Privacy Policy

Welcome to Afro Baobab! Your privacy is important to us, and we are committed to protecting your personal information. This Privacy Policy outlines how we collect, use, store, and protect your data when you visit our website, interact with our services, or engage with us on social media.

1. Who We Are

This Privacy Policy explains how AFRO BAOBAB CULTURAL HUB & ART GALLERY L.L.C, a limited liability company registered in mainland Dubai, United Arab Emirates, trading as Afro Baobab Cultural Hub (“Afro Baobab”, “we”, “us” or “our”), collects, uses, and protects personal data through the website [www.afrobaobabhub.com] (the “Website”).

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and other applicable UAE laws.

2. Personal Data We Collect

Data you provide to us:

  • Inquiry and booking request forms — name, email address, phone number, organisation or school name, role, inquiry type, and the content of your message;
  • Scheduling requests — information you provide when booking a call or visit through our embedded scheduling tool (such as name, email, and selected time);
  • Newsletter signup — name and email address;
  • WhatsApp contact — if you contact us via the WhatsApp button on the Website, we receive your phone number, profile name, and message content through WhatsApp.

Data collected automatically:

  • Usage and device data — IP address, browser type, device type, pages visited, time spent, and referral source, collected through cookies and similar technologies;
  • Analytics and advertising data — collected through Google Analytics and advertising pixels operated by Meta, LinkedIn, and Google (see Section 5);
  • Campaign source data — tags (such as UTM parameters) that tell us which campaign or channel brought you to the Website.

3. How We Use Your Personal Data

We use personal data to:

  • Respond to your inquiries and booking requests and manage our relationship with you or your organisation;
  • Schedule and manage calls, visits, and experiences;
  • Send you our newsletter and updates about Afro Baobab, where you have signed up or otherwise consented (you can unsubscribe at any time);
  • Understand how the Website is used and improve its content and performance;
  • Measure and improve the effectiveness of our marketing campaigns;
  • Comply with our legal obligations under UAE law.

4. Legal Bases for Processing

We process personal data on the following bases under the PDPL:

  • Your consent — for example, when you sign up to our newsletter or accept marketing cookies;
  • Performance of a contract or steps prior to a contract — for example, responding to your booking inquiry;
  • Our legitimate interests — for example, operating and securing the Website and understanding aggregate visitor behaviour, where these interests do not override your rights;
  • Compliance with legal obligations under applicable UAE law.

5. Cookies, Analytics, and Advertising Pixels

The Website uses cookies and similar technologies, including:

  • Essential cookies — required for the Website to function;
  • Google Analytics — to understand how visitors use the Website;
  • Advertising pixels — the Meta Pixel, LinkedIn Insight Tag, and Google advertising tags, which help us measure campaigns and show relevant ads to people who have visited the Website.

These tools may set cookies and collect device and usage data as described by their providers. You can manage or disable cookies through your browser settings, and where a cookie banner is provided on the Website, through your cookie preferences. Disabling cookies may affect some Website functionality.

6. Who We Share Personal Data With

We do not sell personal data. We share personal data only with:

  • Service providers who process data on our behalf — including our website platform (Webflow), customer relationship management system (Zoho CRM), scheduling tool (Calendly), email and communication tools, and analytics and advertising platforms (Google, Meta, LinkedIn);
  • Professional advisors — such as lawyers and accountants, where necessary;
  • Public authorities — where required by applicable UAE law or a valid legal request.

Our service providers are only permitted to use personal data to provide services to us and are required to protect it appropriately.

7. International Transfers

Some of our service providers store or process data on servers located outside the United Arab Emirates. Where personal data is transferred outside the UAE, we take steps to ensure it receives an adequate level of protection consistent with the requirements of the PDPL, including through contractual safeguards with our providers.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, in accordance with the storage limitation principle set out in the PDPL. This retention period is determined in particular by reference to the following criteria: the time needed to respond to your enquiry and manage our business relationship; applicable statutory limitation periods in the event of a dispute; and retention periods required under UAE laws, in particular for accounting, tax, or anti-money laundering purposes.

By way of illustration, the table below sets out the retention periods applicable to the main categories of personal data we process:

Data category

Purpose

Retention period

Legal basis

Enquiry / contact form data (name, email, message)

Responding to your enquiry

3 years from last contact, if no business relationship follows

Legitimate interest / consent

Prospect / marketing data (leads not yet customers)

Commercial prospecting

3 years from last contact

Legitimate interest / consent

Customer / contract data (identity, contact details, order history)

Performance of the contract, relationship management

Duration of the contract + 5 years after termination

Statutory limitation period (contractual claims)

Invoicing / accounting data

Legal accounting and tax obligations

10 years from the end of the financial year

Statutory retention obligation (accounting/tax law)

Payment data (excluding full card numbers, which are not stored)

Processing payments

Duration of the transaction + applicable limitation period for payment disputes (generally 13 to 15 months)

Contractual necessity / legal obligation

Cookies and tracking data

Analytics, website functioning, advertising

Maximum 13 months from collection

Consent

Recruitment data (CVs, applications)

Managing job applications

2 years from last contact if unsuccessful, unless the candidate consents to longer retention

Legitimate interest / consent

Complaints / litigation data

Managing disputes

Duration of proceedings + applicable statutory limitation period

Legal claims

Anti-money laundering (AML) checks (if applicable)

Compliance with AML regulations

5 years from the end of the business relationship

Legal obligation

This table is provided for illustrative purposes and reflects the categories of personal data we process; retention periods may be adjusted in accordance with applicable legal or regulatory requirements.

Upon expiry of these periods, your personal data is deleted or irreversibly anonymised, such that it can no longer be used to identify you.

You may, at any time, exercise your right to request access to, rectification, or erasure of your data, as well as restriction of or objection to its processing, under the conditions set out by the PDPL (see Section 9"Your Rights").

Cookies, Analytics, and Advertising Pixels

The Website uses cookies and similar technologies (such as pixels and tags) for the purposes described below. In accordance with the GDPR and applicable ePrivacy legislation, cookies that are not strictly necessary for the Website to function will only be placed on your device after you have given your prior, free, specific, and informed consent via the cookie banner displayed on the Website.

1.⁠ ⁠Essential cookies

These cookies are strictly necessary for the Website to function (e.g. session management, security, load balancing) and cannot be disabled. They are not subject to consent, in accordance with applicable law.

2.⁠ ⁠Analytics cookies

With your consent, we use Google Analytics to understand how visitors use the Website and to improve our services. These cookies are only activated once you have accepted them via the cookie banner.

3.Advertising pixels

With your consent, we use advertising pixels and tags — including the Meta Pixel, the LinkedIn Insight Tag, and Google advertising tags — to measure the performance of our campaigns and to show you relevant advertising based on your visit to the Website. These tools are only activated once you have accepted them via the cookie banner.

Third-party providers and international transfers

These tools are provided by third parties (Google, Meta, and LinkedIn) and may involve the transfer of your data outside the European Economic Area, in particular to the United States. Where such transfers occur, they are carried out on the basis of appropriate safeguards. For further information, please refer to the privacy policies of the relevant providers: Google Privacy Policy, Meta Privacy Policy, LinkedIn Privacy Policy.

Your choices

You can accept, refuse, or customise your cookie preferences at any time via the cookie banner or the "Cookie Preferences" link available on the Website. You may withdraw your consent at any time, as easily as you gave it, with effect for the future. You can also manage or disable cookies through your browser settings. Please note that refusing certain cookies may affect some Website functionality, although core features will remain accessible.

For more information on the specific cookies used, their purpose, and their retention period, please consult our Privacy Policy.

9. Your Rights

Subject to the conditions set out in the PDPL, you have the right to:

  • Request access to the personal data we hold about you;
  • Withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
  • Request correction of inaccurate or incomplete personal data;
  • Request transfer of your personal data in a structured, machine-readable format, where applicable;
  • Request deletion of your personal data;
  • Request restriction of, or object to, certain processing, including processing for direct marketing;

To exercise any of these rights, contact us using the details in Section 13. You also have the right to lodge a complaint with the UAE Data Office if you believe your personal data has been processed in violation of the PDPL.

10. Children

The Website is intended for adults and is not directed at children. We do not knowingly collect personal data from children through the Website. Inquiries and bookings relating to school experiences are submitted by schools, teachers, and parents or guardians — not by children. Any personal data relating to student groups that is shared with us as part of organising a school visit is provided by the responsible institution and is used only to plan and deliver that visit.

11. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date. Significant changes will be communicated on the Website where appropriate.

13. Contact Us

If you have questions about this Privacy Policy or how we handle personal data, contact us at:

Afro Baobab Cultural Hub

Warehouse No. 14, owned by Suhail Rashid Ahmed Bin Drai Al Qubaisi, Bardab, Al Quoz Industrial Area, Dubai, UAE.

Email: [info@afrobaobab.com]