Privacy Policy

1. Data We Collect

We collect and process the following categories of personal data:

• Account information: name, email address, and authentication details you provide when registering.
• Subscription and payment metadata: plan selected, billing period, and transaction status. Payment card data is handled exclusively by our third-party payment processor and is not stored on our servers.
• Calculation data: tax calculation inputs and outputs you generate using the Platform's calculators.
• Payroll data: employee names, identifiers, salaries, and related fields you upload for bulk payroll processing.
• Usage data: information about how you interact with the Platform, collected for security and service improvement.

2. How We Use Your Data

We use your personal data to:

• Operate, maintain, and secure the Platform;
• Process tax calculations and generate outputs;
• Manage subscriptions, billing, and account administration;
• Provide customer and technical support;
• Comply with applicable legal, accounting, and tax-record obligations under Iraqi law; and
• Improve and develop our services.

We do not sell your personal data to third parties.

3. Legal Basis for Processing

We process your personal data on the basis of your consent, the performance of our contractual obligations to you, and our compliance with applicable legal obligations. Where you upload payroll data relating to your employees, you warrant that you have a lawful basis and any necessary consents under applicable Iraqi labour and data protection requirements, and that the processing of such data by MesoTax is permitted.

4. Data Sharing and Disclosure

We may share your personal data with:

• Third-party payment processors, solely to complete payment transactions;
• Cloud infrastructure providers that host the Platform, under data-processing agreements; and
• Competent Iraqi authorities, where required by law, regulation, or court order.

We do not otherwise transfer or disclose your personal data to third parties without your consent, except as required by applicable law.

5. Data Retention

We retain your personal data for the duration of your account and thereafter as needed to comply with legal, accounting, or tax-record obligations under applicable Iraqi law. You may request deletion of your account and associated data through the Platform at any time, subject to any retention obligations imposed by law.

6. Data Security

We apply reasonable technical and organisational measures, including encryption in transit and at rest, access controls, and secure cloud infrastructure, to protect your personal data. However, no system is perfectly secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.

7. Your Rights

Subject to applicable law, you have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your personal data, subject to legal retention obligations;
• Withdraw consent to processing where consent is the legal basis; and
• Lodge a complaint with the competent authority.

To exercise these rights, contact us through the Platform.

8. International Transfers

Your personal data may be processed on servers located outside the Republic of Iraq, including in the United Arab Emirates and the European Union. Where we transfer personal data internationally, we take reasonable measures to ensure it is protected in accordance with this Privacy Policy and applicable law.

9. Children's Privacy

The Platform is not directed to persons under the age of eighteen (18). We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact us and we will take steps to delete it.

10. Cookies and Similar Technologies

The Platform uses cookies and similar technologies to operate the service, maintain authentication, and understand usage. You may control cookies through your browser settings; disabling them may affect some features of the Platform.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Platform with a revised "Last updated" date. Your continued use of the Platform after the effective date constitutes acceptance of the updated Privacy Policy.

12. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Iraq, including the Iraqi Civil Code No. 40 of 1951, as amended. Any dispute shall be subject to the exclusive jurisdiction of the competent courts of Baghdad, Republic of Iraq.