1. Privacy Notice

This Privacy Notice (“notice”) is issued by Intercontinental Trust Ltd (ITL) and is relevant to our subsidiaries as well (For a list of our subsidiaries, please click here). It outlines how we collect, use, store and share your data including your personal data, when you visit our website or engage our services. This notice applies to individuals outside our organisation, including website visitors, customers, and suppliers who interact with ITL.

2. Definition

“Data” refers to any information, whether in electronic or physical form, which is collected, processed, stored, or shared by ITL. This includes, but is not limited to, personal data, which identifies or can reasonably identify an individual, and company data which pertains to business entities, their operations, financials and other relevant corporate information.

"Personal Data" refers to any information which identifies or can reasonably identify an individual, either on its own or combined with other information.

3. Collection of Data:

We collect your data:

1. When you interact with us directly (e.g. contact forms, application forms or use our services);

2. When the data is shared with us by third parties including government bodies, other agencies, service providers or introducers;

3. When publicly available data is accessible, such as through public registries, media, and social platforms, where privacy settings permit such access; or

4. When you browse or interact with our website.

4. Special Categories of personal data

We do not seek to collect or otherwise process special categories personal data save and except when required by law or when we have obtained your explicit consent prior to the processing of such personal data. In situations where special category of personal data is required by law or where explicit consent has been granted, we ensure that appropriate safeguards are in place to protect your personal data.

5. Processing of Personal Data

We process data strictly for the following purposes or wherever the applicable laws require such processing:

1. Conducting due diligence;

2. Client onboarding;

3. Addressing legal matters and compliance obligations;

4. Recruitment and human resource management;

5. Communication, Marketing and Business Development; and

6. Any other purpose related to the aforementioned purposes or for any specific purpose for which you have provided your personal data to us.

Where processing is not covered under the above, ITL may rely on its legitimate interests after conducting a Legitimate Interest Assessment. If necessary, we will also seek your explicit consent, clearly stating the purpose of data collection. Consent given for one purpose will not be used for another without your prior authorisation.

6. Usage of your Data

We may use your data for the following purposes:

1. Provision of services:

   We shall use your personal data to deliver and enhance our services. This includes responding to inquiries, addressing your concerns and meet any specific requests or needs you may have.

2. Marketing, Communication and Business Development purposes:

   Subject to your consent or our legitimate interests, we may use your contact information to communicate with you regarding our services, promotions, updates and other relevant information. Where processing is based on legitimate interests, ITL ensures that such interests do not override your fundamental rights and freedoms. If required, a Legitimate Interest Assessment is conducted.

Additionally, we may contact you as part of our business development efforts, including reaching out to potential clients and exploring new opportunities.

1. Analytics:

   We may use usage data to analyse trends, manage and optimise the performance of our website, and gather valuable demographic insights about our user base.

2. Compliance and Legal obligations:

   We may process your personal data to comply with applicable legal and regulatory requirements.

7. AI Transparency Obligation

ITL utilises Artificial Intelligence (AI) tools to streamline internal processes, improve operational efficiency, and enhance client services,. These AI tools are employed to support functions such as customer service, data analysis and service optimisation. We assure you that while AI is not used for decision-making regarding your data, it may be utilised to assist in providing services and improving your experience. Where ITL employs AI tools for content generation, it ensures transparency in AI-generated outputs where applicable.

We ensure all AI applications comply with applicable data protection laws and safeguard your privacy rights.

By using our services, you acknowledge and consent to the use of AI subprocessors in processing your data.

8. Information Sharing

We may share your data with third parties such as financial institutions, auditors, IT service providers, legal advisors, and regulatory authorities, strictly for legitimate business purposes or as required by law.

9.International Transfer of Personal Data

ITL operates globally and may transfer data to our subsidiaries for purposes outlined in this policy.

10. Server Location

Your data is stored securely in Microsoft Azure Data Centers located in South Africa and Northern Europe. If we transfer or store your data to other countries, we will take steps to assess and address the risks to ensure that the transfer or storage of data is in line with legal requirements.

11. Data Security

We are committed to protecting the security of your information and have implemented appropriate technical and organizational measures to safeguard it from unauthorised access, use, or disclosure.

12. Data Accuracy

ITL takes reasonable steps to ensure that:

• Your data is accurate and updated; and

• Inaccurate data is promptly corrected or deleted.

ITL reviews your data accuracy periodically and encourages individuals to update their information whenever necessary.

We may periodically ask you to confirm the accuracy of your data.

13. Storage Limitation

ITL retains personal data and company data only as long as necessary for its intended purpose and limits data collection to necessary and relevant data solely.

We will keep your data in accordance with applicable laws and any agreed retention periods.

Data no longer required will be securely erased or destroyed, including requiring third parties to do the same where applicable.

14. Your Rights:

As a data subject, you have the following rights regarding your personal data:

1. Right to Access:

   You have the right to request access to the personal data we hold about you and to request that we correct, update, or delete it if it is inaccurate or incomplete.

2. Right to be informed:

   You have the right to be informed about the personal data we collect and use.

3. Right to transfer data to another controller:

   You have the right to request the transfer of your personal data to another controller.

4. Right to withdraw consent:

   Where we process your personal data on the basis of your consent, you have the right to withdraw that consent anytime.

5. Right to object:

   At any time during the processing of your personal data (including where the personal data will be processed using AI), you have the right to object to the processing of your personal data.

6. Right to restrict processing of your personal data:

   You have the right to limit the processing of your personal data for particular purposes.

7. Right to lodge complaint:

   You have the right to lodge a complaint with the Data Protection Officer of ITL (dpo@cass.mu) regarding the processing of your Personal Data. You may also lodge a complaint with the Data Protection Office of Mauritius.

We will respond to any requests for the exercise of your rights in a timely manner, typically within one month of receipt. To exercise your rights, you may submit a request by contacting our Data Protection Officer at dpo@cass.mu

15. Data Security

We take appropriate technical and organisational measures to safeguard your data against unauthorised access, use, alteration, disclosure and destruction.

16. Contact Details

If you have any questions or concerns about this Privacy Notice or how we handle your data, please contact our Data Protection Office at dpo@cass.mu.

17. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in how we process your data in compliance with applicable laws, including but not limited to the Data Protection Act 2017 of Mauritius. We encourage users to review our Privacy Notice regularly for updates.

By continuing to use the services of ITL, you hereby acknowledge that you have read and agreed to the terms of this Privacy Notice.

February 2025