Privacy

Who is responsible for your data

This site is operated by Nabay Information Technology and Media LLC, trading as The Media Agent, a company registered in the Sultanate of Oman, commercial registration number 1497161, registered office Murtafaat Qurum, Bousher, Muscat 117, Sultanate of Oman. Nabay Information Technology and Media LLC decides why your information is collected and what is done with it, which makes it the controller of it and the one answerable for it. Anything in this notice — including a request about your own data — can go to social@themediagent.com.

What we collect, and where it comes from

From you, when you submit a form. Your name, and whichever of a phone number and an email address you choose to give us; optionally your business name, your sector, a link to your website or social profile, and whatever you write in the message. Those two contact fields are the only ones where one of the two is required — everything else is yours to leave blank.

From you, when you apply to work with us. Your name and email address, and optionally a phone number, where you are based, what you do, how you would like to work with us, a link to your work, a CV or portfolio file, and your message.

From you, when you use the site assistant. The messages you type are sent to our AI provider to produce the replies. If the conversation ends with you asking us to get in touch, the conversation is saved with your enquiry; if it does not, we do not keep it.

Automatically, alongside a submission. The page you submitted from, the site that referred you, the campaign parameters in the link if there were any, and your browser’s user-agent string. This is how we know which of our own campaigns brought you here.

When you only read the site. Our server writes ordinary request logs, including your IP address. When you submit a form or message the assistant, your IP address is also held in the server’s memory for an hour so that one source cannot flood our forms; that record is never written to our database. Which measurement and advertising tags can run, and what decides it, is under Cookies and tags below.

Two things do not fit a neat legal label, and we would rather say so than stretch a word. Those request logs and that one-hour anti-flood record are not something you chose; we do it to keep the site up and to stop it being abused, we could not run it otherwise, and it is the minimum that does the job. Omani law does not offer a “legitimate interest” basis the way European law does, so we rely on the security duty the law places on us, we keep these records for the shortest period that is useful, and we never use them for marketing or to build a profile of you.

What no form here asks for. No form on this site asks for payment card details, bank account numbers, government ID numbers, your date of birth, or anything about your health, religion, politics or background. Please do not send them. The one place something like that can reach us by accident is a CV, which is why the application form asks you to leave it out — and if it arrives anyway we will not use it in any decision about you, we will not copy it anywhere, and we will either strip it from the file or delete the file and ask you for a plainer version.

Where all of this comes from. Everything we hold about you came from you: you typed it into a form, the assistant or a comment box, or your browser sent it along with what you typed. We do not buy lists, we do not scrape contact details, we do not enrich what you gave us from any outside database, and nobody passes us your details on your behalf. If we ever hold something about you that did not come from you, you can ask us where we got it and we will tell you.

The purpose and nature of the processing

We process the above to reply to you, to prepare the audit, proposal or quotation you asked for, to keep a record of the enquiry so a colleague can pick it up if the person you spoke to is away, to measure which of our own marketing actually works, and — if you applied to work with us — to consider you for a role or a collaboration.

We rely on your consent, given when you choose to submit the form, and on our legitimate interest in running and securing this site. We do not sell your details, we do not share them with other advertisers, and we do not add you to a mailing list because you filled in a contact form. Nothing here is subject to an automated decision that has a legal or similarly significant effect on you.

You can withdraw consent at any time — see Your rights below. Withdrawing it stops future processing; it does not undo what was lawful before.

Who else sees it

A small number of service providers, each only for its own part of the job. Named, because a provider you cannot name is a provider you cannot check.

• Anthropic — the provider of the AI model behind the chat assistant. What you type into the assistant is sent to Anthropic so a reply can be generated. We do not send Anthropic our enquiry database, our client list, or anything you did not type into that window.
• Hetzner Online GmbH — this website, its database and any file you upload run on a server we rent from Hetzner, in Nuremberg, Germany.
• Google — every enquiry and application is emailed to our own team mailbox so it is seen and answered quickly, and that email contains everything you wrote, your message in full included. Our mail runs on Google Workspace, so Google delivers and stores it. Each new enquiry is also sent automatically, in full, to a Google Apps Script that writes it into the tracker we use to make sure nothing is missed — so Google holds it twice, once as mail and once as a row.
• The measurement and advertising services described under Cookies and tags — and only the ones you have agreed to.

