1. Overview
Made4Capital Limited, trading as “Made4Trading” (hereafter the “Company”, the “Firm”, “we”, “us” or “our”) is a Company duly incorporated and registered under the laws of the Republic of Mauritius bearing company number 234336GBC, authorised and regulated by the Financial Services Commission of Mauritius (FSC) with licence number GB26205996. Our registered office is Level 1, IconEbene 1, Reduit Road, Cybercity, Ebene 72201, Mauritius.
This Privacy Policy (“the Policy”) describes who we are, why we need to collect your information, and how we will use it. It also explains who we share your information with and how we use data to improve the products and services we provide to you. We thank you for the trust you place in us when you visit our websites or utilise our products or services. We take our responsibility to protect your personal information seriously.
We apply the same data privacy standards to protect and secure your personal data wherever we provide online trading products or services to you. We act as data controllers in respect of the personal information we collect and process in connection with the services or products we provide.
2. Regulatory Framework and Purpose
This Policy has been formulated in accordance with the data protection and privacy obligations arising under the following Mauritian legislative framework:
- The Data Protection Act 2017 (‘DPA 2017’) – the primary legislation governing the collection, processing, storage, and transfer of personal data in Mauritius, administered by the Data Protection Office (‘DPO’);
- The Data Protection (General) Regulations 2021 – supplementary regulations under the DPA 2017 governing data controller obligations, data subject rights, and cross-border data transfers;
- The Financial Services Act 2007 (‘FSA 2007’) – governing the licensing and conduct of financial services providers, including obligations relating to client confidentiality and information security;
- The Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA 2002) and its Regulations – imposing Know Your Customer (KYC) and record-keeping obligations that necessitate the collection and retention of personal data;
- The Computer Misuse and Cybercrime Act 2003 – governing the security of electronic systems and personal data held in digital form;
- FSC Rules and Codes of Conduct – including conduct of business requirements relating to client data confidentiality and fair treatment.
The purpose of this Policy is to provide you with a clear and transparent summary of how the Company collects, uses, stores, shares, and protects your personal data, and to inform you of your rights as a data subject under Mauritian law.
3. Personal Information Collected
As part of providing our products and services to you, we are required by law to carry out Know Your Customer (KYC) checks to verify your identity before we onboard you as a client. We use those details to manage your account effectively and ensure you receive the best possible service.
If you are an actual or potential client, we may collect the following types of personal information depending on your stage in the customer journey:
- Identity data – including title, first name, last name, date of birth, gender, national identity card number or passport number, account number, and any other identifier;
- Contact data – including residential address, billing address, email address, and telephone number;
- Financial and source of wealth information – including details of your assets and liabilities, account balances, trading statements, tax and financial statements, employment details, and government-issued documentation evidencing source of funds;
- Technical data – including IP address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology information from devices you use to access our websites or applications;
- Financial transaction data – including user ID tokens from payment service providers, bank account details, and payment card details;
- Profile data – including your username, trading performance, transaction history, interests, preferences, customer feedback, survey responses, and records of online chats and telephone interactions;
- Usage data – including information about how you use our website, products, and services.
We collect this information through your use of our services and other interactions with us, including through our websites, account opening applications, contact forms, telephone, internet chat and ongoing client service correspondence. We may also collect information about you from third parties, including customer due diligence providers, sanctions screening providers and publicly available sources.
We also keep records of your trading behaviour, including records of suspicious transactions and orders, your preferences for certain types of products and services, your financial transactions and their performance and historical data about the trades and investments you have made.
We also collect, use, and share statistical or aggregated data for various purposes. Aggregated data may be derived from your personal data but does not directly or indirectly identify you and is therefore not considered personal data under the DPA 2017. Where we combine aggregated data with personal data in a way that could identify you, we treat the combined data as personal data and handle it in accordance with this Policy.
4. Visiting Our Websites and Cookies
We use cookies, which are small pieces of text stored on your device when you visit our websites or use our applications. Cookies help us collect standard log information to monitor customer traffic patterns, identify visitor numbers, improve our website, and provide you with a more relevant and effective experience. The information collected through cookies may include personal data, depending on the type of cookie used and the manner in which it is deployed.
Our use of cookies is conducted in accordance with the DPA 2017 and the principle of informed consent. Where cookies involve the processing of personal data, we will seek your consent before placing them on your device, except where strictly necessary for the operation of our website.
For further information about the cookies we use, please refer to our Cookie Notice available on our website, which forms part of this Policy.
5. Personal Information Usage
We only use your personal information where we have a lawful basis for doing so under the DPA 2017. The lawful bases on which we rely include:
- Compliance with a legal or regulatory obligation – where processing is necessary for us to comply with Mauritian law or FSC regulatory requirements;
- Performance of a contract – where processing is necessary for the performance of our contract with you, or to take steps at your request prior to entering into a contract;
- Legitimate interests – where processing is necessary for our legitimate business interests, or those of a third party, provided those interests are not overridden by your rights and interests; or
- Consent – where you have freely given, specific, informed, and unambiguous consent to the processing of your personal data for a particular purpose.
