Privacy notice

Personal data is information relating to a living individual who can be identified from that data or data that makes you identifiable. Settlors, Protectors, Beneficiaries (minors and adults), Directors, Trustees, Protectors, Politically Exposed Persons and their families and associates, Controlling Persons of Entities, Business contacts, Staff (current and former), Suppliers, and associates, employees and consultants of client entities are all included where they are natural living persons.

When we collect, store, use in any way for any purpose or delete your personal data we are processing it.

Personal data includes, among other data, your name(s), address(es), email address(es), telephone number(s), bank account number(s) and passport number(s).

Theseus (Mauritius) Limited is the Data Controller of your personal data. The Data Controller is responsible for ensuring that your personal data is processed in compliance with data protection laws and to provide you with this privacy notice. If you have any questions or concerns about personal data or this privacy notice or you wish to make a complaint about how we have processed your personal data, or you wish to exercise any of your rights as a data subject please contact the Data Controller by email at DPOMauritius@stonehagefleming.com or by post using the following address:

Theseus (Mauritius) Limited
1st Floor
Les Fascines Building - Block B
Vivéa Business Park
Rue des Fascines
Moka, Mauritius

Alternatively, please feel free to discuss with your Account Manager.

If you are a natural person who is a client of the Group, or a counterparty or connected to either the Group or its counterparties – for example as a shareholder or a director or officer of a corporate entity to which we provide regulated services in Mauritius or a trustee, a protector or a beneficiary of a trust for which we provide services or a related party or advisor - then we will collect and use your personal data to enable us to meet our contractual obligations.

We also have regulatory obligations, including compliance with anti-money laundering regulations which necessitate processing of your personal data.

We may also process your personal data because it is necessary for our legitimate interests, such as growing our business.

Depending on the services you require of us we process your personal data:

• To perform due diligence and comply with regulatory obligations (including anti money laundering legislation);
• To incorporate companies (e.g. where you are a shareholder or director);
• To perform our client take on process and client reviews;
• To establish and register a trust (e.g. where you are a settlor, trustee, protector or beneficiary)
• To administer a trust generally (the activities we undertake can be very broad and range from property and/or staff management to regulatory filings);
• To appoint and distribute funds to beneficiaries;
• Keeping documents in safe custody;
• To make payments and investments;
• In the creation of loan agreements;
• To raise and send invoices;
• At termination of any relationship involving a data subject;
• To conduct internal reviews and compile internal reports;
• For internal administration such as time recording against the client name or scanning and saving of documentation;
• For record keeping purposes;
• To generate reports for you in compliance with any request from an auditor, or a regulatory or supervisory body;
• To generate and distribute trust correspondence;
• Complete tax returns;
• To apply for citizenship or residency;
  
• In the establishment of bank accounts and interaction with banks;
• To otherwise fulfil your instructions, provide the advice and assistance that we are engaged to provide, service the trust or company or other entity, or comply with our obligations.

For the avoidance of doubt, you may refuse to provide us with your personal data. In that case, we would likely not be able to provide you with our services.

We may process items of data such as: your name, address, place and date of birth, photograph/ID card/proof of identity, proof of address, Tax identification numbers, bank details, signature, contact information, social security details, ID/passports and FATCA/CRS details. This may be provided directly by you or by your representative such as a lawyer or accountant. We may also collate and hold data found from the results of Google or other internet searches and other sources in the public domain as well as third party service providers in the course of our client due diligence and client review process, and in providing the services that we are engaged to provide. We generate an internal number specific to you and our accounting software will also produce a reference number for you.

We process the following documents and information that may also contain your personal data: Trust Deeds, employment history, bank references, register of members, register of directors, financial statements, controlling persons list, authorised signatories list, minutes and resolutions. Information regarding source of funds and source of wealth may also contain your personal data. We may also undertake sanction screening, credit and fraud checks with third parties and checks to ascertain any convictions, court cases, criminal records or proceedings of any person connected with our client, the trust or company or other entity. In the course of your dealings with us you may provide further information to us, where we seek additional information, all of this information will be kept securely by Theseus (Mauritius) Limited and the Group.

The Group’s business and the services you request of us require transfers to many third parties, often at your request, and at other times transferring data to a third party is necessary to perform our contract with you (for example if you ask us to open a bank account for a legal entity or where other advisors or service providers are engaged) or for Legal/Regulatory reasons, such as completion of a corporate annual return of a Company. A non-exhaustive list of potential transfers include:

• Collecting and sending documents for external audits of client entities;
• Collecting and sending documents for external audits of Group entities;
• Publications onto the public record, such as companies registries or beneficial ownership registers;
• Publications with regulators;
• FATCA/CRS filings onto approved external platforms;
• Sending information to external parties such as notaries and other advisors or service providers on behalf of serviced clients;
• For legitimate business purposes your personal data may be shared with any investor, potential investor, acquirer, bank or financial institution investing in or considering investing in Theseus (Mauritius) Limited or any of the Group companies.

Brokers, Banks, Custodians, Advisors, Auditors and Portfolio Managers may require information on you for their own due diligence to comply with regulations. We share the information you provide to us with them for this purpose.

As a result of contracting with Theseus (Mauritius) Limited your personal data will be processed in Mauritius and is subject to the Mauritius Data Protection Act. In addition, as an entity which may offer services into the European Union and United Kingdom, where we process personal data of data subjects’ resident in the European Union and United Kingdom, the GDPR and UK GDPR may apply respectively with local privacy laws. Your personal data may be processed by any of the Group’s offices, inside and outside the European Union, United Kingdom or Mauritius. We have agreements in place, where required, to protect transfers of your data between jurisdictions in accordance with the applicable privacy laws. Should you require further information about this, please contact us.

Additionally your data may be entered into our accounting and/or billing systems, and our document management systems and your data may be processed by our sub-processors including our retail investment technology and third party administration solution providers or outsourcing technology companies, including cloud services providers. In such cases, where data is processed in a third country, an appropriate safeguard is used. Your data may also be provided externally to banks, regulators, auditors, advisors (including, but not limited to, legal advisors), supervisory or governmental bodies as well as those appointed as directors, shareholders, and/or beneficiaries, settlors or protectors to the trust.

Your personal data will be kept securely by Theseus (Mauritius) Limited and the Group. This information will be held in accordance with our Record Retention Policy and any applicable laws, after which it will be securely destroyed. We may keep it longer where:

• There is litigation or an investigation;
• It may be required to assist with the mitigation of any future tax or regulatory query into the transactions or other affairs undertaken by an entity or trust to which we provide regulated services. This ensures that the rights and freedoms of our clients, our staff as well as the Group and its Members are safeguarded.

You have the following data protection rights:

• To obtain access to, and copies of, the personal data that we hold about you;
• To require that we cease processing your personal data if the processing is causing you damage or distress;
• To require us not to send you marketing communications;
• To require us to correct the personal data we hold about you if it is incorrect;
• To require us to erase your personal data;
  
• To require us to restrict our data processing activities;
• To receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, please contact us using the following email address: DPOMauritius@stonehagefleming.com

If you are not satisfied with how we are processing your personal data, you can make a complaint to the Mauritius Data Protection Office or the relevant Supervisory Authority, if you reside outside of Mauritius.

Version: 29 November 2024