Dossier 03 / data
The technical job is to expose the real data path and implement approved controls. The page does not invent a universal Iraq privacy conclusion or treat a boilerplate policy as evidence.
List each data field, who supplies it, why the system needs it, where it is stored, who can access it, and when it should be removed.
Identify hosting, analytics, email, AI, payment, file-storage, support, and security providers, including their data locations and contract owners.
The client and qualified adviser approve notices, permissions, rights handling, retention, transfers, incident duties, and any sector-specific requirements. Engineering records the approved rule and validation evidence.
US-based engineering