The following table sets out the specific purposes for which we use your personal information and the lawful basis we rely on:
What We Use Your Personal Information For |
Our Lawful Basis |
|---|---|
| To provide products, services, and support to you. | Performance of our contract with you. Legitimate interests – to deliver excellent customer service. |
| To prevent and detect fraud and financial crime. | Legal and Regulatory obligation – to prevent, detect and investigate fraud and financial crime. |
| KYC checks, identity verification, and sanctions screening. | Legal and regulatory obligation. |
| Gathering information relating to audits, legal claims, complaints, or regulatory investigations. | Legal and regulatory obligation – to defend ourselves and relevant third parties from legal claims. |
| Ensuring internal policies are adhered to, including data retention and security. | Legitimate interests – to ensure we follow our internal procedures and deliver the best service. |
| Operational improvements, training, and quality control. | Legitimate interests – to operate efficiently and deliver the best service. |
| Statistical analysis to help us manage our business. | Legitimate interests – to improve our efficiency and service delivery. |
| Preventing unauthorised access to systems and protecting cybersecurity. | Legal and regulatory obligation – to prevent and detect criminal activity. |
| Updating and maintaining accurate client records. | Legal and regulatory obligation – performance of contract. |
| Statutory returns and regulatory reporting to the FSC and other Mauritian authorities. | Legal and regulatory obligation. |
| Marketing our services to existing, prospective, and former clients where permitted. | Legitimate interests – consent, where required. |
| Credit reference and due diligence checks. | Legitimate interests – to assess our clients’ financial circumstances appropriately. |
The above table does not apply to special category personal information, such as data relating to health, political opinions, or biometric data, which we will only process with your explicit consent or where otherwise permitted by law.
6. Promotional Communications
We may use your personal information to send you updates, by email, text message, telephone, or post, about our products and services, including exclusive offers, promotions, or new products and services.
Where your consent is required for promotional communications under the DPA 2017, we will seek that consent separately and clearly. Where we rely on our legitimate interests as the basis for marketing, we will always ensure that our interests do not override your rights.
We will never sell your personal information to third parties for marketing purposes. You have the right to withdraw consent or opt out of promotional communications at any time by:
- Contacting us using the contact details set out in Section 15 of this Policy;
- Using the ‘unsubscribe’ link in any marketing email we send you.
We will update your marketing preferences when we contact you, when you request information about our products and services, or when there are changes in law, regulation, or the structure of our business.
7. Change of Purpose
We will only use your personal data for the purposes for which we collected it. If we need to use your personal data for a different purpose that is not compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so, in accordance with the DPA 2017.
Please note that we may process your personal data without your knowledge or consent where this is required or permitted by Mauritian law, including where required by the FSC, the Financial Intelligence Unit (‘FIU’), or any other competent authority.
8. Personal Information Sharing
As part of using your personal information for the purposes set out above, we may disclose your information to the following categories of recipients:
- Our related entities and group companies;
- Third-party service providers who help us deliver our products and services, such as electronic identity verification agencies, IT providers, compliance consultants, insurance providers, and administrative support;
- Introducers, brokers, and marketing agents with whom we have a commercial relationship;
- Credit providers, courts, tribunals, and applicable regulatory authorities, including the FSC, the FIU, and the DPO, where required by law or our agreement with you;
- Marketing agencies or website hosting providers;
- Credit reporting or reference agencies;
- Crime prevention agencies and law enforcement bodies; and
- Any other party authorised by you.
We only allow service providers to handle your personal information where we are satisfied that they have appropriate data protection measures in place. We impose contractual obligations on each service provider to ensure they may only use your personal information as instructed by us and solely for the purpose of providing services to us and to you.
We may also share personal information with external auditors and regulatory bodies to comply with our legal obligations. In the event of a business restructuring or sale, some personal information may need to be shared with potential buyers or successors, who will be bound by equivalent data privacy and confidentiality obligations. Where we have shared your personal information with third parties, we will communicate your data subject request to them to ensure your rights are upheld throughout the data supply chain.
Please note that the processing of your personal information by third parties acting as independent data controllers is not governed by this Policy.
9. Management of Personal Information
Your personal information may be held at our offices, at the offices of our related entities, or at the offices of our third-party service providers and agents.
In order to deliver our services to you, it may sometimes be necessary to transfer your personal information to recipients located outside Mauritius. Any such transfer will be carried out in compliance with the DPA 2017. Specifically, we will only transfer personal data internationally where:
- The recipient country offers an adequate level of data protection as determined by the Data Protection Commissioner of Mauritius;
- We have put in place appropriate safeguards, such as standard contractual clauses approved by the DPO; or
- The transfer is necessary for the performance of a contract with you or for the implementation of pre-contractual measures taken at your request.
