Privacy Policy
Last updated: 18 June 2026.
This Privacy Policy explains how Brainy Oman("Brainy", "we", "us", "our") collects, uses, shares, and protects personal data when you visit Brainy Oman at https://brainy.om(the "Site"). Brainy is the digital growth partner for Omani enterprises, based in Muscat, Oman, working with clients in Oman and internationally.
Brainy Oman is a marketing and portfolio website. It does not offer user accounts or a logged-in application. The data we handle is limited to what is needed to run an informational website and to respond to people who choose to contact us.
We provide this notice at or before the point at which we collect your personal data (for example, on our contact form and through the cookie banner), not only via a footer link, so you have the required information before you decide to share data with us.
Brainy Oman, based in Muscat, Sultanate of Oman.
1. Who we are
Brainy Oman is the trading name of the entity that operates this Site and is the controller responsible for your personal data.
- Trading name: Brainy Oman (brainy.om)
- Location: Muscat, Oman
- Contact for privacy requests: hello@brainy.om
2. The data we collect
As a marketing and portfolio site, we collect a limited set of personal data:
| Category | Examples | Source |
|---|---|---|
| Contact and enquiry data | Name, email address, company, phone, and the message you send through the contact form or by emailing hello@brainy.om | You provide it |
| Communication content | The content of your enquiry and any follow-up correspondence | You provide it |
| Usage and device data | Pages viewed, referring page, approximate location, IP address, browser type, device type | Collected automatically |
| Server log data | IP address, request timestamps, user agent, requested URLs, error events | Collected automatically by our hosting and CDN providers |
| Cookie and similar-technology data | Preference and (if enabled) analytics identifiers, as described in our Cookie Policy | Collected via your device, with consent where required |
We do not operate user accounts on this Site, and we do not knowingly collect special category data (such as health, biometric, religious, or similar data). Please do not send us this kind of data through the contact form.
3. How and why we use your data
We use your data for the purposes below. The "legal basis" column applies to visitors in the EEA or the UK whose data is protected by the GDPR or UK GDPR.
| Purpose | Personal data used | Legal basis (where GDPR / UK GDPR applies) |
|---|---|---|
| Respond to your enquiry and discuss a possible engagement | Contact and communication data | Steps taken at your request before entering a contract; legitimate interests in responding to enquiries |
| Operate, maintain, and secure the Site | Usage, device, and server log data | Legitimate interests in running a safe, reliable website |
| Detect and prevent fraud, abuse, and technical attacks | Server log and usage data | Legitimate interests in protecting the Site |
| Remember your preferences (such as theme or language) | Cookie and preference data | Consent (where required) |
| Measure how the Site is used so we can improve it | Analytics data | Consent (where required); legitimate interests |
| Meet legal, accounting, and record-keeping obligations | Contact and correspondence data | Legal obligation |
Where we rely on consent (for example, non-essential cookies), you can withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it.
For Oman PDPL purposes, our processing of your personal data is based on your consent where required and on the other lawful grounds recognized under the Personal Data Protection Law (Royal Decree No. 6/2022), including where processing is necessary to respond to your request or to comply with a legal obligation.
4. Cookies and tracking
We use a small number of cookies and similar technologies to run the Site, remember your preferences, and (with consent where required) measure usage. We load non-essential cookies only after you consent, and you can change your choices at any time through our cookie banner or the "Manage cookies" link in the footer.
For the full list of cookies, their purposes, and durations, see our Cookie Policy.
5. Who we share data with
We do not sell your personal data. We share it only with service providers that process it on our behalf to run the Site, and only as needed. These typically include a website hosting provider, a content delivery and security (CDN) provider, and an email provider that receives and routes contact-form and email enquiries. If and when we enable website analytics, an analytics provider would be added to this list, and our Cookie Policy would be updated to reflect it.
We may also disclose data when required by law, to respond to a lawful request from a competent authority (including the Ministry of Transport, Communications and Information Technology in Oman), to protect our rights, or in connection with a business transfer.
6. International data transfers
Brainy operates from Oman and works with international clients, and some of our service providers may store or process data outside Oman (for example, in the regions where their infrastructure is located). When personal data is transferred from Oman to another country, we take steps to ensure it remains protected, consistent with the cross-border transfer requirements of the Oman Personal Data Protection Law (Royal Decree No. 6/2022).