Nobody else sees your personal data, unless you ask us to involve somebody or the law requires it of us. Two routine things do leave our server and carry nothing about you: when we publish a page we tell the search engines its address, and the Journal’s research reads public news feeds.

Inside The Media Agent, enquiries are visible to the people who work on new business and delivery. An application, and any file attached to it, is visible only to the people who hire. Comment email addresses are visible only to signed-in staff.

Where your data goes. Our hosting, our email and the automation that logs your enquiry all run on services outside Oman — the server is in Germany, and our mail and the tracker run on Google. The chat assistant sends what you type to Anthropic in the United States. If you agree to the measurement tags, those services are outside Oman too.

For the services we need in order to operate at all — hosting, email and the automation — we rely on the written data-protection terms each provider gives us, which commit them to protect your data to a standard no lower than the law here requires. You can ask us for a copy of those terms and we will send them. For the chat assistant and the optional measurement tags we rely on your consent, which you give by choosing to use the assistant or by accepting the tags in the banner; you can withdraw it at any time by not using the assistant, or by changing your answer under Cookie choices in the footer. And when you send us a form, the line under the submit button tells you your details go abroad to be hosted and answered, and sending the form is your agreement to that.

One honest limit, and we would rather you heard it here: we cannot un-host what is already stored. Withdrawing consent means we stop using your information and delete it on the schedule below, or sooner if you ask — it does not retrospectively unwind the fact that it sat on a server while we were answering you.

Data from Meta platforms (our internal tools)

Separately from this website, we run internal software that connects to Meta’s platforms (Facebook, Instagram and Meta Ads) through Meta’s official APIs. It is used only by our own team, to manage the advertising and social media accounts that our clients have given us access to through Meta Business Manager.

What it accesses. Advertising data for those accounts — campaigns, ad sets, ads, budgets, performance reports and creative — and, where a client has asked us to manage them, their Facebook Page and Instagram posts, comments and messages, their product catalogues, and the leads submitted through their Meta lead forms.

Why. Only to set up, run, measure and report on our clients’ advertising and social media, as agreed with each client. We do not sell this data, we do not use it to build profiles of individuals, we do not use it to advertise our own services, and we do not combine it with data from outside Meta.

Who sees it. The members of our team who work on that client’s account, the client, and the service providers that run our tools for us (for example our social inbox tool), under written data-protection terms. It is protected the same way as everything else described above.

How long we keep it. For as long as the client keeps us on the account. Leads are delivered to the client; any copy we keep for them (for example a lead sheet we manage on their behalf) is deleted with the rest of their data when the client removes our access or asks us to, normally within 30 days.

Deleting your data. If you are a person whose data reached us this way — for example by submitting a lead form or messaging a client’s page — write to social@themediagent.com with the subject “Meta data deletion” and the page or account it concerns. We will delete what we hold and confirm by email, normally within 30 days. You can also remove our access at any time from your own Facebook settings, under Apps and Websites.

How long we keep it

• An enquiry that does not become a project — two years from the last time we spoke, then deleted.
• Records of work we actually did for you — as long as Omani commercial and tax rules require.
• An application, and any file attached to it — twelve months, then deleted, unless you join us or ask us to keep it on file.
• An approved comment and its likes — for as long as the post it sits under is published. A comment is published writing, and deleting it on a timer mutilates the thread.
• A Journal subscription after you unsubscribe — we keep the address on a do-not-send list rather than deleting it, because a deleted address is added back by the next sign-up form and starts receiving email again.
• Server logs — fourteen days, then rotated out. That is what the server is configured to do, not an intention.
• The anti-flood record of your IP address — one hour, in memory, never written to our database.
• Data from Meta platforms — as described in the section above.

Omani law requires us to erase personal data once the purpose it was collected for has been fulfilled, and we do.

How we protect it

The site is served only over HTTPS — a request on plain HTTP is redirected, not answered, and browsers are additionally told for a year to reach us over HTTPS only. We also set headers that stop our pages being framed by another site, stop browsers guessing a file’s type, limit what we pass on in a referrer, and switch off camera, microphone and location access for our own pages.

The database is not reachable from the public internet. It listens on the server itself, and the firewall admits nothing but web traffic and our own administrative access.

