Privacy Policy

1. Who we are

This Privacy Policy explains how SkySat collects, uses, shares and protects personal data across all of its activities.

In this policy, "SkySat", "we", "us" and "our" refer to Qamar Al-Sama Company for General Services and Internet Services LLC. "You" refers to any individual whose personal data we handle.

SkySat operates in two areas:

• Internet service provision. Fiber broadband to subscribers in Baghdad, together with customer care, subscription management and the SkySat app.
• Software services for businesses. Platforms used by business clients, including a service that lets a business client send one-time passcode (OTP) messages to its own customers over the WhatsApp Business Platform.

2. Who this policy applies to

Different information is handled depending on your relationship with SkySat. This policy covers three groups, and the sections that follow address each of them.

2a. Website visitors

Anyone who visits skysat-iq.com, browses our pages, or contacts us through the website contact form. You do not need an account and you are not required to identify yourself to read this site.

2b. Internet subscribers

Individuals and households who take a SkySat fiber broadband subscription, use our customer care channels, or use the SkySat app. For this group SkySat is the data controller.

2c. Business clients and their end customers

Businesses that use a SkySat software platform, and the customers of those businesses whose data passes through the platform. For a business client's own account data SkySat is the controller. For data belonging to that client's end customers, the business client is the controller and SkySat acts only as a processor on its instructions. Section 5 sets this out in detail for the WhatsApp Business Platform.

3. What we collect

3a. From website visitors

• Technical data recorded automatically in server logs: IP address, browser and device type, operating system, pages requested, date and time of the request, and the referring page.
• Information you choose to submit through the contact form: your name, email address, phone number and the content of your message.
• Your email address, if you submit it to a newsletter sign-up form.

We do not use advertising trackers or third-party analytics profiling on this website.

3b. From internet subscribers

• Identity and contact data: full name, national identification or other identity document required to register a subscription, phone number and email address.
• Installation and service address.
• Subscription data: plan, contract start and renewal dates, equipment issued and its identifiers.
• Billing and payment records, including amounts, dates and payment method used.
• Technical service data generated by the connection: assigned IP address, session start and end times, bandwidth consumed, and fault or diagnostic logs.
• Customer care records: support tickets, correspondence, and records of calls made to or by our support team.
• SkySat app data: account credentials, device type and app version, and in-app activity relating to your subscription.

We do not inspect, record or retain the content of your internet traffic, and we do not monitor the websites you visit, except where a specific technical fault requires diagnosis or where we are compelled by a lawful order of a competent authority.

3c. From business clients and their end customers

From the business client itself:

• Business name and commercial registration details.
• Contact name, email address and phone number of the client's authorised representative.
• Account credentials and platform configuration.
• Where the client uses the messaging service: WhatsApp Business Account ID, phone number ID, and Meta access tokens issued when the client connects its account.
• Billing records for SkySat's own fees.

On behalf of the business client, in respect of that client's own end customers:

• The end customer's phone number.
• The verification code sent to that number, and the delivery status of the message.

4. Why we process it, and on what basis

We do not sell personal data. We do not use subscriber data, business client data or end-customer data to build advertising profiles.

5. Third-party processors

We use a small number of service providers that process personal data on our behalf and on our instructions. They may use that data only to provide their service to us.

WhatsApp Business Platform

The scope of this processing is deliberately narrow. In delivering an OTP message, SkySat handles only the recipient's phone number and the verification code. We do not receive, request or store any other attribute of the recipient: no name, no email address, no location, no payment details, no message history beyond the delivery record of the code itself.

Verification codes expire and are not retained afterwards. A code is valid only for a short window. Once it has expired or been used it ceases to be valid and is not kept.