When we transfer personal data of EEA or UK visitors outside the EEA or the UK, we rely on an appropriate safeguard, such as the European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement or Addendum, an adequacy decision, or, where the recipient is certified, the EU-U.S. Data Privacy Framework and its UK extension. You can request information about the safeguard we rely on by emailing hello@brainy.om.
7. How long we keep data
We keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires.
- Contact-form and enquiry correspondence: kept while we are in active discussion with you and for a reasonable period afterward, then deleted or anonymized, unless we are required to keep it longer for legal or accounting reasons.
- Server logs: kept for a limited window for security and troubleshooting, then deleted or anonymized.
- Cookie and preference data: kept for the duration set out in our Cookie Policy.
We can provide the specific retention period for a given category on request.
8. How we protect your data
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, the principle of least privilege, and due diligence on the providers we use. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond quickly if something goes wrong.
9. Your rights
Which rights apply to you depends on where you are located and which law protects your data. The sections below set out your rights under the Oman Personal Data Protection Law and under the GDPR and UK GDPR. If more than one framework applies to you, you may rely on whichever gives you the stronger protection. To exercise any right, email hello@brainy.om. We may need to verify your identity before we act.
Your rights under the Oman Personal Data Protection Law (PDPL)
If your personal data is processed in connection with Oman, the Personal Data Protection Law (Royal Decree No. 6/2022, overseen by the Ministry of Transport, Communications and Information Technology) gives you rights in relation to your personal data, including the right to:
- Be informed about how your personal data is processed.
- Access your personal data that we hold.
- Request correction of inaccurate or incomplete personal data.
- Request that we stop processing, or delete, your personal data in the circumstances allowed by the law.
- Withdraw consent you previously gave, where our processing relies on consent.
- Transfer your personal data in the circumstances provided by the law.
- Object to processing that causes you harm, in the circumstances provided by the law.
You also have the right to raise a concern with the Ministry of Transport, Communications and Information Technology (MTCIT), the authority that oversees the Personal Data Protection Law in Oman.
Your rights under the GDPR and UK GDPR
If you are in the EEA or the UK, you have the right to:
- Access a copy of your personal data.
- Rectify inaccurate or incomplete data.
- Erase your data (the right to be forgotten) where it applies.
- Restrict processing in certain circumstances.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Port your data to another service in a structured, machine-readable format.
- Withdraw consent at any time where we rely on consent, without affecting prior lawful processing.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out this kind of automated decision-making on this Site.
- Lodge a complaintwith your local supervisory authority. UK visitors may contact the Information Commissioner's Office (ICO), and EEA visitors may contact the supervisory authority in their country.
We aim to respond to rights requests within the time the applicable law allows (under the GDPR and UK GDPR, generally within one month).
Global Privacy Control (GPC)
We honor the Global Privacy Control (GPC) browser signal. If your browser or extension sends GPC, we treat it as a request to opt out of non-essential (analytics and marketing) cookies and as a request not to sell or share your personal information, for the browser or device that sends it.
10. Children's privacy
The Site is a business-to-business marketing site and is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact hello@brainy.om and we will delete it. The minimum age to use this Site is 18.
11. Automated decision-making
We do not use solely automated decision-making that produces legal or similarly significant effects on you. If this changes, we will update this policy, explain the logic involved, and tell you how to request human review.
12. Data breaches
If a personal data breach occurs, we will assess it and, where the law requires, notify the relevant authority and affected individuals within the applicable timeframes. This includes the notification obligations under the Oman Personal Data Protection Law and, for affected EEA or UK visitors, the notification obligations under the GDPR and UK GDPR. We maintain an internal process to detect, investigate, and respond to incidents.
13. Changes to this policy
We may update this policy from time to time. When we do, we will change the "Last updated" date above. If the changes are material, we will give you notice through the Site or by another appropriate means before they take effect. Please review this policy periodically.
14. Contact us
Questions or requests about this policy or your data:
- Brainy Oman
- Muscat, Oman
- hello@brainy.om
Brainy Oman, based in Muscat, Sultanate of Oman.
A framework note: which privacy framework applies depends on your location. The Oman PDPL applies to processing connected with Oman, while the GDPR or UK GDPR applies to visitors in the EEA or the UK. Where more than one applies, the stronger protection governs.