1. Privacy Notice

This privacy notice has for purpose to explain how Capital Markets Brokers Ltd (“CMB”) collects, uses, discloses and safeguards your personal data whenever your data is being collected. 

Any reference to “personal data” in this privacy notice means any information which identifies, or could reasonably be used to identify, an individual, either on its own or together with other information.

2. Processing your Personal Data

        2.1. Collection of Data

        CMB may collect your personal data directly from different sources, including:

• When you contact us via email or telephone or by any other means of communication;
• As part of our client on-boarding procedure;
• When managing transactions for or on behalf of customers; and
• When you visit our website.

In some cases, we may collect data about you from a third-party source, such as state-owned entities or other institutions, or from public records.

    2.2. Information collected

CMB may process the following categories of personal data, such as:

• Personal Details: first and last name, middle name, gender, date of birth or age, marital status, ID number, passport number, nationality, photographs;
• Family Details: names and contact details of family members;
• Contact Details: address, telephone and mobile numbers, email address;
• Employment Details: names of current and former employers, work address, work telephone number, work email address and work-related social media profile details;
• Education History: details of your education and qualifications;
• Financial Details: billing address, bank account numbers, credit card numbers, cardholder or accountholder name and details, transaction details; and
• Electronic Identifying Data:  IP addresses, cookies and geolocation data.

As part of CMB’s client on-boarding procedure, the following special categories of personal data

may be processed: 

1. Commission or alleged commission of an offence;
2. Any proceedings for an offence committed or alleged to have been committed, the disposal of such proceedings or the sentence of any Court in the proceedings.

CMB creates personal data about you, such as records of your interactions with CMB, and details of your accounts, subject to the applicable law.

        2.3. Purpose of Data Processing

CMB will only process your personal data for any of the purposes listed below or wherever the applicable law so requires:

• Due diligence;
• Client on-boarding;
• Credit worthiness;
• Providing services to you;
• Marketing and/or Prospecting;
• Financial Management;
• Analytics;
• Legal matters (for e.g. investigations, legal compliance and legal proceedings);
• Fraud prevention; and 
• For any purpose related to the foregoing or for any purpose on the basis of which you provided the personal data to CMB.

Where none of the aforesaid purposes apply to the processing, we shall seek explicit consent from you, setting out clearly the purpose for which we are collecting your personal data. Consent obtained for one purpose shall not be used for another purpose unless prior written authorisation of the data subject is obtained.

3. Lawful, fair and transparent processing

Your personal data will be processed lawfully, fairly and in a transparent manner. As a data subject, you are hereby informed that:

1. Processing is/will be performed in accordance with the regulations (lawfulness); 
2. Personal data collected shall be handled in a way data subjects expect and not ways which lead to unjustified adverse effect (fairness); and 
3. You will be informed whenever you are the subject of data processing (transparency). 

4. Purpose Limitation

Your personal data will be collected only for specified, explicit and legitimate purposes. It will not be further processed in any manner incompatible with those purposes. 

Personal data collected for one specific purpose shall not be used for other purpose(s) without prior authorisation of the data subject.

5. Data Minimisation

CMB takes reasonable steps designed to limit the collection of personal data to what is directly relevant and necessary to accomplish specific purposes set out in this privacy notice. 

6. Data Accuracy

The accuracy of any personal data collected shall be checked at the point of collection and during regular intervals afterwards. CMB will request you to confirm the accuracy of your personal data from time to time.

CMB takes reasonable steps designed to ensure that:

• your personal data which we process are accurate and where necessary, kept up to date, 
• any of your personal data which CMB processes and are considered inaccurate or out-of-date, are erased or rectified without further delay, and 
• the data subject is informed about any rectification carried out. 

Data subjects must inform CMB of any change in their personal data as soon as is reasonably practicable. 

7. Accountability

CMB shall adopt policies and implement appropriate technical and organisational measures to ensure and be able to demonstrate that the processing of personal data is performed in accordance with the Mauritian Data Protection Act 2017 (“DPA”). 

