Privacy Policy

Who We Are

Crestmont International Group (“Crestmont International“, “we“, “us“, or “our“) is a leading investment advisory and asset management group focused on unlocking capital for sustainable growth in underserved markets across Africa and emerging economies. We operate through a group of affiliated entities including Crestmont Energy, Crestmont Real Estate, Crestmont Access, and the Fund for Nature.

For the purposes of applicable data protection law, Crestmont International Group is the data controller responsible for the personal data collected through this website (crestmontinternational.com) and through our direct client and business relationships.

Our registered offices are located in Nairobi (Kenya), Lagos (Nigeria), London (United Kingdom), and Washington DC (United States). Where different data protection regimes apply to our operations in different jurisdictions, we comply with the applicable law in each territory.

Data We Collect

We collect personal data in a number of ways — directly from you when you provide it to us, automatically through your use of our website and digital services, and occasionally from third parties where permitted by law.

Data You Provide Directly

• Contact and enquiry data: your name, email address, telephone number, company name, job title, and the content of any message or enquiry you send us via our contact forms, email, or telephone.
• Investment and client onboarding data: financial information, identification documents, source of funds information, investment objectives, risk appetite, and other information required to establish and manage an investment relationship with you.
• Career and recruitment data: your CV or résumé, cover letter, professional history, qualifications, references, and any other information you provide in connection with a job application through our Apply Now page.
• Newsletter and communications data: your name and email address if you subscribe to our research publications, insights, or event communications.
• Event registration data: information provided when registering for Crestmont International events, webinars, or roundtables.

Data Collected Automatically

• Technical data: your IP address, browser type and version, operating system, referral source, pages visited, time spent on pages, and other standard web analytics data collected when you visit our website.
• Cookie data: information placed on your device via cookies and similar tracking technologies as described in Section 9 of this Policy.
• Device data: the type of device you use to access our website, screen resolution, and related device identifiers.

Data from Third Parties

• Business contact data: professional contact information obtained from publicly available sources, industry databases, or professional networks such as LinkedIn, in connection with our legitimate business development activities.
• Due diligence and compliance data: information obtained from sanctions screening databases, credit reference agencies, regulatory registers, and other authorised sources as part of our anti-money laundering (AML) and know-your-customer (KYC) obligations.
• Referral data: if you are introduced to us by an existing client, partner, or intermediary, we may receive basic contact information about you from that party.

Special Categories of Personal Data

We do not routinely collect or process special categories of personal data (including information about racial or ethnic origin, political opinions, religious beliefs, health, or biometric data) unless this is strictly necessary — for example, in the context of equal opportunities monitoring in our recruitment process, where we will always obtain your explicit consent and clearly identify the purpose for collection.

How We Use Your Data

We use personal data only for the purposes set out below. We do not sell, rent, or otherwise commercially exploit your personal data to third parties for their own marketing purposes.

Purpose	Description	Legal Basis
Responding to enquiries	Processing and responding to messages, meeting requests, and general enquiries submitted via our website or by email or telephone.	Legitimate interests; pre-contractual steps
Client services	Providing investment advisory, asset management, and related services to existing and prospective clients under our engagement agreements.	Performance of contract; legal obligation
Regulatory compliance	Conducting AML, KYC, sanctions screening, and other regulatory compliance checks required under applicable financial services law.	Legal obligation
Recruitment	Reviewing job applications, communicating with candidates, conducting interviews and background checks, and managing our talent pipeline.	Pre-contractual steps; legitimate interests; consent
Research & insights distribution	Sending our publications, market research, thought leadership articles, and event invitations to subscribers who have opted in to receive them.	Consent; legitimate interests
Business development	Maintaining professional relationships, attending industry events, and conducting outreach to potential clients, partners, and co-investors.	Legitimate interests
Website operation & analytics	Operating, maintaining, securing, and improving our website; analysing usage patterns to enhance user experience.	Legitimate interests; consent (where required)
Legal proceedings	Establishing, exercising, or defending legal claims, and complying with court orders, regulatory requests, or legal processes.	Legal obligation; legitimate interests

Legal Basis for Processing

Where applicable data protection law requires us to identify a legal basis for processing your personal data, we rely on the following:

