Privacy Notice
Effective date: 6 October 2026 | Last updated: 6 October 2026 | Version: 1.0
1. Introduction
This Privacy Notice explains how Reinsurance Solutions (Mauritius) Ltd (“we”, “us”, “our” or the “Company”) collects, uses, discloses and protects personal data when you visit our website at www.reinsurance.mu (the “Website”), submit an enquiry, download materials, correspond with us, or otherwise engage with our reinsurance broking and advisory services.
We are committed to processing personal data lawfully, fairly and transparently in accordance with the Data Protection Act 2017 of the Republic of Mauritius (the “DPA”) which reflects internationally recognised data protection standards, including those embodied in the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 (together, the “UK GDPR”).
Please read this Notice carefully. By using the Website or providing personal data to us, you acknowledge the practices described in this Notice.
2. Data Controller and Contact Details
The data controller responsible for your personal data is:
| Legal entity | Reinsurance Solutions (Mauritius) Ltd |
| Registered office | Banyan House, Vivea Business Park, Moka, Mauritius |
| Business Registration Number (BRN) | C06017390 |
| Regulator | Financial Services Commission, Mauritius – Licence No. BI07000065 |
| Data protection contact | Selvina Vyapooree, svyapooree@reinsurance.mu |
| Privacy email | info@reinsurance.mu |
| Privacy postal address | Banyan House, Vivea Business Park, Moka, Mauritius |
| UK branch (if applicable) | Office 310-311 Birchin Court, 20 Birchin Lane, London, EC3V 9DU |
For any questions about this Notice or the way we handle personal data, please contact us using the details above.
3. Scope of this Notice
This Notice applies to the processing of personal data by us, in our capacity as data controller in connection with:
- Your use of our Website, through cookies and similar technologies (please refer to our separate Cookie Policy);
- Enquiries submitted via our online forms (contact, risk submission, career and complaint forms);
- Downloads of our articles, market commentary, case studies and other published materials;
- Our professional correspondence with cedants, capacity providers, brokers, reinsurers and service providers;
- Marketing and business development communications, including invitations to events and industry updates where permitted under applicable law.
This Notice does not apply to personal data processed in connection with the performance or administration of a reinsurance contract, which is governed by separate contractual and regulatory arrangements between the concerned parties.
4. Personal Data We Collect
We collect the following categories of personal data, either directly from you or from third parties such as your employer, your broker, public registers, or sanctions and due diligence databases, where such collection is lawful and necessary for the purposes described in this Notice.
4.1 Identity and contact data
Full name, job title, employer, professional email address, business telephone number, business postal address, country of residence or business.
4.2 Enquiry and correspondence data
The content of messages, enquiries, documents and attachments you send to us, including risk-related information you that you voluntarily provide in connection with our services.
4.3 Technical and usage data
IP address, device identifiers, browser type and version, operating system, referring URL, pages visited, time and date of visit, and other information collected through cookies and similar technologies (see the Cookie Policy).
4.4 Marketing preferences
Your consents and objections to receive marketing communications from us, and your engagement with such communications (open/click events, where applicable), in accordance with applicable data protection and electronic communications laws
4.5 Compliance data
Information required to meet our legal and regulatory obligations, such as sanctions screening results, anti-money laundering and counter-terrorist financing checks, and politically-exposed-person (PEP) status as required under applicable laws and regulatory requirements.
We do not knowingly collect special categories of personal data through the Website. Please do not submit health, biometric, genetic, political, religious, racial or similar sensitive information through our forms unless we have specifically requested it in connection with a regulated process.
4.6 Job applications and CVs
If you apply for a role through our website, we collect the details you enter in the application form (your name, email address, telephone number, the position you are applying for and your level of experience) together with the CV you upload. Uploaded files are stored by our file upload provider, Uploadcare, and our recruitment team receives a web link to each file in the notification email for your application. Because the file is opened through a web link, anyone who holds that link can open it, so we share these links only with members of our team who need them to consider applications. Section 8 explains how long we keep personal data.
5. Purposes and Lawful Bases for Processing
We only process personal data where we have a valid lawful basis to do so. The table below sets out the purposes for which we process personal data, together with the lawful basis under the DPA (Section 28) and the UK GDPR (Article 6).
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing requested information | Performance of a contract or steps prior to entering into a contract; legitimate interests in operating our business (DPA s.28(b)(i); UK GDPR Art.6(1)(b) and (f)) |
| Providing and administering our reinsurance broking, advisory and placement services | Performance of a contract; legitimate interests (DPA s.28(b); UK GDPR Art.6(1)(b) and (f)) |
| Sanctions screening, anti-money laundering checks, fraud prevention and regulatory compliance | Compliance with a legal obligation; legitimate interests in preventing crime (DPA s.28(c); UK GDPR Art.6(1)(c) and (f)) |
| Website operation, security and performance monitoring | Legitimate interests in running a secure and effective website (DPA s.28(f); UK GDPR Art.6(1)(f)) |
| Analytics and measurement of Website use (e.g. Google Analytics) | Consent via the cookie banner (DPA s.28(a); UK GDPR Art.6(1)(a)) |
| Sending marketing and business development communications to business contacts | Consent, or legitimate interests where permitted by the DPA and PECR/ePrivacy rules (DPA s.28(a) or (f); UK GDPR Art.6(1)(a) or (f)) |
| Recruitment enquiries and processing applications | Steps prior to entering into a contract; consent; legitimate interests (DPA s.28(a), (b) and (f); UK GDPR Art.6(1)(a), (b) and (f)) |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation (UK GDPR Art.6(1)(c) and (f)) |
Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Where we rely on legitimate interests, we have carried out a balancing assessment and you may ask us for details of that assessment.
