mandated by UK law; and
• Professional legal, audit, and tax advisers bound by statutory or contractual confidentiality obligations.

06International Data Transfers

Where personal data is accessed by our engineering affiliate in Iraq or processed by infrastructure providers outside the United Kingdom in jurisdictions without a UK adequacy regulation, we enforce appropriate safeguards pursuant to Chapter V of the UK GDPR—specifically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supplemented by technical encryption controls. You may request information regarding applicable transfer safeguards by contacting [email protected].

07Data Retention Schedules

• Prospective Enquiries: Retained for 24 months following the last substantive communication where no commercial engagement ensues.
• Contracted Client & Portal Records: Retained for 6 years following the termination or expiration of the commercial relationship, in accordance with the UK Limitation Act 1980 and statutory tax retention requirements.
• Transient Session Records: Purged automatically upon session expiration.
• Encrypted System Backups: Retained on a rolling cycle for up to 24 months, after which backup snapshots are permanently overwritten or destroyed.

08Technical and Organisational Security Measures

All data in transit is encrypted via TLS 1.3/1.2. Portal authentication supports hardware-backed FIDO2/WebAuthn passkeys and enforces multi-factor authentication for administrative personnel. Project artifacts uploaded to the Portal are stored in private, encrypted buckets and accessed exclusively via cryptographically signed URLs with a 15-minute expiration window.

09Your Statutory Data Subject Rights

Under the UK GDPR, you have the right to request access to your personal data (Article 15), rectification of inaccurate data (Article 16), erasure where retention is no longer necessary (Article 17), restriction of processing (Article 18), and data portability (Article 20), as well as the right to object to processing based on legitimate interests (Article 21). To exercise any of these rights, submit a request to [email protected]. We respond to verifiable requests within one calendar month without charge.

10Supervisory Authority and Complaints

If you have concerns regarding our processing of your personal data, please contact [email protected] so we may resolve the matter promptly. You also have the statutory right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, via https://ico.org.uk or by telephone on +44 303 123 1113.

11Updates to this Notice

We review and update this Privacy Notice periodically to reflect changes in our technical operations or statutory obligations. The revision date at the top of this page indicates the effective date of the current text.

12Governing Language

This Privacy Notice is published in English and Arabic. In the event of any divergence in interpretation, the English text shall prevail.