Obligations under the Mauritius Data Protection Act 2017 (DPA) and EU General Data Protection Regulation 2016/679 (GDPR)

The DPA was revised and enhanced in 2018 in order to be in line with international standards set by the GDPR. Vuna shall, for the performance of its obligations under the aforementioned legislation, collect and where necessary or required, process and store Personal Data which Clients voluntarily disclose to us for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements. Vuna has a legal obligation to store Personal Data of Clients for seven years after they cease being a client of Vuna. Vuna undertakes to treat Personal Data confidentially and securely in line with the provisions of the DPA and GDPR as amended from time to time.

Except in the following circumstances, Vuna undertakes not to disclose Personal Data:

1. Vuna has obtained the express consent of the Principal, or
2. Vuna is under either a legal obligation or any mandatory duty to do so, or
3. Personal Data is disclosed to an agent, service provider, professional adviser or any other person under a duty of confidentiality towards Vuna and such person being itself bound by the DPA and/or GDPR.

Clients’ Rights

The DPA provides that Clients, have in relation to their Personal Data, which is under the control of Vuna (Controller), the right to:

1. Access such Data and to request rectification and erasure of same;
2. Object to the processing of such Data;
3. Withdraw consent at any time, without affecting the lawfulness of processing based on the consent which Clients had provided prior to withdrawal.

For how long does Vuna keep Clients’ Personal Data

1. Personal Data cannot be kept for longer than Vuna needs it. However, there is no specific time limit. How long Vuna retains Personal Data shall depend on the purpose for which Vuna holds such data.
2. Vuna shall destroy Personal Data as soon as is reasonably practicable where the purpose for keeping same has lapsed.
3. Clients who have ceased their relationship with Vuna, shall find that Vuna shall keep Personal Data for a period of 7 years in line with the prevailing laws of Mauritius and proceed to its destruction thereafter.
4. Clients who have consented to receive updates from Vuna, shall find that Personal Data held by Vuna for that purpose shall be kept until such time that Clients notify Vuna that they no longer wish to receive updates.

Transfer outside Mauritius

Clients have expressly acknowledged and agreed when retaining Vuna’s services that Personal Data may be required on a case by case basis, to be transferred to parties located in countries which do not offer the same level of data protection as Clients’ country of domicile. In that connection, Clients understand and agree that there may be risks involved in that transfer.

Complaint

Should Clients wish to exercise any of the aforementioned rights or should Clients have any queries relating to the processing of Personal Data, Clients may contact the Data Protection Officer of Vuna at vsoniassy@vunagroup.com

In case you are not satisfied with the reply provided, you may refer the complaint to the Data Protection Commissioner dpo@govmu.org