The law in Iraq
We could not confirm a general data protection law in Iraq. The Iraq chapter of Chambers and Partners' guide Doing Business In 2025 states that Iraqi legislation has no specific data protection or privacy law, and that general provisions of the Civil Code (Law No. 40 of 1951) and the Penal Code (Law No. 111 of 1969) apply instead. Article 437 of the Penal Code, for example, penalises a person who has access to confidential information and discloses or uses it without lawful authority. The Constitution of 2005 gives every individual the right to personal privacy (Article 17) and protects postal, electronic and telephone correspondence from being monitored or disclosed except for legal and security necessity and by a judicial decision (Article 40).
The Kurdistan Region has its own parliament and its own laws. We found no data protection law there either, but its rules may differ. The points in this notice are for an Iraqi lawyer to confirm. We handle your data as the notice describes, and where a law asks more of us, we follow the law.
What we collect and why
| Data | Where it comes from | Why we need it |
|---|---|---|
| Name, job title, work email and phone | Our forms, emails, calls and messages | To answer you, quote and deliver |
| Organisation, address, province, company registration and tax numbers, website | Quote, pre-order and account forms, and the documents you send | To check that we may supply you, and to invoice and deliver |
| Licence type, number and issuing authority | Buyers whose activity needs a licence | To check the licence |
| Institution, department, responsible researcher, research purpose and the signed end-use declaration | Research buyers | To show that research-grade products go to laboratories |
| The cosmetic products an ingredient is for | Cosmetic buyers | To check that cosmetic-grade products go into cosmetic manufacturing |
| Orders, payments, deliveries, batch numbers and claims | Our dealings with you | To supply you, trace batches, handle claims and keep accounts |
| Your choice on product news | The tick box on our quote form | To send it only if you asked |
| How the website is used, only if you accept analytics cookies | Google Analytics | To see which pages are useful |
Company registration certificates and licences can carry the names of owners and managers. We use them only for the checks above.
We do not ask for health information and do not want it. Please do not send any.
Why we may use it
We use your data to take the steps you ask for before a contract and to carry out the contract; to meet our legal duties, such as accounting, tax and lawful requests from authorities; to keep a record of whom we supplied and on what documents; and, for analytics and product news, because you agreed. You can withdraw that agreement at any time.
Who sees it
- Our own staff, and only those who need it.
- Couriers: the delivery name, address and phone.
- The companies that host this website, pass on our form messages and carry our email. The website forwards each form message to our inbox and keeps no copy of the message itself. A file attached to a form, where a form takes attachments, is kept with our records.
- Banks, to process payments.
- A product's manufacturer, only as far as a claim or a batch question needs.
- Google, for analytics, only if you accepted analytics cookies.
- The federal Ministry of Health, the Kurdistan Region's Ministry of Health, customs, tax and other authorities, where the law requires.
We do not sell personal data, and we do not use it for advertising.
Data held outside Iraq
Our website, form and email providers may store or process data on servers outside Iraq. We use them only to run this website, our forms and our email. We found no Iraqi rule on sending personal data abroad; this is for an Iraqi lawyer to confirm.
Keeping it safe
This website encrypts what you send through it, and access to our records is limited to the people who need them. If a breach puts your data at risk, we tell you.
How long we keep it
- Enquiries that do not lead to an order: only as long as we need them to deal with the enquiry.
- Account, order, batch and declaration records: as long as Iraqi law requires business and tax records to be kept.
What you can ask us to do
No Iraqi law we could confirm sets out rights over personal data, so these are the requests we accept. You can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct it or complete it;
- delete it, unless we must keep it by law or for an open claim;
- stop sending product news, or stop analytics, at any time.
Write to sales@iraqpeptides.com. We confirm who you are before we act on a request.
Cookies
See our cookie notice.
Changes to this notice
We update this notice when our practice or the law changes. The date of the latest legal review appears below.