Privacy Policy

1. Who we are

This website, nicholas.design, is operated by nicholas, an international architecture and design studio headquartered in the Kingdom of Bahrain ("nicholas.design", "we", "us" or "our"). We are the data controller responsible for the personal data described in this policy. Where personal data is processed by our Indian operations, the controller is nicholas India Private Limited, a subsidiary of nicholas WLL. Full details for each region are set out in section 15.

Our details:

• Entity: nicholas WLL
• Commercial Registration: 173775-1
• Registered address: Office 2016, Level 19, East Tower, Bahrain World Trade Center, Isa Al-Kabeer Avenue, Manama 316, Kingdom of Bahrain
• Email: hello@nicholas.design
• Royal Institute of British Architects (RIBA) Chartered Practice number:  20058118

2. Scope

This policy applies to personal data we collect through www.nicholas.design, our contact forms, and the email addresses published on this site. It does not apply to third-party websites we link to, which operate under their own privacy policies.

3. The personal data we collect

Information you give us. When you contact us through a form or by email, we collect the information you choose to provide. Depending on the channel, this may include:

• Your name, email address and telephone number
• Your company or organisation
• The content of your enquiry or message
• Project information you share with us in relation to a commission
• For supplier enquiries: company and product information
• For media enquiries: your publication and request
• For careers enquiries: your CV, qualifications, work history and any details you include in your application

Information we collect automatically. When you visit the site, we and our service providers may collect:

• Your IP address, approximate location, browser and device type
• Pages visited, time on site, referring source and similar usage data
• Information collected through cookies and analytics tools, as described in section 5

We do not intentionally collect special categories of data such as health, religion or biometric data. Please do not send us such information unless it is necessary, for example within a job application.

4. How we use your personal data, and our legal basis

We use personal data for the following purposes:

• To respond to your enquiry and correspond with you: performance of a contract, or our legitimate interest in answering enquiries.
• To provide and manage architectural and design services: performance of a contract.
• To assess job applications and recruit: steps taken at your request before a contract, and our legitimate interest.
• To manage supplier and media relationships: our legitimate interest in running the studio.
• To operate, secure and improve the website: our legitimate interest in maintaining and improving the site.
• To send updates or insights, where you have asked to receive them: your consent.
• To comply with legal, regulatory and professional obligations: compliance with a legal obligation.

Where we rely on consent, you may withdraw it at any time, as described in section 9.

5. Cookies and analytics

We use cookies and similar technologies to operate the website and to understand how it is used. Essential cookies support page delivery, security and basic functionality, and cannot be switched off. Analytics cookies help us see which pages are read and how visitors reach us. We use Google Analytics 4 for this, and Google Tag Manager to manage the tags that run on the website. The data is aggregated and we do not use it to identify you. Some pages embed content from third parties, which may set their own cookies or receive your IP address when that content loads. These are Google Maps, for the location map on our contact page, Dropbox, for video content, and Cloudflare, for part of the website's technical delivery. You can control or delete cookies through your browser settings. Refusing non-essential cookies will not prevent you from using the website.

6. Who we share your personal data with

We do not sell your personal data. We share it only with:

• Service providers who run the website and our tools, including our website platform and host (Webflow), our analytics and tag management provider (Google, through Google Analytics and Google Tag Manager), and providers of content delivery and media hosting (Cloudflare and Dropbox). These providers process data on our instructions.
• Professional advisers, such as legal, accounting or insurance advisers, where necessary.
• Project partners and consultants, where this is required to deliver a commission you are involved in, on a need-to-know basis.
• Authorities or regulators, where we are required to disclose information by law or to protect our legal rights.

7. International data transfers

We are established in the Kingdom of Bahrain and in India. Some of our service providers store and process data on servers located outside these countries, including in the United States and the European Union. Where personal data is transferred outside Bahrain or India, we take steps to ensure it is protected to a standard consistent with the Bahrain Personal Data Protection Law and the Indian Digital Personal Data Protection Act 2023, including using providers that offer appropriate contractual and security safeguards.

8. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes set out above:

• General enquiries: up to 24 months after our last contact.
• Client project records: for the duration of the engagement and for 10 years after completion, in line with professional indemnity, contractual and statutory record-keeping requirements.
• Job applications that are unsuccessful: up to 12 months, then deleted, unless you ask us to keep them on file.
• Website and analytics data: retained in line with the settings of our analytics tools.

When data is no longer needed, we securely delete or anonymise it.

9. Your rights

Subject to the Bahrain Personal Data Protection Law, and to the Saudi PDPL, Oman PDPL or GDPR where they apply to you, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate or incomplete data
• Ask us to delete your data, where there is no legal reason to keep it
• Object to, or ask us to restrict, certain processing
• Withdraw consent where we rely on it
• Receive a copy of the data you provided to us in a portable format
• Lodge a complaint with the relevant supervisory authority

To exercise any of these rights, contact us at hello@nicholas.design. We will respond within the period required by applicable law. You also have the right to complain to the Personal Data Protection Authority in the Kingdom of Bahrain, or to the data protection authority in your country of residence.

10. Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Children

This website is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Links to other websites

Our site links to third-party services, including our social media profiles on LinkedIn, Instagram, YouTube, TikTok and Pinterest, and to WhatsApp. We are not responsible for the privacy practices of those services, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this policy from time to time. The current version will always be posted on this page, with the date of the latest revision shown at the top.

14. How to contact us

For any question about this policy or your personal data, contact us:

nicholas.design
Office 2016, Level 19, East Tower, Bahrain World Trade Center
Isa Al-Kabeer Avenue, Manama 316, Kingdom of Bahrain
Email: hello@nicholas.design
Telephone: +973 7777 9524

15. Region-specific information

Kingdom of Bahrain. The controller is nicholas WLL, Commercial Registration 173775-1, Office 2016, Level 19, East Tower, Bahrain World Trade Center, Manama 316, Kingdom of Bahrain. The supervisory authority is the Personal Data Protection Authority.

India. Where personal data is processed by our Indian operations, the controller is nicholas India Private Limited, a subsidiary of nicholas WLL, Corporate Identity Number U7110WR2026FTC296088, at 7ES6D, Mani Casadona, East Block 14-0372 LIF/04, New Town, North 24 Parganas 700156, West Bengal, India. Processing is governed by the Digital Personal Data Protection Act 2023. If you have a concern about how your personal data is handled, you may contact us at hello@nicholas.design. You may also refer a complaint to the Data Protection Board of India.

Kingdom of Saudi Arabia. Where we process the personal data of residents of Saudi Arabia, the Saudi Personal Data Protection Law applies. The supervisory authority is the Saudi Data and Artificial Intelligence Authority.

European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies to our processing, you have the rights set out in section 9, and you may complain to your national data protection authority.

This policy was last updated on 26 August 2026.