Privacy Policy

This Privacy Policy explains how Nairank Global Limited, 245 Mwai Kibaki Road, Kinondoni, Dar es Salaam, Tanzania, trading as Nairank Global ("we", "us"), collects and uses personal data through this website and in providing our services. We are the data controller for that personal data.

We handle personal data in line with the Personal Data Protection Act, 2022 of Tanzania and, where they apply to a request or engagement, the data protection laws of the other countries in which we work — including the Data Protection Act, 2019 of Kenya, the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection Act, 2021 of Zambia — and the EU and UK General Data Protection Regulation for people in those regions.

Questions or requests about your personal data: support@nairankglobal.com.

• Contact and identity details you give us — name, email address, telephone number, company, job title and country.
• Request details — the service requested, the material, its location and quantity, dates, and anything you write in a message.
• Information about suppliers and counterparties — names, company details, contact details and roles of a supplier’s owners, directors, signatories or staff, which you or the supplier provide or which we obtain from public registries, licensing authorities, court records, sanctions lists and media during a check.
• Documents — files you upload or send, which may include identity documents (such as passport copies), company and licence certificates, invoices, assay certificates and export papers.
• Engagement records — test readings, weights, seal numbers, photographs and video taken by our personnel, laboratory results, findings and reports.
• Acceptance records — the version of these policies you accepted and the date and time.
• Technical and usage data — how you reached the site (the referring site, landing page and any campaign tags), an anonymous session identifier, clicks on our email links, and the server logs our hosting provider keeps (such as IP address, browser type and time of request).

• To answer your request and propose a scope — to take steps at your request before entering into a contract.
• To carry out an engagement — performance of our contract with you.
• To verify suppliers and counterparties — our legitimate interest, and our client’s, in preventing loss and confirming that a counterparty is genuine, licensed and lawful, balanced against the rights of the individuals concerned. We use only what the check needs.
• To meet legal obligations — including record-keeping, tax, anti-money-laundering and sanctions requirements, and responding to lawful requests from authorities.
• To protect the website and our business — security, fraud prevention and establishing, exercising or defending legal claims (legitimate interests).
• To understand which channels bring enquiries — our legitimate interest in running the website; the data used for this does not identify you.
• Optional measurement cookies — only with your consent, given through the cookie banner, which you can change at any time.

Identity documents and any special category data are processed only where needed for the check you requested, with access limited to the personnel working on it.

We do not sell personal data, and we do not use it for advertising profiles.

The findings and recommendation in our due diligence reports are prepared by our specialists. We do not make decisions about individuals based solely on automated processing.

• Service providers that host and run this website and our systems — website hosting (Vercel), database and file storage (Supabase), email delivery (Resend) and our email provider — under contracts that require them to protect the data and use it only on our instructions.
• Laboratories, licensed counsel and field partners engaged on your request, only as far as they need it, under duties of confidentiality.
• Registries, licensing authorities and issuing bodies — when we confirm a record or a document, we share only what is needed to identify it.
• Authorities — where required by law, regulation or court order.
• A successor — if our business or part of it is transferred, under the same protections.

Our service providers and some of our partners process data outside the country where it was collected, including in the European Union, the United States and other African countries. Where we transfer personal data across borders, we do so as the applicable law permits — for example to countries with adequate protection, under contractual safeguards, or where the transfer is necessary for the contract you asked us to perform.

• Requests that do not become engagements — up to twenty-four (24) months from the last contact, then deleted, unless you ask us to delete them sooner.
• Engagement records, reports and supporting documents — seven (7) years from the end of the engagement, to meet legal and professional record-keeping obligations and to answer document verification requests.
• Document verification requests — twenty-four (24) months.
• Acceptance records — for as long as the request or engagement they relate to is kept.
• Channel and click data stored in your browser — up to thirty (30) days; you can clear it at any time.

Where a law requires a longer period, or a legal claim is pending, we keep the data for as long as that requires.

Data travels to us encrypted in transit (HTTPS). Uploaded files are held in access-controlled storage, and access to requests, documents and reports is limited to the personnel and partners working on them. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authority where the law requires.

Subject to the law that applies to you, you may ask us to:

• confirm whether we hold personal data about you, and give you a copy;
• correct inaccurate or incomplete data;
• delete data we no longer have a lawful reason to keep;
• restrict or object to processing based on legitimate interests;
• provide data you gave us in a portable format; and
• withdraw consent where processing is based on consent, without affecting processing before withdrawal.

Send requests to support@nairankglobal.com. We will verify your identity and reply within the time the law requires. Some data may be kept where the law requires it or where it is needed to establish or defend legal claims.

If you are not satisfied, you may complain to the data protection authority where you live or where the issue arose — in Tanzania the Personal Data Protection Commission, in Kenya the Office of the Data Protection Commissioner, in Uganda the Personal Data Protection Office, in Zambia the Office of the Data Protection Commissioner, and in the EU or UK your national supervisory authority.

If you are named in a request — for example as a director or signatory of a supplier — we process your data to confirm the identity, standing and authority of the business our client is dealing with. We collect only what the check needs, mostly from public records and the documents provided, and keep it as set out above. You have the rights described in section 9.

• Essential — your cookie choice, and your position on a page when you go back, stored in your browser.
• Channel data — the site that referred you, the landing page and campaign tags, stored in your browser for up to thirty (30) days, so that if you later send a request we know which channel brought it. It contains no personal data.
• Measurement and advertising — only with your consent. No advertising or analytics tag is loaded on this website at present; if one is added, it will run only with your consent.

You can change your choice at any time by clearing this site’s data in your browser, which brings the cookie banner back.

Our services are for businesses and professionals. The website is not directed at anyone under eighteen (18), and we do not knowingly collect their data.

We may update this policy. The version and date at the top of this page show when it last changed. Significant changes affecting an active engagement will be notified to the client.

Nairank Global Limited, trading as Nairank Global. Registered office: 245 Mwai Kibaki Road, Kinondoni, Dar es Salaam, Tanzania. Privacy requests: support@nairankglobal.com.