Privacy Policy

Nathan & Brank (“Nathan & Brank”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit www.nathanbrank.com (the “Site”), engage us as a client or prospective client, or otherwise interact with us.

Because we serve clients and visitors across the United Arab Emirates, Kenya, South Africa, and internationally, this Policy is designed to meet the requirements of multiple frameworks, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) (“UAE PDPL”), the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, South Africa's Protection of Personal Information Act (“POPIA”), and the Kenya Data Protection Act, 2019 (“Kenya DPA”). Where these frameworks impose differing requirements, we apply the higher standard of protection.

Nathan & Brank, Office No. 1006, 10th floor, Marina Plaza, Dubai Marina, Dubai, United Arab Emirates, is the controller (or, under POPIA, the responsible party) of personal data collected through the Site and during the course of our client relationships, unless stated otherwise.

3.1 Data you provide directly

• contact details (name, email address, phone number, job title, company name) submitted via enquiry forms, proposal requests, or newsletter sign-up;
• information provided when engaging us as a client, including billing and authorised contact details;
• content of correspondence, briefs, and any personal data contained within materials you share with us;
• information submitted through recruitment or partnership enquiries, where applicable.

3.2 Data collected automatically

• device and usage data (IP address, browser type, operating system, referring URLs, pages visited, time spent on pages);
• data collected via cookies and similar technologies, as described in our Cookie Policy.

3.3 Data from third parties

• information from publicly available business sources (e.g. company registries, LinkedIn) used for legitimate business development;
• data received from analytics, advertising, and CRM platform providers.

We use personal data to:

• respond to enquiries and provide requested information or proposals;
• perform and administer our contracts with clients;
• operate, secure, and improve the Site;
• send marketing communications where you have consented or another lawful basis applies (see our Marketing Consent Notice);
• conduct analytics to understand Site usage and improve our services;
• comply with legal, regulatory, and accounting obligations;
• establish, exercise, or defend legal claims.

Where the GDPR, UK GDPR, or UAE PDPL apply, we rely on one or more of the following legal bases: your consent; performance of a contract with you or steps taken at your request prior to entering a contract; compliance with a legal obligation; and our legitimate interests (such as business development, Site security, and service improvement), balanced against your rights. Under POPIA and the Kenya DPA, we process personal data only where a corresponding lawful ground applies, including consent, contractual necessity, legal obligation, or legitimate interest.

We may share personal data with:

• service providers who support our operations (e.g. hosting, email delivery, CRM, analytics, and the AI-enabled internal tools described in our AI Usage & Content Disclosure Policy), acting on our instructions and under appropriate confidentiality and data protection terms;
• professional advisers (legal, accounting, audit) where necessary;
• regulators, courts, or authorities where required by law;
• a successor entity in the event of a merger, acquisition, or restructuring of our business.

We do not sell personal data. We do not disclose personal data to third parties for their own independent marketing purposes without your consent.

Given our multi-jurisdictional operations, personal data may be transferred between the UAE, Kenya, South Africa, and other countries in which our service providers operate, which may include countries outside your own. Where such transfers occur, we apply appropriate safeguards, which may include Standard Contractual Clauses approved by the European Commission and the UK Addendum, adequacy-based mechanisms, contractual protections consistent with UAE PDPL cross-border transfer requirements, POPIA section 72 requirements, and Kenya's data transfer regulations, as applicable to the specific transfer.

We retain personal data only for as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, or reporting obligations. Enquiry and prospect data not converted to a client relationship is generally retained for 24 months and then deleted or anonymised unless you have asked us to retain it for longer or applicable law requires otherwise. Client data is retained in accordance with our contractual and statutory record-keeping obligations.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption where appropriate, and vendor due diligence for our AI-enabled operating tools. No system is completely secure, and we cannot guarantee absolute security.

Subject to applicable law and any exemptions, you may have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• object to or restrict certain processing, including direct marketing;
• request data portability;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your relevant data protection authority (for example, the UAE Data Office, the Kenya Office of the Data Protection Commissioner, South Africa's Information Regulator, or your EU/UK supervisory authority).

To exercise these rights, contact us using the details in the Contact Us section below. We may need to verify your identity before actioning a request.

The Site is directed at business audiences and is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. The revised Policy will be posted with an updated effective date, and, where changes are material, we will provide additional notice as required by applicable law.

Data Privacy Officer: Susan Njeri

Registered Address: Office No. 1006, 10th Floor, Marina Plaza, Dubai Marina, Dubai, United Arab Emirates

legal@nathanbrank.com

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection authority in your jurisdiction.