This data is never sold, never used for marketing, and never used to build profiles. Specifically:

• We do not sell or rent recipient phone numbers to anyone, for any purpose.
• We do not use recipient phone numbers or verification codes for marketing, promotion or advertising, whether our own or a third party's.
• We do not use this data for profiling, scoring, behavioural analysis or automated decision-making.
• We do not combine this data with data from other sources to build a profile of any individual.
• We do not share this data with any third party other than Meta for the purpose of delivering the requested message, or where compelled by law.

Meta's own handling of data transmitted through the WhatsApp Business Platform is governed by its privacy policy, available at https://www.facebook.com/privacy/policy.

If you are the customer of a business that uses our platform and you want to know why you received a message, or you want your data deleted, your first point of contact is that business, because it is the controller. You may also contact us at it@skysat-iq.com and we will act on the request or refer it to the responsible client. Step-by-step instructions are on our Data Deletion page.

Website contact form

The contact form on this website is delivered by Formspree, which receives the name, email address, phone number and message you submit and forwards them to us by email. Formspree processes this data on our behalf and on servers located outside Iraq.

Hosting and infrastructure

Our website and platform systems run on hosting and infrastructure services provided by third parties under contract. Those providers may process personal data incidentally in the course of hosting our systems, and are bound to use it only to provide the hosting service.

Other disclosures

We may disclose personal data where we are required to do so by applicable law or by a lawful order of a competent authority in the Republic of Iraq. We do not otherwise share personal data with third parties for those parties' own purposes.

6. Data retention

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires.

Where a business client instructs us to delete end-customer data sooner, we follow that instruction, subject only to records we are legally required to keep.

7. Security

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including:

• Encryption of data in transit using TLS for connections to our website, our platforms and the WhatsApp Business Platform.
• Encryption at rest for stored credentials, including Meta access tokens.
• Access control on the principle of least privilege, so staff can reach only the data their role requires.
• Individual named accounts for staff, with no shared logins.
• Logging of administrative access to production systems.
• Segregation of each business client's data, so that one client cannot access another client's data.
• Physical access controls at our premises and network facilities.
• Regular review of accounts, permissions, patches and dependencies.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. If a personal data breach affects your data, we will notify you and any competent authority without undue delay.

8. Your rights and how to exercise them

Whichever group you fall into, you have the right to:

• Ask what personal data we hold about you and obtain a copy of it.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete your data.
• Withdraw consent where our processing relies on consent, such as newsletters.
• Object to processing we carry out on the basis of our legitimate interests.

To exercise any of these rights, email it@skysat-iq.com. We respond within 30 days of receiving your request. We may first need to verify your identity, so that we do not disclose or delete data on the instruction of the wrong person. Exercising these rights is free of charge.

Detailed deletion instructions for every customer type are set out on our Data Deletion page.

9. International transfers

Some of the service providers described in section 5 process data on infrastructure located outside the Republic of Iraq:

• Meta Platforms, Inc. When an OTP message is sent, the recipient's phone number and the message content are transferred outside Iraq to Meta for the sole purpose of delivering that message.
• Formspree. Contact form submissions are processed outside Iraq before being forwarded to us.
• Hosting providers. Some of our systems are hosted outside Iraq.

We limit such transfers to what is necessary to deliver the service, and we require the recipient to process the data only on our instructions and to protect it appropriately.

10. Children

Our services are not directed at anyone under 18 years of age, and we do not knowingly collect personal data from anyone under 18. A broadband subscription may be taken out only by an adult, who is responsible for use of the connection in their household.

If we learn that we hold personal data collected directly from a person under 18, we will delete it. If you believe we hold such data, contact it@skysat-iq.com.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page and publish the updated policy at this same address.

Where a change materially affects how we handle personal data, we will give notice at least 30 days before it takes effect: to subscribers and business clients by email to the address on the account, and to everyone else by a notice on this website. Continued use of our services after a change takes effect constitutes acceptance of the updated policy.

12. Contact

For privacy questions, data access requests and deletion requests, contact it@skysat-iq.com. For anything else, use our general contact details.

Last updated: 4 September 2026