We hold ourselves to the highest standard
We acquire rights, not data. The data always belongs to the company that owns it, and everything we do with it is governed by the data protection law of the country it comes from.
Our commitments
The data stays with its owner
We acquire the rights to use records for agreed purposes. Ownership never changes hands.
No custody
We do not take custody of a company's data. It is used where and how the agreement says, and nowhere else.
De-identified to local law
Personal data is de-identified to the standard of the country it comes from before it is used for anything.
Strict confidentiality
A partner's identity is never shared downstream unless that partner authorises it. Every term is agreed in writing.
The laws we work to
We work to the data protection law of every market we operate in, including:
| MARKET | LAW |
|---|---|
 India | Digital Personal Data Protection Act, 2023 |
 Bahrain | Personal Data Protection Law (Law No. 30 of 2018) |
 Saudi Arabia | Personal Data Protection Law |
 United Arab Emirates | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data |
 Nigeria | Nigeria Data Protection Act, 2023 |
 United Kingdom | UK GDPR and the Data Protection Act 2018 |
Where a partner is based somewhere else, we work to the law that governs them as well.
Our partners
We only work with partners who commit, in writing, to the data protection law that governs the data they work with, including India's Digital Personal Data Protection Act where it applies. We hold them to the same standard we hold ourselves.
Questions
For anything about how we handle data, write to adi@nevarrotech.com.