We will always ensure that any international transfer of personal data maintains the confidentiality, integrity, availability, and security of your information.
10. Personal Information Retention
We will retain your personal information for as long as you hold an account with us or we are providing products or services to you. After the end of our relationship, we will retain your personal information for as long as is necessary to:
- Respond to any questions, complaints, or claims made by you or on your behalf;
- Demonstrate compliance with applicable laws and regulations; and
- Fulfil record-keeping obligations imposed by law.
Under the FIAMLA 2002 and other applicable regulations, we are required to retain your personal information for a minimum period of seven (7) years. Other categories of personal data may be subject to different retention periods as prescribed by applicable Mauritian law and FSC requirements.
When personal data is no longer required, we will securely delete or anonymise it in a manner consistent with our obligations under the DPA 2017.
11. Rights as a Data Subject
Under the DPA 2017, you have the following rights in relation to your personal information:
Right |
Explanation |
|---|---|
| Right of Access | The right to request a copy of the personal information we hold about you (a ‘data access request’ under Section 38 of the DPA 2017). |
| Right to Rectification | The right to ask us to correct or update inaccurate or incomplete personal information we hold about you. |
| Right to Erasure | The right to request deletion of your personal information where there is no longer a legitimate reason for us to retain it, subject to applicable legal retention obligations. |
| Right to Restriction | The right to ask us to restrict the processing of your personal information in certain circumstances, for example where you contest the accuracy of the data. |
| Right to Data Portability | The right to receive the personal information you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller in certain circumstances. |
| Right to Object | The right to object at any time to your personal information being processed for direct marketing purposes, or in certain other circumstances where we rely on legitimate interests as our lawful basis. |
| Right Not to be Subject to Automated Decisions | The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you. |
| Right to Lodge a Complaint | The right to lodge a complaint with the DPO of Mauritius if you believe we have not handled your personal data in accordance with the DPA 2017. |
You may exercise these rights free of charge by contacting us using the details in Section 15 of this Policy. We will respond to your request within the timeframes prescribed by the DPA 2017. We reserve the right to charge a reasonable fee where requests are manifestly unfounded or excessive.
12. Personal Information Security
Safeguarding your personal information is a priority for us, whether you interact with us in person, by telephone, email, post, or through the internet. We follow strict security procedures and protocols for the storage, processing, and disclosure of your information, consistent with the data security requirements of the DPA 2017 and the Computer Misuse and Cybercrime Act 2003.
Our security measures are designed to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We also have documented procedures for managing any suspected or actual personal data breach, and we will notify you and the DPO of a data breach where we are legally required to do so under Section 22 of the DPA 2017.
Where we share your information with third parties, we ensure that their security standards for storage and processing are at least equivalent to our own. We continually review our information security systems and follow best-practice industry standards.
13. Websites Information
We continuously strive to improve the functionality of our websites and applications, which may involve changes to the way personal information is collected or used. We will update this Policy as necessary to reflect any technology changes that affect your privacy rights.
Whilst we implement appropriate technical and organisational measures to safeguard the personal information you provide to us, we cannot accept liability where communications are intercepted by third parties or are incorrectly delivered. Where possible, we recommend using the secure channels we provide to transmit information directly to us.
Our websites may contain links to third-party websites. This Policy applies only to the personal information we collect through our own websites and applications. We are not responsible for the privacy practices of third-party websites and encourage you to review the privacy policy of any third-party site you visit.
14. Failure to Provide Personal Information
Where we are required by law or by the terms of our contract with you to collect certain personal data, and you fail to provide that data when requested, we may be unable to perform the contract or may only be able to provide a restricted service. In most cases this will mean we are unable to open or maintain an account for you. In such case, we shall notify you.
15. How to Contact Us
If you have any questions about this Policy, wish to exercise your data subject rights, or have concerns about how we handle your personal information, please contact us using the following details:
| Company | Made4Capital Limited |
| Address | Level 1, IconEbene 1, Reduit Road, Cybercity, Ebene, 72201, Mauritius |
| support@made4trading.com | |
| Regulator | Financial Services Commission of Mauritius (FSC) |
If you are not satisfied with our response to your concern or complaint, you have the right under the DPA 2017 to lodge a formal complaint with the Data Protection Officer of Mauritius. Complaints relating to our financial products or services may be referred to the Office of the Ombudsperson for Financial Services of Mauritius, in accordance with the Ombudsperson for Financial Services Act 2018. We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority, so please contact us in the first instance.
16. Policy Review
This Policy shall be reviewed periodically to account for new legal obligations, technological developments, changes to our operations, and the evolving regulatory landscape in Mauritius.
When we make material changes to this Policy, we will notify you through your usual method of communication, which may include email notifications or a highlighted notice on our website.