CMB will ensure that it has adequate resources, systems and processes in place to demonstrate compliance with its data processing duties as a controller, including: 

1. implementing appropriate data security and organisational measures; 
2. keeping a record of all processing operations; 
3. performing a data protection impact assessment; 
4. complying with the requirements for prior authorisation from, or consultation with the Commissioner; and 
5. designating an officer responsible for data protection compliance issues.

8. Storage Limitation

Personal data will not be kept in an identifiable form for longer than is necessary for the purposes for which the data is processed. 

Pursuant to the Mauritian Companies Act 2001 and the Financial Intelligence and Anti-Money Laundering Act 2002, CMB will maintain retention procedures to ensure personal data is retained for a minimum period of seven years from the date of commencement of business relationship. The criteria will be reviewed as and when there is any regulatory or legal amendment.

Reasonable steps will be taken to destroy or erase all personal data which is no longer required in accordance with the Company’s applicable procedures. This includes requiring third parties to delete that data where applicable.  

9. Your Legal Rights

Subject to the applicable law, you have a number of rights regarding the processing of your personal data, including:

1. the right to request access to, or copies of, your personal data that CMB processes or controls together with information regarding the nature, processing and disclosure of those personal data;
2. the right to request rectification of any inaccuracies in your personal data that CMB processes or controls;
3. the right to request, on legitimate grounds:
   1. erasure of your personal data that CMB processes or controls;
   2. restriction of processing of your personal data that CMB processes or controls;
4. the right to have your personal data that CMB processes or controls transferred to another controller to the extent applicable;
5. where CMB processes your personal data on the basis of your consent, the right to withdraw that consent anytime; and
6. the right to lodge complaints with the Data Protection Office of Mauritius regarding the processing of your personal data by CMB or on CMB’s behalf.

10. Security, Integrity and Confidentiality

CMB has implemented appropriate physical, technical and organisational security measures which ensure a level of internal security designed to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or unauthorised forms of processing of your personal data, in accordance with the applicable law. You are, however, responsible for ensuring secure sending of your personal data to CMB.

Appropriate safeguards will be developed, implemented, and maintained in accordance with the size, the scope of business, the available resources, the amount of personal data which are owned and maintained by the Company. The effectiveness of the said safeguards will be regularly evaluated and tested to ensure security of the processing of personal data. Particular care will be exercised in handling special categories of personal data. 

Data security will be maintained by protecting the confidentiality, integrity and availability of Personal Data as follows: 

• Confidentiality: Only people who are required to know and are authorised to use the personal data can access it. 
• Integrity: Personal data is accurate and suitable for the purpose for which it is processed. 
• Availability: Authorised users can access personal data when they need it for authorised purposes.

11. Disclosure of Personal Data to third parties

CMB may also need to transfer and disclose your personal data to other related companies affiliated to CMB and/or third parties (including sub-processors) involved in your matters, for legitimate business purposes, in accordance with applicable laws. 

Subject to section 4, CMB may engage the services of another sub processor to process personal data on its behalf provided that the sub processor has similar security measures for the safekeeping of personal data. Where CMB transfers personal data to third parties, CMB will only provide it to organisations which have data privacy policies equivalent to CMB or to those who are subject to similar data protection laws as CMB.

12. International Transfer of Personal Data

For international transfer of personal data, CMB will abide by the requirements of the DPA. If any of the legal bases provided by the law is not applicable, CMB shall seek the approval of the Data Protection Office of Mauritius for any such transfer.

13. Direct Marketing

CMB may process your personal data to contact you, primarily by email and also by telephone, so that we can provide you with information concerning services that may be of interest, provided that we have first obtained your consent, to the extent required by, and in accordance with the applicable law.

If you do not wish to receive marketing communications from CMB, you can opt out at any time by contacting CMB.

14. Contact Details

If you have any questions, concerns or requests about any of the information in this privacy notice, or any issues relating to the processing of personal data by CMB, please contact our Data Protection Officer at  dpo@cmb.mu.

Your usage of this application signifies your understanding and acceptance of how we collect, process and protect your personal data. You hereby acknowledge that you have read, understood and agreed to the terms in this privacy notice.