1. Purpose of this Privacy Notice
This Privacy Notice explains our approach to any personal data that we collect from you or which we have obtained about you from a third party and the purposes for which we process your personal data. It also sets out your rights in respect of our processing of your personal data.
This Privacy Notice will inform you of the nature of your personal data that is processed by us and how you can request that we delete, update, and/or provide you with access to them.
This Privacy Notice is intended to assist you in making informed decisions when using our Services and/or to understand how your personal data may be processed by us when you visit and have access to our website. Please take a moment to read and understand it.
Please also note that this Privacy Notice only applies to the use of your personal data obtained by us.
2. Who are we and what do we do
The EDB is the leading Government agency mandated to provide institutional support for strategic economic planning and to promote Mauritius as an attractive investment and business centre, a competitive export platform as well as an International Financial Centre (IFC).
The EDB is a corporate body set up under the Economic Development Board Act 2017 and operates under the aegis of the Ministry of Finance, Economic Planning & Development.
The EDB is a data controller and processes your personal data as such.
3. How to contact us
If you have any questions about this Privacy Notice or want to exercise your rights set out in this Privacy Notice, please contact us by:
- sending an email to dpo@edbmauritius.org ; or
- calling us on: +230 203 3800
4. What personal data do we collect
We may collect your personal data in the course of our business, when you contact us or request information from us, in order to fulfil a statutory requirement, or where such information is necessary for the purposes of the Services which you require from us.
Your personal data may also be needed for your registration on the EDB’s website in order for you to submit an enquiry or a customer feedback.
The personal data we may collect are the following:
- Personal details: Name, phone number, address, email, the name of your company or the company you work for, the said company’s website; and
- Any other information relevant to the provision of Services.
Any information you submit to us must be true, complete, and not misleading. Submitting inaccurate, incomplete, or misleading information may lead to a rejection of your request. In addition, it is your responsibility to ensure that the information you submit does not violate any third party’s rights.
5. Purpose and legal bases for our use of your personal data
Our processing of personal data is justified by a “legal basis”, that is, a specific condition. We may use personal data for the following purposes, in each case as justified by a legal basis:
We use your personal data to enable us to perform the Services, consider your project, perform background and due diligence checks, respond to your requests and deliver the Services, for which you have required from us.
What is our legal basis?
This processing is necessary for our compliance with legal obligations and it is in our legitimate interest to use your personal data in such a way to ensure that we provide the Services to you.
- Communication, marketing, and promotion
We may use your personal data to facilitate communication with you regarding your request, to send you newsletters, reports, updates, surveys and other publications from the EDB, as well as invites to events organized by the EDB.
What is our legal basis?
It is in our legitimate interest to use your personal data in order to inform, enhance and promote the different types of stakeholders’ support we can give with the aim of promoting Mauritius as an attractive investment and business centre. Where necessary, we will also rely on consent as the legal basis.
We may use your personal data to comply with legal and other requirements, such as record-keeping and reporting obligations, conducting audits, compliance with government inspections and other requests from government or other public authorities, responding to legal process such as subpoenas, sharing information with government authorities, law enforcement and private parties where we have a good- faith belief it is necessary.
What is our legal basis?
This processing is necessary for our compliance with legal obligations, and it is in our legitimate interest to use your personal data in such a way to ensure that we provide the Services to you.
We may use your personal information for other business operations. There may be more than one purpose that justifies our use of your personal information in any particular circumstances. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. If you fail to provide certain information when requested, we may not be able to entertain your enquiry or we may be prevented from complying with our legal obligations.
What is our legal basis?
This processing is necessary for our compliance with legal obligations, and it is in our legitimate interest to use your personal data in such a way to ensure that we provide the Services to you.
If we wish to use your personal data for purposes other than those stated in this Privacy Notice, we will notify you and/or obtain your consent where required by applicable laws.
6. Cookies
Our Website may use cookies to enhance user experience. Users can control cookie preferences through their browser settings. For more information about the cookies we use, please consult our Cookie Policy.
7. Sharing your personal data
We may appoint sub-contractor data processors as required to deliver the Services, such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT support service providers, and document and information storage providers, who will process personal data on our behalf and at our direction. We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub- contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.