6. Who We Share Personal Data With
We treat personal data as confidential and share it only with the following categories of recipients, on a need-to-know basis and legitimate purposes, and subject to appropriate organisational safeguards in accordance with applicable data protection law, including the DPA:
- Group companies and branches (including our offices in Mauritius, Kenya, Côte d’Ivoire, South Africa, Zambia, Rwanda and the United Kingdom);
- Reinsurers, retrocessionaires, cedants, lead brokers and other participants required to evaluate, place or service a risk;
- Regulators and supervisory authorities, including the Financial Services Commission (Mauritius), the Data Protection Commissioner (Mauritius), the UK Information Commissioner’s Office, and equivalent authorities in the territories where we operate;
- Professional advisers including legal, audit, tax, actuarial and compliance advisers;
- IT service providers, including hosting, email, CRM, analytics and cybersecurity vendors, bound by written data processing agreements;
- Law enforcement, courts, and parties to legal proceedings where disclosure is required by law or is necessary for the establishment, exercise or defence of legal rights.
- We do not sell personal data to any third party.
7. International Transfers
Because we operate across multiple African territories and the United Kingdom, and because many reinsurance participants and IT vendors are based abroad, personal data may be transferred outside Mauritius and outside the United Kingdom.
Where we transfer personal data outside Mauritius, we rely on one or more of the bases permitted by Section 36 of the DPA, including: the written authorisation of the Data Protection Commissioner, your explicit consent, performance of a contract with you, substantial public interest, the establishment of legal claims, or binding contractual clauses imposing adequate safeguards.
Where we transfer personal data from the United Kingdom to a country not covered by UK adequacy regulations, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism recognised under the UK GDPR. You may request a copy of the safeguards in place by contacting us.
8. How Long We Keep Personal Data
We keep personal data only for as long as we need it for the purposes described in this Notice, or to comply with our legal, regulatory, tax, accounting and professional indemnity obligations. Our standard retention periods are:
| Category | Typical retention period |
|---|---|
| Website enquiry correspondence (not progressed) | 12 months from last contact |
| Client and intermediary records (active and dormant files) | 7 years from the end of the engagement, or longer where required by regulation |
| Claims-related information | 10 years from final settlement |
| Recruitment data (unsuccessful) | 6 months from decision, unless you consent to longer retention |
| Marketing consents and records | Until consent is withdrawn, plus a short audit-trail period |
| Website analytics (identifiable) | Maximum 14 months (default GA4 retention) |
| Accounting and tax records | As required by applicable tax law (typically 7 – 10 years) |
At the end of the retention period we securely delete, anonymise or archive personal data in accordance with our information governance policies.
9. Your Rights
Subject to the conditions set out in the DPA and, where applicable, the UK GDPR, you have the following rights in relation to your personal data:
- Right of access – to obtain confirmation of whether we process your personal data and a copy of it (DPA s.37; UK GDPR Art.15).
- Right to rectification – to ask us to correct inaccurate or incomplete personal data (DPA s.38; UK GDPR Art.16).
- Right to erasure – to ask us to delete personal data in certain circumstances (DPA s.39; UK GDPR Art.17).
- Right to restrict processing – to ask us to limit how we use your personal data (DPA s.39; UK GDPR Art.18).
- Right to object – to processing based on legitimate interests, including profiling, and to direct marketing at any time (DPA s.40; UK GDPR Art.21).
- Right to data portability – to receive personal data you provided in a structured, commonly used, machine-readable format where processing is based on consent or contract (UK GDPR Art.20).
- Right to withdraw consent – where we rely on consent, you may withdraw it at any time.
- Rights related to automated decision-making – we do not make decisions about you using solely automated means that produce legal or similarly significant effects.
To exercise any of these rights, please contact us at info@reinsurance.mu. We will respond within one month of receiving a valid request, subject to any extension permitted by law.
10. How to Complain
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction:
| Authority | Contact |
|---|---|
| Data Protection Office, Mauritius | 5th Floor, SICOM Tower, Wall Street, Ebene, Mauritius – dpo@govmu.org – +230 460 0251 – https://dataprotection.govmu.org |
| Information Commissioner’s Office (United Kingdom) | Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF – +44 303 123 1113 – https://ico.org.uk |
11. Security
We implement technical and organisational measures appropriate to the risk presented by our processing activities including access controls, encryption in transit and at rest where appropriate, system monitoring and logging, secure backups procedure, third party due diligence, staff training, and incident-response procedures.
No method of transmission over the internet or method electronic storage is completely secure. Accordingly, while we take appropriate security measures, we cannot guarantee absolute security of personal data transmitted to us. You should therefore avoid sending sensitive or confidential documents through unencrypted email channels unless specifically requested or agreed secure methods are provided
12. Children
Our Website and services are not directed at children. We do not knowingly collect or process personal data from individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a child, we will take reasonable steps to delete such data promptly. If you believe a child has provided us with personal data, please contact us so that appropriate action may be taken.
13. Third-Party Links
The Website may contain links to third-party websites and resources. We are not responsible for the content or privacy practices of those third parties. We encourage you to review their privacy notices before providing any personal data to them.
14. Changes to this Notice
We may update this Notice from time to time. When we do, we will update the “Last updated” date at the top. Where changes are material we will provide additional notice, for example through a banner on the Website or by email to registered contacts.
15. Governing Law
This Notice is governed by the laws of the Republic of Mauritius. Where UK GDPR applies, the applicable provisions of the laws of England and Wales shall also apply in respect of personal data processed in connection with our UK branch.