Getting at an enquiry requires a named staff account with a role that permits it; a signed-in session lasts thirty days, and five failed sign-in attempts lock the account for ten minutes. A CV or portfolio you attach is stored outside the public part of the site and can only be opened by a signed-in member of staff, never by guessing a web address. Comment email addresses are withheld from the site’s own public interfaces, not just hidden on the page. The forms turn away submissions that look automated instead of making you prove you are a human.

If a breach affects your data, Omani law requires us to tell the Ministry within 72 hours of becoming aware of it where the breach puts people’s rights at risk, and to tell you where it is likely to cause you serious harm or is otherwise high risk. We will do both, and we will tell you what happened and what we did about it rather than the shortest thing we can get away with.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete it;
• send it to you in a portable form; or
• stop processing it, by withdrawing your consent.

Write to social@themediagent.com and we will act on it and confirm once it is done — within 45 days at the very outside, and normally within a few working days. We will not ask you to justify the request.

Cookies and tags

There is no separate cookie page; this is the section.

What this site sets itself. None of it leaves our own domain. A random identifier your browser keeps, so a like button knows it was you who pressed it and a double press does not count twice — created only when you press like or leave a comment, never just for reading. The name and email you last commented with, so your second comment is one tap instead of a form; nothing in the page can read it. Your answer to the cookie banner, so we do not ask again and nothing loads that you said no to. A note that you closed the announcement bar. A signed value inside each form that proves it was loaded in a browser rather than posted by a script, which is how we avoid putting a CAPTCHA in your way. And, for our own staff, sign-in and preview cookies.

Measurement and advertising. These are optional, they are off until you say otherwise, and the site works exactly the same if you decline. We ask through a banner on your first visit, and you can change your mind at any time using Cookie choices in the footer. The banner offers two groups and names the services that are live at the moment you are asked.

How the site is used can load Google Analytics, which measures visits in aggregate, and Microsoft Clarity, which is different and you should know what it does: Clarity records individual sessions — where your pointer moved, what you clicked, how far you scrolled and what was on the page — so that we can watch back where a page confused somebody. It is a recording of your visit, not a count of it.

Which advert brought you here is the group that can follow you to other websites. It can load Google Tag Manager, the Meta pixel, the LinkedIn insight tag, the TikTok pixel and the Snap pixel, and it is also what allows us to remember which advert your visit started from.

Three facts about how the banner behaves, because they are the difference between a choice and a formality. Nothing in either optional group loads before you answer. Google’s consent signals are sent as denied on every page before any Google tag runs, whatever you answered previously, and only then updated to what you chose. And closing the banner is not consent: there is no X, and the “only what is needed” button is the same size and weight as “accept all”.

You can also block or clear cookies in your browser whenever you like, and nothing on this site stops working if you do.

A note on the law here. Oman’s Personal Data Protection Law has no cookie-specific rule. The banner exists because the European and United Kingdom rules on storing information on your device require it, and because your consent is what allows the measurement under Omani law too. We would rather run one banner for everybody than two different sites.

Children

This is a business-to-business site and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us something, tell us and we will delete it.

If you are in the European Union or the United Kingdom

We do not market this site to the European Union or the United Kingdom. We run no EU or UK campaigns, we price in Omani rials, and our pages are written for a Gulf audience. The European paragraphs in this notice are here because a reader in the EU or the UK may still find us and should know where they stand, not because we target that market.

For that reason we have not appointed a representative in the Union under Article 27. If that changes, we will appoint one and name them here before the first campaign runs.

Complaints

If you are unhappy with how we have handled your data, write to us first — we would rather fix it than read about it.

You can also go to a regulator:

• Oman — the Ministry of Transport, Communications and Information Technology, which oversees personal data protection under Royal Decree 6/2022.
• European Union or United Kingdom — your own national data protection authority; in the UK, the Information Commissioner’s Office.
• United Arab Emirates — the federal regulator is the UAE Data Office, though in practice enquiries currently go to the TDRA while the Data Office is still being stood up.

Wherever you are, you may bring a data protection complaint to the regulator or the courts where you live. Nothing in our terms of use sends you somewhere else for that.

Changes

If this notice changes in a way that matters, the date at the top changes with it. If a change affects something you have already agreed to, we will ask you again rather than assume. If you want to know what an earlier version said, ask us and we will send you a copy. This version is dated November 2026.