Further, we may appoint external data controllers where necessary to deliver the Services. When doing so, we will comply with our legal and regulatory obligations in relation to the personal data including, but without limitation, putting appropriate safeguards in place.
We may also share personal data with a variety of the following categories of third parties as necessary:
- Government and/or regulatory authorities;
- Third parties to whom we outsource certain services, such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT Support service providers, and document and information storage providers; and/or
- Third party service providers to assist us with client insight analytics, such as Google Analytics.
8. Where we transfer your personal data to
The EDB is headquartered in Mauritius but has several representative offices located in other jurisdictions. When you submit personal data to us, we will receive it and will process it in Mauritius. In order to provide the Services, we also may need to transfer your personal data to locations in other jurisdictions.
If you are based within the European Union/European Economic Area (EEA), please note that where necessary to deliver the Services, we will transfer personal data to countries outside the EEA. Countries outside the EEA may not provide an adequate level of protection for your personal data. In such cases, we will take reasonable measures to implement appropriate and suitable safeguards to afford your personal data a level of protection that is at least comparable to that under applicable law.
For more information on how we protect your information please contact us at our contact details as described at Clause 3 above.
9. Retention of personal data
EDB’s retention periods for personal data collected under this Privacy Notice are based on business needs and legal requirements. We retain personal data for as long as is necessary for the processing purpose(s) for which we collected the information, as set out in this Privacy Notice, and any other permissible, related purposes. Unless instructed otherwise or required by applicable law, we will retain personal data you have supplied to us for the purposes specified in this Privacy Notice.
10. Confidentiality and security of your personal data
We are committed to keeping personal data secure and we have implemented and maintain appropriate technical, administrative, physical, and procedural security measures including appropriate information security policies and rules consistent with local and international information practices designed to protect the personal data that we have under our control from unauthorized access, improper use or disclosure, unauthorized modification and unlawful destruction or accidental loss. Please note that no transmission over the Internet is completely secure or error-free, and that the information security policies, rules and technical measures utilized and maintained by us may be subject to compromise.
All of our partners, employees, consultants, workers and data processors (i.e., those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal data, are obliged to respect the confidentiality of such personal data.
11. How to access your information and your other rights
You have the following rights in relation to the personal data we hold about you:
Your right of access
If you ask us, we will confirm whether we are processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
Your right to correction (rectification)
If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it corrected. If you are entitled to have information corrected and if we have shared your personal data with others, we will let them know about the rectification where possible. If you ask us, we will also tell you, where possible and lawful to do so, with whom we have shared your personal data so that you can contact them directly.
Your right to erasure
You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, we will also tell you, where it is possible and lawful for us to do so, with whom we have shared your personal data with so that you can contact them directly.
Your right to restrict (block) processing
You can ask us to restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us. If you are entitled to restriction and if we have shared your personal data with others, we will let them know about the restriction where it is possible for us to do so. If you ask us, we will also tell you, where it is possible and lawful for us to do so, with whom we have shared your personal data so that you can contact them directly.
Your right to data portability
This right only applies to data originating from the European Union.
With respect to EU/EEA data, there is the right, in certain circumstances, to receive a copy of personal data we have obtained from you in a structured, commonly used and machine-readable format, and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
Your rights in relation to automated decision-making and profiling
You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.
Your right to object
You have the right to object in writing at any time to the processing of your personal data. Where your personal data are processed for the purpose of direct marketing, you may object to processing of your personal data for such marketing. This includes profiling to the extent that it is related to such direct marketing.
Your right to withdraw consent
If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
Your right to lodge a complaint with the supervisory authority
If you have a concern about any aspect of our privacy practices, including the way we’ve handled your personal data, you can report it to the Data Protection Office of Mauritius or any supervisory authority (as applicable).
Please note that some of these rights may be limited where we have an overriding legitimate interest or legal obligation to continue to process the personal data, or where the personal data may be exempt from disclosure due to applicable law, the applicable rules of professional conduct, attorney-client privilege, legal professional privilege, other applicable privileges or protections, or professional secrecy obligations.
12. Changes to this Privacy Notice
We may make changes to this Privacy Notice from time to time, to reflect changes in our practices. We may also make changes as required to comply with changes in applicable law or regulatory requirements. Where we materially change this Privacy Notice, we will take steps to notify you (such as by posting a notice on the EDB’s website), and where required by applicable law to obtain your consent.
