How we handle your information.
What we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it, in plain language and accurate to how our systems actually work.
01 Who we are
WE MANAGE is a corporate digital presence and management company based in Erbil, Kurdistan. This policy explains what personal information we collect through our website and client portal, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.
We are the controller of the personal information described here. For anything you ask us to process on your behalf as part of a project, such as your own customer lists, audience data, or CRM records, you remain the controller and we act on your instructions.
02 What we collect
We collect only what a specific purpose requires. Nothing on this site asks for payment card numbers, and we never store them.
When you submit the consultation form, we receive the fields you fill in: your name, email address, phone number, company, the service you are interested in, your industry, your website or social link, the services you need, your budget range, your project urgency, your preferred contact method, and your message.
When you hold a client portal account, we store your full name, email address, an optional recovery email address, your role and account status, a one-way hash of your password (never the password itself), and, if you enable two-factor authentication, an encrypted authentication secret and your unused backup codes.
When you use the portal, we store the project records that make it work: projects, approvals and decisions, uploaded files, invoices and payments, support requests and their messages, and a history of status changes.
Automatically, for security, we record sign-in attempts against your email address together with the IP address and browser user-agent that made them, and we keep an audit log of significant actions taken in the portal: who did what, to which record, when, and from which IP address.
03 Why we use it, and on what basis
We use personal information to respond to enquiries and prepare proposals; to deliver, manage, and support the services you engage us for; to operate and secure the client portal; to issue and track invoices; to send service-related messages such as password resets and security alerts; and to keep our own records.
Where a legal basis is required, we rely on: performing a contract with you, or taking steps at your request before entering one; our legitimate interests in securing our systems, preventing abuse, and running our business; your consent, for analytics cookies; and compliance with legal obligations such as tax and accounting record-keeping.
We do not sell personal information, and we do not use it for automated decision-making that produces legal or similarly significant effects.
04 Analytics
This website uses Google Analytics 4 (measurement ID G-0Y54VQ4B2K) to understand how the site is used: which pages are visited, how visitors arrive, and which content is useful. Google Analytics sets cookies in your browser and receives your IP address, device and browser information, and the pages you view. Google processes this data as our processor and may transfer it outside Iraq, including to the United States.
We do not use analytics to identify you personally, and we do not combine analytics data with your portal account.
You can opt out at any time by declining analytics cookies in your browser, by using Google’s opt-out browser add-on, or by enabling your browser’s tracking protection. Declining analytics does not affect any other part of the site.
05 Cookies
We use a small number of cookies. The essential ones keep you signed in and protect forms against cross-site request forgery; without them the portal cannot work. The analytics ones are optional.
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
| PHPSESSID | Keeps you signed in to the client portal and carries the anti-forgery token that protects form submissions. | Essential | Until you close your browser |
| wm_returning | Remembers the name and email of the last person who signed in on this device, so the sign-in page can greet you. Cleared when you sign out. | Essential | 30 days |
| _ga, _ga_* | Set by Google Analytics to distinguish visitors and sessions. | Analytics | Up to 2 years |
Our own cookies are set with HttpOnly and SameSite=Lax, and are marked Secure over HTTPS, so they cannot be read by scripts and are not sent from other sites. You can delete or block cookies in your browser settings; blocking essential cookies will prevent you from signing in.
Our Cookie Policy covers this in more detail.
06 Who we share information with
We do not sell or rent personal information. We share it only with the service providers that make our own operation work, and only as far as each needs:
- Our email provider: to deliver messages such as password resets, security alerts, invoices, and replies to your enquiry.
- Telegram: our team receives internal notifications of new enquiries and operational alerts through the Telegram Bot API, which means the details you submit in the consultation form are transmitted to Telegram’s servers.
- Google: for the analytics described above, and for the web fonts this site loads from Google’s servers, which receive your IP address in order to serve them.
- Our hosting provider: which stores the website, database, and uploaded files on our behalf.
We may also disclose information where we are legally required to, or to establish, exercise, or defend legal claims. If our business is ever transferred, personal information may transfer with it, and we will tell you before that happens.
07 International transfers
Some of the providers above operate outside the Kurdistan Region of Iraq, including in the United States and the European Union. Where information is transferred internationally, we rely on the provider’s own safeguards and contractual commitments for the protection of that data.
08 How long we keep it
We keep personal information only as long as it serves the purpose it was collected for, or as long as the law requires.
| Information | Kept for |
|---|---|
| Consultation enquiries | Up to 24 months from your last contact with us, unless the enquiry becomes an engagement |
| Client project records | For the life of the engagement, then up to 7 years for contractual, tax, and accounting purposes |
| Invoices and payment records | Up to 7 years, to meet accounting obligations |
| Portal account details | Until the account is closed, then removed within 90 days except where records must be retained |
| Password reset links | 1 hour, after which they expire and cannot be used |
| Failed sign-in attempts | Deleted as soon as you sign in successfully; otherwise used only within a 15-minute rate-limiting window |
| Security audit log | Up to 24 months |
| Database backups | Rotated on a rolling schedule; deleted records disappear from backups as the rotation completes |
09 How we protect it
Passwords are stored only as one-way hashes and are never recoverable, by us or anyone else. Two-factor authentication is available on portal accounts, and the authentication secret is encrypted at rest. Sign-in attempts are rate-limited to slow down guessing.
All form submissions carry an anti-forgery token, database access uses prepared statements throughout, uploaded files are restricted to an allow-list of types and served through a controlled endpoint rather than directly, and portal pages enforce role-based permissions on every request. Traffic is served over HTTPS with strict transport security, and significant actions are written to an audit log.
No system can be guaranteed completely secure. If a breach ever affects your personal information and creates a real risk to you, we will tell you and the relevant authority without undue delay.
10 Your rights
You can ask us to:
- Access the personal information we hold about you, and receive a copy of it.
- Correct anything inaccurate or incomplete.
- Delete information we no longer have a reason or an obligation to keep.
- Restrict or object to how we use it, including for our legitimate interests.
- Withdraw consent where our use relies on it, such as analytics cookies. Withdrawing consent does not affect what we did before you withdrew it.
- Receive your information in a portable, machine-readable format.
To make a request, email us at info@wemanage.site. We may need to verify your identity first, and we aim to respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
11 Children
Our website and services are intended for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.
12 Links to other sites
Our site links to other places: client websites, our social profiles, and WhatsApp. Once you follow a link, you are on someone else’s site under their privacy policy, not ours. We are not responsible for how they handle your information.
13 Changes to this policy
We may update this policy as our services or our providers change. The current version is always posted on this page with the date it was last updated. If a change materially affects how we use your personal information, we will make that clear rather than relying on the date alone.
14 Contact us
Questions about this policy, or about the information we hold on you? Reach us at info@wemanage.site, on WhatsApp, or in person at Erbil, Kurdistan.