Privacy policy
Last updated: 2026-09-23 · OS Store
OS Store ("we", "the shop") sells new and second-hand computers, monitors, printers and accessories from our shop in Kurdistan Region, Iraq and through this website. This policy explains what personal data we collect when you use the website, why we collect it, how long we keep it and what rights you have. It is written to comply with the right to privacy guaranteed by Articles 17 and 40 of the Constitution of the Republic of Iraq (2005), the Electronic Signature and Electronic Transactions Law No. 78 of 2012, the Consumer Protection Law No. 1 of 2010, the confidentiality provisions of the Iraqi Penal Code No. 111 of 1969, and the laws and regulations in force in the Kurdistan Region of Iraq. Iraq does not yet have a comprehensive personal-data-protection law; where a new law enters into force we will update this policy to follow it.
1. What we collect
Browsing without an account. You can browse products, filter, read auction pages and contact us on WhatsApp without registering. We then only process technical data: your IP address, browser type, the pages you open and the time of the visit, in the server logs and, as described in section 5, to choose the site language.
Account (needed only to bid or keep a wishlist). Your name, mobile number and a password. The password is stored only as a one-way hash; we cannot read it. We also store your language and display-theme preference, the date of your last login, and whether the account is active or blocked from bidding.
Bidding. Every bid you place is recorded permanently with the amount, time, your account, the IP address and browser used. Bids are legal commitments to buy; the record is our evidence of that commitment and cannot be deleted by either side.
Purchases in the shop. When you buy something, the invoice records your name and mobile number (if you give them), the items, serial numbers, prices, payments, returns and warranty period. Invoices are accounting records.
Contact. If you write to us on WhatsApp, call us or message us on Facebook or TikTok, those platforms process your data under their own policies; we keep the content of the conversation only as long as needed to answer you and fulfil the sale.
We do not collect payment-card numbers (all payments are made in the shop), national ID numbers, or precise GPS location.
2. Why we use it
- To run the website — show pages, remember your language and theme, keep you logged in.
- To operate auctions fairly — identify bidders, prevent fraud and double accounts, contact the winner, and enforce pick-up deadlines and no-show rules.
- To sell and support products — issue invoices, handle returns and warranty claims, and contact you about an order.
- To protect the shop and users — rate-limit abusive traffic, investigate disputes, and keep an audit log of important actions.
- To meet legal duties — keep commercial and tax records, and respond to lawful requests from Iraqi or Kurdistan Region authorities.
We rely on your consent (creating an account, placing a bid, contacting us), on the performance of a sale or auction contract, and on legal obligations. We never sell your data, and we do not use it for advertising profiles.
3. Who we share it with
- Our staff — only the shop owner and employees who need it to serve you. Purchase prices, profit and reserve prices are visible to the owner only; bidders' phone numbers are visible to shop staff only, never to other bidders. Other bidders see only a masked version of your name (for example "Ah***d").
- Service providers — the company hosting this website and its database, and the IP-to-country service used to pick your language (it receives only your IP address, not your name). They act on our instructions and may not use your data for their own purposes.
- Messaging platforms — WhatsApp (Meta), Facebook and TikTok, when you choose to contact us or open our pages there. Their processing is governed by their own privacy policies.
- Authorities — courts, police or regulators in Iraq or the Kurdistan Region when the law requires it or to defend our legal rights.
4. How long we keep it
- Invoices, returns and payment records: for the period required by Iraqi commercial and tax law for merchants' books (generally seven years), then deleted or anonymised.
- Bid records and auction audit logs: for as long as the auction may be disputed and at least for the same period as invoices, because a winning bid is a sale.
- Account data: until you ask us to delete the account or after three years without a login. Deleting an account removes your name, phone number and wishlist; bid and invoice records are kept as described above with your name replaced by a reference number.
- Server logs and IP addresses: up to 90 days, unless needed for an investigation.
- Cookies: see section 5.
5. Cookies and approximate location
This website uses only strictly necessary cookies: a session cookie (to keep you logged in and protect forms against forgery), a locale cookie remembering your language, and a theme cookie remembering light or dark mode. The language and theme cookies are kept for one year. We do not use advertising or analytics cookies.
On your first visit we send your IP address to a geolocation service to guess your country and region, so that visitors from the Kurdistan Region see the site in Kurdish, visitors from other Arabic-speaking countries in Arabic, and everyone else in English. Only the resulting language is stored (in the cookie); the lookup result is cached on our server for seven days. You can change the language at any time from the menu.
Product pages may embed a TikTok video of the item. The embed loads only on that page and TikTok may set its own cookies; see TikTok's privacy policy.
6. Security
Passwords are hashed with a modern algorithm; connections to the live website are encrypted (HTTPS); administrative access is protected by roles (owner and staff) so that cost prices and personal data are visible only to those who need them; bids are processed inside database transactions so they cannot be altered afterwards; failed logins and bids are rate-limited; and all significant actions are written to an audit log. No system is perfectly secure, so please use a password you do not use elsewhere and tell us immediately if you suspect misuse of your account.
7. Your rights
You may, at any time and free of charge:
- see the personal data we hold about you and receive a copy;
- correct your name or phone number (from your account page or by asking us);
- delete your account (we then keep only what the law obliges us to keep, as explained in section 4);
- withdraw consent for optional processing, for example by removing your wishlist or asking us not to contact you on WhatsApp;
- object or complain — first to us (section 12), and, if you are not satisfied, to the competent authorities or courts in the Kurdistan Region of Iraq.
To protect your account we may ask you to confirm your identity (for example from the registered mobile number) before acting on a request. We answer within 30 days.
8. Auctions
By placing a bid you agree that the bid amount, time and your account identifier are recorded permanently; that other visitors can see the amount and a masked form of your name; that if you win, the shop will contact you on the registered mobile number (including by WhatsApp) to arrange payment and collection; and that repeated failure to collect won items may be recorded and may lead to your account being blocked from bidding. These records are necessary for the fair operation of the auction and for the sale contract that a winning bid creates.
9. Children
Accounts and bidding are for adults (18 years and over) or for minors with the consent and under the supervision of a parent or guardian, in accordance with Iraqi civil law on capacity to contract. We do not knowingly collect data from children; if you believe a child has registered without consent, contact us and we will delete the account.
10. Third-party sites
Links to Facebook, TikTok, WhatsApp, Google Maps or other sites lead to services we do not control. Please read their privacy policies. We are not responsible for their practices.
11. Changes to this policy
We may update this policy when the website or the law changes. The date at the top shows the current version. Material changes will be announced on the website; continued use after the change means you accept the updated policy.
12. Contact and governing law
OS Store
Kurdistan Region, Iraq
Phone / WhatsApp: 07502302070
This policy and any dispute about it are governed by the laws of the Republic of Iraq and the laws and regulations of the Kurdistan Region of Iraq. The courts of the Kurdistan Region have jurisdiction, without prejudice to any mandatory consumer-protection rights you have under the Consumer Protection Law No. 1 of 2010.