Privacy Policy

Hasnihl Capital Limited is the data controller responsible for your personal data. We are a mineral intelligence and investment advisory firm incorporated in Kenya, with operational offices in Nairobi (Kenya), Johannesburg (South Africa), and Dubai (United Arab Emirates).

For any question or request relating to your personal data, contact our Privacy Contact at the email above. We respond to all data-related communications within 14 calendar days.

We collect personal data only where necessary and proportionate to the purpose for which it is used. The categories of data we may collect are set out below.

2.1 Data you provide directly

2.2 Data we collect automatically

2.3 Data we receive from third parties

We may receive publicly available professional data (such as LinkedIn profile information) where you interact with us through professional networks, or verification data from our legal and compliance partners as part of KYC/AML procedures required for formal engagements.

We process your personal data only where we have a lawful basis to do so. The table below sets out each purpose, the data categories involved, and our legal basis.

4.1 Our confidentiality commitment

All personal data and business information shared with Hasnihl Capital is treated as strictly confidential. We do not sell, rent, or trade personal data to third parties. Limited service-provider disclosures are described below.

4.2 When we share data

We share personal data only in the following limited circumstances:

• Service delivery partners - vetted legal, assay, logistics, and financial partners engaged to deliver a specific transaction or service. Each partner operates under a contractual confidentiality obligation and processes your data only as necessary to deliver the service.
• Email delivery - contact-form enquiries are processed by Zoho ZeptoMail to deliver them to our team. The information submitted in the form is shared with this provider for that purpose.
• Professional advisors - our lawyers, accountants, or auditors where disclosure is necessary for professional advice or audit purposes. These parties are bound by professional confidentiality obligations.
• Regulatory and legal requirements - where we are required by law, court order, or competent authority to disclose data. This includes AML/KYC reporting obligations under applicable financial crime legislation in Kenya, South Africa, and the UAE.
• Business transfers - if Hasnihl Capital undergoes a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before any such transfer and prior to your data becoming subject to a different privacy policy.

Hasnihl Capital operates from Kenya, South Africa, and the UAE, and our partners are located across Africa, the Gulf, and Europe. Personal data may therefore be transferred to and processed in countries outside your country of residence.

Where we transfer data outside the European Economic Area (EEA) or outside jurisdictions with adequacy decisions, we apply one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Contractual data protection obligations equivalent to EEA standards
• Transfer only to countries recognised as providing adequate protection

You may request a copy of the safeguards applied to your specific data transfer by contacting info@hasnihlcapitals.com.

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

On expiry of the applicable retention period, data is securely deleted or anonymised so that it can no longer be associated with an individual.

Depending on your jurisdiction, you have rights in relation to your personal data. We honour these rights regardless of where you are located.

To exercise any right, email info@hasnihlcapitals.com with the subject line "Data Rights Request" and describe the right you wish to exercise. We will respond within 30 days and will not charge a fee unless the request is manifestly unfounded or excessive.

If you are in the UK or EEA and are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority. In Kenya, complaints may be directed to the Office of the Data Protection Commissioner.

8.1 What cookies we use

8.2 Managing cookies

You may control or disable cookies, including analytics cookies, through your browser settings. Rejecting analytics cookies will not affect your ability to use the site. Note that rejecting essential cookies may impair site functionality.

8.3 Third-party cookies

If you interact with embedded content (such as a video or map), third-party cookies may be set by those providers under their own privacy policies. We do not control those cookies and recommend reviewing the relevant third-party privacy policy.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• TLS encryption for all data in transit (HTTPS)
• Encrypted storage for personal data at rest
• Access controls limiting data access to authorised personnel only
• Regular internal security reviews and staff data protection training
• Contractual security obligations on all data processors and partners

No transmission over the internet is entirely secure. While we do everything reasonably possible to protect your data, we cannot guarantee the absolute security of data transmitted to our website. Any transmission is at your own risk.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where we rely on legitimate interests as our lawful basis, we have balanced our interests against your rights and freedoms and determined that our interests do not override your fundamental rights. You may object to processing on the basis of legitimate interests at any time (see Section 7 - Right to Object).

Where we rely on consent, you may withdraw that consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, email info@hasnihlcapitals.com or use the unsubscribe link in any marketing email.

Our website may contain links to third-party websites, including our partner organisations. This Privacy Policy applies only to our website. We are not responsible for the privacy practices of third-party sites and recommend you review their privacy policies before submitting personal data to them.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. Where we make material changes, we will notify you by email (if we hold your email address) and by posting a prominent notice on our website at least 14 days before the change takes effect.

The "Last updated" date at the top of this page shows when this Policy was most recently revised. Your continued use of our website or services after any change constitutes acceptance of the updated Policy.

This Privacy Policy is governed by and interpreted in accordance with the laws of Kenya, including the Kenya Data Protection Act 2019. We also comply with the EU General Data Protection Regulation (GDPR)for data subjects located in the European Economic Area, and with the POPIA (Protection of Personal Information Act 2013) for data subjects in South Africa.

Any dispute arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Nairobi, Kenya, unless you are located in the EU or South Africa, in which case you retain the right to bring proceedings before your local competent authority.