Privacy Policy | Midrock Global

1. About this policy

This Privacy Policy explains how Midrock Global ("Midrock", "we", "us", "our") collects, uses, shares and protects personal data when you visit midrockglobal.com (the "Website") or contact us through it.

We are committed to handling personal data responsibly and in line with applicable data protection laws. These include the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and the Nigeria Data Protection Act 2023. Where they apply to you, they also include the UK and EU General Data Protection Regulations.

2. Who we are

The Website is operated by:

Midrock Global FZE, registered in the United Arab Emirates
Midrock Global LTD, registered in Nigeria

Depending on where you are and which office handles your enquiry, one or both of these entities will be responsible for your personal data.

Contact for privacy matters: info@midrockglobal.com (subject line: "Privacy")

3. Personal data we collect

Information you give us

When you submit an enquiry through our contact form, email us or contact us in any other way, we may collect:

your full name, organisation and job title
your email address, phone number and country
the service you are interested in and the content of your message
whether you have agreed to receive occasional insights from us
if you apply to join our associate network, your area of expertise and any CV or profile you upload

Please do not include sensitive personal information (for example health, financial account or identity document details) in the contact form. If we need such information to provide a service, we will ask for it separately and securely.

Information collected automatically

When you visit the Website, we and our service providers may collect:

your IP address and approximate location (country or city)
browser type, device type and operating system
the pages you visit, how long you spend on them and how you reached the Website
information collected through cookies and similar technologies (see our Cookie Policy)

4. How we use your personal data

Purpose	Legal basis
To respond to your enquiry and communicate with you about it	Our legitimate interests in responding to enquiries; or taking steps at your request before entering into a contract
To assess and manage applications to join our associate network	Our legitimate interests; steps before entering into a contract
To send you occasional insights and updates, where you have opted in	Your consent (you can withdraw it at any time)
To operate, maintain and secure the Website, including preventing spam and misuse	Our legitimate interests in running a secure website
To understand how visitors use the Website and improve it (analytics)	Your consent, given through our cookie banner
To carry out client due-diligence checks (such as KYC and sanctions screening) where you become a client	Legal obligations and our legitimate interests
To comply with law, regulation and legal processes, and to establish or defend legal claims	Legal obligations and our legitimate interests

We do not sell your personal data. We do not use it for automated decision-making that has legal or similarly significant effects on you.

5. Who we share your personal data with

We share personal data only where necessary, and with:

Midrock entities. Our UAE and Nigerian entities share enquiry information so that the right team can respond.
Service providers who help us run the Website and our business. These include website hosting, email, form handling, analytics, spam protection and customer relationship management (CRM) tools. They may only use your data to provide services to us.
Professional advisers and specialist associates, where needed to respond to or act on your enquiry, and only with appropriate confidentiality obligations.
Authorities, regulators or courts, where we are required to by law or need to protect our legal rights.
A buyer or successor, if our business or part of it is sold or reorganised, subject to equivalent protections.

6. International transfers

Because we operate in the UAE and Nigeria, and some of our service providers are based elsewhere (for example in the European Union, the United Kingdom or the United States), your personal data may be transferred to and stored in countries other than your own.

Where we transfer personal data internationally, we take steps required by applicable law to make sure it is adequately protected. These steps may include transferring only to countries recognised as providing adequate protection, using contractual safeguards, or relying on other lawful transfer mechanisms.

7. How long we keep your personal data

Type of data	How long we keep it
Enquiries that do not lead to an engagement	Up to 24 months after our last contact with you
Client and engagement records	For the duration of the engagement and up to 5 years afterwards, or longer where required by law
Associate network applications	Up to 24 months, or for the duration of any associate relationship
Marketing preferences	Until you unsubscribe or withdraw consent
Analytics data	Up to 14 months

When personal data is no longer needed, we delete it or make it anonymous.

8. How we protect your personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include encrypted connections (SSL), access controls, secure hosting and confidentiality obligations on our staff and associates. No method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security.

9. Your rights

Subject to applicable law, you may have the right to:

be told how we use your personal data (this policy)
access the personal data we hold about you
ask us to correct inaccurate or incomplete data
ask us to delete your data
ask us to restrict or stop processing your data, or object to it
receive your data in a portable format
withdraw your consent at any time, where we rely on consent (this does not affect processing already carried out)
not be subject to decisions based solely on automated processing

To exercise any of these rights, email info@midrockglobal.com with the subject line "Privacy request". We may need to verify your identity before responding. We aim to respond within 30 days.

Complaints. If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the relevant data protection authority. These include the UAE Data Office, the Nigeria Data Protection Commission (NDPC) or, if you are in the UK or EU, your local supervisory authority.

10. Marketing communications

We will only send you insights or updates if you have opted in. Every message includes an unsubscribe link. You can also opt out at any time by emailing info@midrockglobal.com.

11. Third-party websites

The Website may link to other websites, such as LinkedIn or Google Maps. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

12. Children

The Website is intended for business and professional users. It is not directed at anyone under 18, and we do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the "Last updated" date shown at the top.

14. Contact us

Midrock Global

Email: info@midrockglobal.com

UAE: B.C. 1308076, Ajman Free Zone, United Arab Emirates

Nigeria: Suite 3, Group C, Plaza 3, UASPDA, Trade Fair Complex, Badagry Expressway, Lagos, Nigeria