• Performance of a contract: processing is necessary to perform a contract with you or to take pre-contractual steps at your request — for example, responding to an enquiry or providing advisory services under an engagement letter.
• Legal obligation: processing is necessary for us to comply with a legal or regulatory obligation, including AML and KYC requirements under financial services regulation, tax reporting obligations, and regulatory reporting to relevant authorities.
• Legitimate interests: processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include operating and improving our business, maintaining professional relationships, conducting business development activities, and protecting our legal rights. Where we rely on legitimate interests, we have conducted a balancing test and determined that those interests are not outweighed by your privacy rights.
• Consent: in certain circumstances — including some marketing communications and non-essential cookies — we will ask for your explicit consent before processing your data. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.
• Vital interests or public task: in rare circumstances where processing is necessary to protect your vital interests or to perform a task in the public interest.

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with a formal data protection framework (including Kenya under the Data Protection Act 2019, and Nigeria under the Nigeria Data Protection Act 2023), our processing is conducted in compliance with the applicable requirements of that framework.

Sharing Your Data

We do not sell or rent your personal data. We share it only in the limited circumstances described below, and only to the extent necessary for the stated purpose.

Within the Crestmont International Group

We may share your personal data between our affiliated entities — including our offices in Nairobi, Lagos, London, and Washington DC, and our operating platforms (Crestmont Energy, Crestmont Real Estate, Crestmont Access, and Fund for Nature) — where necessary to provide our services, manage our client relationships, or fulfil regulatory obligations. All entities within the group are bound by this Privacy Policy and our internal data governance standards.

Service Providers and Professional Advisors

We engage third-party service providers who process personal data on our behalf as data processors. These include:

• Technology providers: cloud hosting, website infrastructure, email delivery, and CRM platform providers.
• Professional advisors: lawyers, accountants, auditors, and compliance consultants who provide services to Crestmont International under confidentiality obligations.
• Due diligence and compliance providers: sanctions screening, identity verification, and credit reference agencies used to fulfil our AML and KYC obligations.
• Recruitment platforms: applicant tracking systems and background screening providers used in connection with our hiring process.
• Analytics and marketing technology: providers of web analytics and communications platforms used in accordance with this Privacy Policy and applicable consent requirements.

All service providers are subject to contractual data processing agreements that require them to process personal data only on our instructions and in accordance with applicable data protection law.

Co-Investors, Counterparties, and Business Partners

In the context of specific transactions, we may share relevant personal data (including identification and verification information) with co-investors, DFI partners, lenders, counterparties, and their professional advisors. This sharing is limited to what is strictly necessary for the transaction and is conducted subject to appropriate confidentiality and data protection protections.

Regulatory Authorities and Law Enforcement

We may disclose personal data to regulators, government authorities, law enforcement agencies, or courts where required to do so by applicable law, regulation, or court order, or where we reasonably believe disclosure is necessary to protect the rights or safety of Crestmont International, our clients, or any other person.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data may be transferred to the relevant counterparty as part of that transaction. We will notify you if such a transfer materially affects the processing of your personal data.

International Transfers of Personal Data

Crestmont International operates across multiple jurisdictions. As a result, your personal data may be transferred to, stored in, or processed in countries outside your country of residence — including Kenya, Nigeria, the United Kingdom, the United States, and other countries in which our service providers operate.

Where we transfer personal data from the European Economic Area (EEA) or the United Kingdom to countries that have not been granted an adequacy decision by the relevant authority, we rely on appropriate safeguards to protect your data, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner’s Office, as applicable.
• Binding Corporate Rules or equivalent intra-group transfer mechanisms where applicable.
• Other lawful transfer mechanisms permitted under applicable data protection law, including derogations for specific situations such as the performance of a contract in your interests or the exercise or defence of legal claims.

Where transfers involve data subject to the Kenya Data Protection Act 2019 or the Nigeria Data Protection Act 2023, we comply with the cross-border transfer requirements established under those instruments, including the use of appropriate contractual safeguards and, where required, notification to or authorisation from the relevant Data Protection Authority.

Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to resolve any disputes or enforce our agreements. The specific retention period depends on the type of data and the purpose for which it was collected.

Category of Data	Retention Period	Basis
Client and investor records	Duration of the relationship plus 7 years from the end of the engagement	Legal obligation (financial services regulation, AML)
AML / KYC compliance records	Minimum 5 years from the end of the business relationship, or as required by applicable jurisdiction	Legal obligation
Enquiry and contact form data	2 years from the date of last contact, unless a client relationship develops	Legitimate interests
Recruitment and application data	12 months from the conclusion of the recruitment process for unsuccessful candidates; duration of employment plus 7 years for successful candidates	Legitimate interests; legal obligation
Marketing and newsletter subscriber data	Until you unsubscribe or withdraw consent, plus 1 year	Consent
Website analytics data	26 months (standard analytics platform retention period)	Legitimate interests; consent
Legal and contractual records	Duration of the relevant contract plus the applicable statutory limitation period (typically 6–7 years)	Legal obligation; legitimate interests

At the end of the applicable retention period, personal data is securely deleted or anonymised, unless we are required by law to retain it for longer, or unless deletion would prejudice ongoing legal proceedings or regulatory investigations.

Your Data Protection Rights

Subject to the requirements and limitations of applicable data protection law, you have the following rights in relation to your personal data. These rights apply whether you are located in the United Kingdom, the European Economic Area, Kenya, Nigeria, or another jurisdiction with applicable data protection legislation.

To exercise any of these rights, please contact us using the details set out in Section 10. We will respond within the applicable statutory timeframe (typically 30 days, extendable by a further 60 days in complex cases) and will not charge a fee for reasonable requests. We may ask you to verify your identity before processing your request.

Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to provide essential functionality, analyse website performance, and — where you have given consent — to support marketing and personalisation activities. A cookie is a small text file placed on your device when you visit a website.

Types of Cookies We Use

Cookie Type	Purpose	Consent Required?
Strictly necessary	Essential for the website to function — enabling navigation, form submission, and security features. These cookies cannot be disabled without affecting core website functionality.	No — these are necessary for the site to operate
Functional	Remember your preferences and settings (such as language or region selection) to improve your experience on return visits.	Yes — consent required
Analytics	Collect aggregate, anonymised data about how visitors use our website — including pages visited, time on site, and referral sources — to help us understand and improve our website performance.	Yes — consent required
Marketing	Track your browsing activity across websites to enable us or our partners to serve relevant advertising or content. We do not use these cookies to sell your data to third-party advertisers.	Yes — explicit consent required

Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept all cookies, reject non-essential cookies, or customise your preferences by category. You can change your cookie preferences at any time by accessing the cookie settings tool in our website footer.

You can also manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, and set preferences for specific websites. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit www.aboutcookies.org or your browser’s help documentation.

Third-Party Analytics

We use third-party analytics services — including Google Analytics — to help us understand website usage. These services use cookies to collect information in aggregate, anonymised form. Google Analytics data is processed in accordance with Google’s privacy policy and our data processing agreement with Google. You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

Contact Us & How to Complain

Data Protection Contact

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we process your personal data, please contact us:

• By website: crestmontinternational.com/contact-us
• By post — Nairobi (East Africa): Crestmont International Group, Upper Hill, Nairobi, Kenya
• By post — London (Europe): Crestmont International Group, Mayfair, London, United Kingdom
• By post — Washington DC (Americas): Crestmont International Group, Pennsylvania Avenue NW, Washington DC, USA

We aim to respond to all privacy-related enquiries within 5 business days of receipt, and to fulfil data subject rights requests within the applicable statutory timeframe.

Your Right to Complain to a Supervisory Authority

If you are not satisfied with our response to a privacy concern, or believe that we are processing your personal data in a manner that does not comply with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. The primary supervisory authorities relevant to our operations include:

• United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk
• European Union: The data protection supervisory authority in your EU member state of residence or the lead supervisory authority where applicable.
• Kenya: Office of the Data Protection Commissioner (ODPC) — odpc.go.ke
• Nigeria: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
• United States: Relevant federal or state consumer protection authorities, as applicable.

We ask that you contact us directly in the first instance so that we have the opportunity to address your concerns before escalating to a supervisory authority, but we fully support your right to contact these bodies at any time.

Updates to This Privacy Policy

We review and update this Privacy Policy periodically to reflect changes in our business operations, legal requirements, or data processing activities. When we make material changes, we will notify you through our website or — where we hold your contact details — by direct communication. The most current version of this Privacy Policy is always available at crestmontinternational.com/conflict-of-interest and this page.