WEBSITE PRIVACY POLICY

1. Introduction and scope

ANNEAU Limited (“ANNEAU”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you:

• visit or use www.anneau.co (the “Website”);
• submit an enquiry, request a call, complete a form or otherwise contact us through the Website;
• receive website-related communications or marketing from us; or
• interact with us as a prospective client, client, supplier, adviser, business contact or complainant where the interaction is connected with the Website.

This Policy should be read together with any more specific privacy notice supplied during client onboarding or when using a separate application or service. It does not replace an employee privacy notice or the privacy policy for the ANNEAU – INVESTISSEMENTS eIPO mobile application.

We process personal data in accordance with the Data Protection Act 2017 of Mauritius (the “Act”) and other applicable legal and regulatory requirements.

2. Who is responsible for your personal data

ANNEAU is the controller of personal data processed for the purposes described in this Policy.

3. Data-protection principles

We seek to ensure that personal data are:

• processed lawfully, fairly and transparently;
• collected for explicit, specified and legitimate purposes and not used incompatibly with those purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date where necessary;
• kept in an identifiable form for no longer than necessary; and
• processed in accordance with the rights of data subjects and protected by appropriate safeguards.

4. Personal data we may collect

4.1 Information you provide

Depending on how you interact with us, this may include:

• identity and contact data, such as your name, title, organisation, postal address, email address and telephone number;
• enquiry and relationship data, including the service in which you are interested, meeting requests and correspondence;
• professional or business information, such as your role, employer and industry;
• client or prospective-client information supplied through a form or related communication;
• complaint, feedback and rights-request information; and
• marketing choices and communication preferences.

4.2 Information collected automatically

When you use the Website, we and our service providers may collect technical and usage data, including:

• internet protocol address, browser and device information, operating system and language settings;
• dates and times of visits, pages viewed, links selected, referring pages and navigation patterns;
• cookie or similar-technology identifiers; and
• security and diagnostic information used to maintain the availability and integrity of the Website.

4.3 Information from other sources

Where lawful and relevant, we may receive personal data from introducers, professional advisers, service providers, publicly available sources, corporate websites, public registers, regulators or authorities. If you proceed to become a client, further identity, due-diligence and regulatory information may be collected under the onboarding notice applicable to that relationship.

4.4 Sensitive personal data

Please do not send sensitive or special-category personal data through a general Website form unless we specifically request it and explain why it is required. If such data are received or must be processed, we will do so only where an appropriate legal basis and safeguards apply.

5. How we collect personal data

We may collect personal data:

• directly from you when you complete a form, correspond with us, telephone us, meet us or request a service;
• automatically through Website logs, cookies and similar technologies; and
• from third parties or public sources where it is lawful and appropriate to do so.

6. Why we use personal data and our lawful bases

We use only the personal data reasonably necessary for the relevant purpose. Depending on the circumstances, processing may be based on your consent, steps taken at your request before entering a contract, performance of a contract, compliance with a legal or regulatory obligation, protection of vital interests, performance of a task in the public interest or our legitimate interests where these are not overridden by your rights and freedoms.

The applicable lawful basis depends on the circumstances. Where we rely on legitimate interests, we assess those interests against the effect of the processing on you.

7. If you do not provide requested information

Where personal data are required by law, regulation or a contract, or are necessary to respond to your request, we will identify this where practicable. If you do not provide the information, we may be unable to respond fully, progress an application, establish or continue a relationship, or provide the requested service.

8. Disclosure of personal data

We may disclose personal data, on a need-to-know basis and subject to appropriate safeguards, to:

• ANNEAU personnel and authorised contractors;
• website-hosting, form, communications, cloud, information-technology, cybersecurity, analytics and records-management providers;
• banks, payment providers, auditors, insurers, lawyers, consultants and other professional advisers;
• introducers or business partners where you request or reasonably expect the disclosure;
• the Financial Services Commission, the Data Protection Office, the Financial Intelligence Unit, law-enforcement bodies, courts, tax authorities and other competent authorities where required or permitted; and
• a prospective purchaser, investor, financier or successor in connection with a genuine corporate transaction, subject to confidentiality and applicable law.

We do not sell personal data.

9. International transfers

Some service providers or recipients may process or store personal data outside Mauritius. We will make such transfers only where permitted by the Act and will take steps designed to ensure an appropriate level of protection. Depending on the transfer, this may include verifying appropriate safeguards, entering into suitable contractual arrangements, relying on an applicable statutory condition and completing any required assessment, notification or authorisation.

10. Cookies and similar technologies

Cookies are small files or similar identifiers placed on or read from your device. The Website may use:

• strictly necessary cookies for core operation, security and accessibility;
• preference cookies that remember choices;
• analytics cookies that help us understand Website performance and use; and
• marketing or third-party cookies, if enabled, that measure campaigns or support embedded content.

Where consent is required, non-essential cookies will be used only after you have made a choice through the Website consent mechanism. You may change or withdraw that choice through the Website settings, where available, or through your browser. Blocking certain cookies may affect Website functionality.

Our cookie notice or cookie-settings panel will identify the cookies actually in use, their providers, purposes and lifetimes.

11. Direct marketing

We may send you news, invitations or information about relevant services where permitted by law. We will obtain consent where required. You may object to direct marketing or withdraw consent at any time by using an unsubscribe facility or contacting us. We may keep a minimal suppression record to ensure that your request continues to be respected.

12. Automated decision-making and profiling

The Website is not intended to make decisions about you based solely on automated processing that produces legal effects or similarly significant effects.

13. Security

We apply technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are selected having regard to the nature, scope, context and purposes of the processing and the associated risks. Access is restricted to persons who require the information for authorised purposes.

No internet transmission or storage method is completely secure. If a personal-data breach occurs, we will assess it and make any notification or communication required by the Act.

14. Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, accounting, reporting, security and dispute-resolution requirements. Retention periods vary according to the type of record, the relationship and applicable limitation or regulatory periods. When personal data are no longer required, we delete, anonymise or securely dispose of them, subject to lawful exceptions.

15. Your rights

Subject to the Act and any applicable limitations, you may have the right to:

16. How to exercise your rights

Send a written request to the privacy contact identified in section 2 and describe the right you wish to exercise. We may ask for information reasonably necessary to verify your identity and protect personal data against unauthorised disclosure. We will respond within the period required by law. Access requests are generally handled without charge, although the Act permits a reasonable fee or refusal in limited circumstances, such as manifestly excessive requests.

17. Complaints

We invite you to contact us first so that we can try to resolve your concern. You also have the right to complain to:

18. Children

The Website is not directed at children and we do not knowingly seek personal data from children through general Website forms. If you believe that a child has provided personal data to us inappropriately, please contact us. Where processing involving a child is necessary, we will apply the requirements and safeguards of the Act.

19. Third-party websites and services

The Website may link to websites, platforms or services operated by third parties. Those third parties control their own processing, and their privacy notices apply. We encourage you to read them before supplying personal data. A link from our Website does not make us responsible for a third party’s privacy practices.

20. Changes to this Policy

We may update this Policy to reflect changes in law, our processing or the Website. The current version will be posted on the Website with its effective date. Where a change is material, we may provide an additional notice where appropriate.

21. Contact

Questions about this Policy, our use of personal data or your rights should be sent to: