Privacy Notice

1. Introduction

This website is owned, operated, hosted and maintained by Bloomsbury LLP.

This notice applies to Bloomsbury LLP only. This notice applies where we are acting as a data controller with respect to the personal data of our website visitors, physical site visitors and other data subjects.

We are committed to safeguarding the privacy of data subjects, including our website visitors and physical site visitors. As a result, we would like to inform you regarding the way we would use your personal data, as is required by the European Union General Data Protection Regulation (hereafter the “GDPR”) and the Data Protection Act 2017 (hereafter the “DPA”) where applicable. We recommend you read this Privacy Notice so that you understand our approach towards the use of your personal data.

Our Privacy Notice sets out the types of personal data we collect, how we collect and process that data, who we may share this information with and the rights you have in this respect.

As data controllers, we determine the purposes and means of the processing of that personal data. We also comply with our obligations as a data processor under the DPA and the GDPR.

2. Who we are

Bloomsbury LLP (The “firm”) is a firm of Chartered Accountants in Mauritius and is a Member Firm of the Mauritius Institute of Professional Accountants (“MIPA”), providing pioneering audit services.

For more information, please refer to the “About” section on our website at:

http://www.bloomsbury.mu/.

We need to collect personal data to effectively carry out our everyday business functions and activities and to provide the services in connection with our business. Such data is collected from our website visitors, physical site visitors and other data subjects (but is not limited to), name, address, email address, date of birth, identification numbers, private and confidential information, special categories of personal data and bank details.

The principal place of business of the firm is at 1st Floor, Sterling Tower, Office 101-102, 14 Poudrière Street, Port Louis, Mauritius.

3. Personal data we may collect about you

Personal data is any data from which you can be identified, and which relates to you.

The type of data we collect will depend on the purpose for which it is collected and used. We will only collect data that we need for that purpose.

We may collect your personal data in the following ways:

• When you give it to us directly for e.g., you use any of our services, you provide or offer to provide services to us, you correspond with us and provide us with your information, or you visit our premises.
• When you browse and/or interact on our website.

The types of personal data that are collected and processed may include:

4. Cookies

We use cookies on our website. Insofar as those cookies are not strictly necessary for the provision of our website and services, we will ask you to consent to our use of cookies when you first visit our website.

5. How we use your personal data

The firmwill only use your personal data for the purposes for which it was collected or agreed with you. We will not use your personal data for any automated individual decision making which will have a significant impact on you.

We have set out below the legal basis of processing for each purpose. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your personal data.

In addition to the above-mentioned specific purposes for which we may process your personal data, we may also process any of your personal data where such processing is necessary for compliance with legal and regulatory requirements which apply to us, or when it is otherwise allowed by law, or when it is in connection with legal proceedings.

6. Disclosure of personal data

In general, we do not share your personal information with third parties (other than service providers acting on our behalf) unless we have a lawful basis for doing so.

We may also make certain personal data available to third party companies that provide us software and tools relevant for our business operations.

We may also be required to disclose your personal data to other third parties such as lawyers, bankers, consultants, insurers, auditors as well as public and government authorities for purposes mentioned in Section 5 or where:

• We have a duty or a right to disclose in terms of law or for national security and/or law enforcement purposes;
• We believe it is necessary to protect our rights;
• We need to protect the rights, property or personal safety of any member of the public or a customer of our firm or the interests of our firm; or
• You have given your

We require our service providers and other third parties to keep your personal data confidential and that they only use the personal data in furtherance of the specific purpose for which it was disclosed. We have written agreements in place with our processors to ensure that they comply with these privacy terms.

7. International transfers

We may transfer, or store, your personal data outside Mauritius as may be necessary for the purposes mentioned above.

These transfers would always be made in compliance with the GDPR and/or the DPA. Data transfers do not change any of our commitments to safeguard your privacy and your personal data remains subject to existing confidentiality obligations.

If we transfer your personal data to other countries which provide a lower level of protection, we will ensure that there are appropriate safeguards in place with regard to the protection of your personal data, such as by using:

• the European Commission's approved Standard Contractual

If you would like further details on the transfer of your personal data outside Mauritius, please contact our Data Protection Officer/ Privacy Champion (hereafter “DPO”).

8. Personal data security

We are legally obliged to provide adequate protection for the personal data we hold. We have put in place appropriate security measures to prevent your personal data from being subject to any accidental or unlawful destruction, loss, alteration, and any unauthorised disclosure or access.

We have also put in place procedures to deal with any suspected data security breach and will notify you and the Data Protection Office of a suspected breach where we are legally required to do so.

We will, on an on-going basis, continue to review our security controls and related processes to ensure that your personal data is secure.

Our security policies and procedures cover:

• Access to personal data
• Encryption
• Malware Protection
• Vulnerability Management
• Password
• Security Compliance
• Network Control
• Firewall
• Backup of data
• Incident management
• Information Risk Management and Information Risk Treatment
• Use and misuse of IT assets
• Physical security
• Antivirus

When we contract with third parties, we impose appropriate security, privacy and confidentiality obligations on them to ensure that personal data that we remain responsible for is kept secure.

We will ensure that anyone to whom we pass your personal data agrees to treat your data with the same level of protection as we are obliged to.

9. Your data protection rights

Under the GDPR and the DPA, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right to erasure of your personal data

You have the right to ask us to delete your personal data in certain circumstances:

• When we no longer need your personal data;
• If you initially consented to the use of your personal data, but have now withdrawn your consent;
• If you have objected to us using your personal data, and your interests outweigh ours;
• If we have collected or used your personal data unlawfully; and
• If we have a legal obligation to erase your

Where we collect personal data for a specific purpose, we will not keep it for longer than is necessary to fulfil that purpose, unless we have to keep it for legitimate business or legal reasons. Upon the determined expiry date, we will securely destroy your personal data. Retention periods are indicated in Annex A’s Records Retention and Disposal Schedule. When we delete data from our servers, no residual copies remain on our servers. Data from our backup tapes are also deleted depending on the next scheduled backup overwrite which may be on a weekly, monthly or yearly basis in accordance with its configuration.

Your right of access to your personal data

You have the right to request a copy of the personal data we hold about you. To do this, simply contact our DPO (refer to Section 11.1) and specify what data you would like. We will take all reasonable steps to confirm your identity before providing details of your personal data.

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Your right to rectification of your personal data

You have the right to ask us to update or correct your personal data if you think it is inaccurate or incomplete. We will take all reasonable steps to confirm your identity before making changes to personal data we may hold about you. We would appreciate it if you would take the necessary steps to keep your personal data accurate and up-to-date by notifying us of any changes we need to be aware of.

Your right to restriction of processing

You have the right to ask us to limit how we use your data. If necessary, you may also stop us from deleting your data. To exercise your right to restriction, simply contact our DPO (refer to Section 11.1), say what data you want restricted and state your reasons. You may request us to restrict processing of your personal data in the following circumstances:

• If you have contested the accuracy of your personal data, for a period to enable us to verify the accuracy of the data;
• If you have made an objection to the use of your personal data;
• If we have processed your personal data unlawfully but you do want it deleted;
• If we no longer need your personal data but you want us to keep it in order to create, exercise or defend legal claims.

Your right to object to processing

You also have the right to object to us processing your personal data where your data is being used:

• For a task carried out in the public interest;
• For our legitimate interests;
• For scientific or historical research, or statistical purposes; or
• For direct

We currently process personal data for our legitimate interests. You should contact our DPO (refer to Section 11.1) to inform that you are objecting to any more processing of your personal data and state in your objection why you believe we should stop using your data in this way. Unless we believe we have strong legitimate reasons to continue using your data in spite of your objections, we will stop processing your data as per the objection raised.

Your right to data portability

The right to data portability allows you to ask for transfer of your personal data from one organisation to another, or to you. The right only applies if we are processing information based on your consent or performance of a contract with you, and the processing is automated. You can exercise this right with respect to information you have given us by contacting our DPO (refer to Section 11.1). We will ensure that your data is provided in a way that is accessible and machine-readable.

Your right to withdraw consent

To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

If you wish to exercise any of the rights set out above, please contact our DPO (refer to Section 11.1).

10. Changes to this privacy notice

We keep our privacy notice under regular review. We reserve the right to change our privacy notice at any time thus we encourage you to periodically review this notice to be informed of how we are using and protecting your personal data. We will notify you of significant changes by a pop-up on the website. This version was last updated on the 14 March 2025.

11. Contact details

The primary point of contact for questions relating to this privacy notice, including any requests to exercise your legal rights, is our DPO who can be contacted by email at:

• nawsheenchoomka@bloomsbury.mu

If you believe we have not handled your request in an appropriate manner, you have the right to complain to the Data Protection Office.

The procedure to file a complaint with the Data Protection Office is available on https://dataprotection.govmu.org/Pages/Home%20-%20Pages/Take%20Action/To-report-your-Complaint.aspx

ANNEX A: RECORDS RETENTION AND DISPOSAL SCHEDULE

The table below sets specific retention requirements: