1. Controller and contact
Dhow Capital Ltd is the controller for personal data it determines to collect and use in connection with this website and its direct corporate communications.
You may contact the Company at dhowcapital@bramston.co, by telephone at +230 650 0690, or by post at 6th Floor, Carleton Tower, 19 Wall Street, Ebene Cybercity 72201, Mauritius.
Data protection enquiries and rights requests may be sent to the same role-based email address with the subject line “Data protection request”.
2. Scope
This notice applies to visitors to the website, persons who contact Dhow Capital, representatives of shareholders, counterparties, advisers, suppliers and other professional contacts whose personal data the Company processes.
Separate or more specific notices may be provided where a particular transaction, due-diligence exercise, employment matter or legal requirement calls for additional information.
3. Personal data we may collect
- Identity and professional details, such as name, role, employer or organisation and relevant corporate capacity.
- Contact details, including business email address, telephone number and correspondence address.
- The content of correspondence, enquiries, meeting records and documents you choose or are authorised to provide.
- Corporate, compliance and due-diligence information where it is lawfully required for a relationship or transaction.
- Limited technical and security data generated by the web server, such as IP address, date and time, requested page, browser or device information, referrer and security events.
4. Sources of personal data
We generally obtain personal data directly from you or from the organisation you represent. We may also receive it from shareholders, counterparties, professional advisers, service providers, public registers, official sources or other persons authorised or lawfully entitled to provide it.
5. Purposes and lawful bases
Where the provision of personal data is required by law, contract or a due-diligence process, Dhow Capital will identify that requirement when appropriate. Failure to provide required data may prevent the Company from responding to a request, entering into a relationship or meeting an obligation. Where provision is voluntary, you may choose not to provide the data.
- Enquiries and communications
- To respond to you, arrange discussions and maintain professional correspondence. Depending on the context, processing is necessary for pre-contractual steps or our legitimate interest in conducting and documenting corporate communications.
- Corporate administration
- To maintain corporate records, manage governance, relationships and authorised information-sharing. Processing may be necessary for legal obligations, contractual arrangements or legitimate corporate interests.
- Due diligence and compliance
- To verify identity, authority, ownership or other relevant matters where lawfully required. Processing may be necessary to comply with legal obligations, protect legitimate interests or establish, exercise or defend legal rights.
- Website and information security
- To operate, protect and troubleshoot the website, prevent abuse and investigate incidents. Processing is based on our legitimate interest in maintaining secure and reliable systems and, where relevant, legal obligations.
- Consent
- Where we specifically ask for consent, you may withdraw it at any time without affecting processing already carried out lawfully before withdrawal.
6. Recipients and disclosure
Personal data may be made available on a need-to-know basis to Dhow Capital’s directors, authorised personnel and service providers supporting hosting, information technology, communications, administration or professional services.
It may also be disclosed to legal, accounting, tax, banking, compliance or other advisers; to counterparties where necessary for an authorised matter; and to courts, regulators, law-enforcement bodies or public authorities where required or lawfully justified.
Dhow Capital does not sell personal data and does not disclose it for third-party advertising.
7. Transfers outside Mauritius
Some recipients or technical service providers may be located outside Mauritius. Before an international transfer is made, Dhow Capital considers the transfer basis, the destination, the nature of the data and the safeguards required under section 36 of the Data Protection Act 2017.
Where appropriate, safeguards may include contractual commitments, access controls, encryption, transfer assessments, explicit consent in the limited circumstances permitted by law, or another lawful transfer ground.
8. Retention
Personal data is retained only for as long as necessary for the purpose for which it was collected, and thereafter where required for legal, corporate, tax, accounting, compliance, dispute-resolution or record-keeping purposes.
General enquiries are ordinarily reviewed for deletion after the matter is closed. Technical logs are kept for a limited security period unless they are required to investigate an incident. Corporate and due-diligence records may be retained for the period required by applicable law or while legal rights may need to be established, exercised or defended.
9. Security and personal-data breaches
Dhow Capital applies proportionate technical and organisational measures intended to preserve confidentiality, integrity, availability and resilience. Measures may include access restrictions, secure configuration, encryption where appropriate, backup, logging, incident handling and oversight of service providers.
A personal-data breach is assessed and documented without delay. Where the law requires notification, the Mauritius Data Protection Commissioner is notified without undue delay and, where feasible, within 72 hours after the Company becomes aware of the breach. Where a breach is likely to create a high risk to an individual’s rights and freedoms, the affected individual is also informed without undue delay.
No method of transmission or storage is completely secure. Please avoid sending sensitive documents through ordinary email unless a secure method has been agreed.
10. Your rights
Subject to applicable conditions and exceptions, you may request access to your personal data, rectification of inaccurate or incomplete data, erasure, restriction of processing, or object to processing. You may withdraw consent where consent is the basis used and may request information about international transfers and any relevant automated decision-making.
Dhow Capital does not use this website to make decisions based solely on automated processing that produce legal or similarly significant effects.
A written request may be sent to dhowcapital@bramston.co. We may request proportionate information to verify identity and authority. Further practical details appear on the Data Subject Rights page.
The Data Protection Act 2017 does not provide a general statutory right to data portability. Dhow Capital will nevertheless consider a reasonable request for information in a commonly usable format where lawful, proportionate and technically practicable.
11. Children
This corporate website is not directed to children. Dhow Capital does not knowingly seek to collect personal data from children through the website. If you believe a child’s personal data has been provided, please contact us so the matter can be reviewed.
12. Registration and data-protection governance
Section 14 of the Data Protection Act 2017 requires controllers and processors to register with the Mauritius Data Protection Office. This public website is not evidence of a particular registration certificate; current evidence may be made available to properly authorised counterparties through controlled due-diligence channels, where applicable and available.
The Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 come into operation on 1 January 2027. Once Dhow Capital has designated a suitably qualified Data Protection Officer and notified the Data Protection Office in accordance with the applicable requirements, the required contact details will be published on this website. Until then, the role-based address above is the Company’s data-protection contact.
13. Questions, complaints and updates
Please contact Dhow Capital first so that a privacy concern can be considered promptly. You also have the right to lodge a complaint with the Mauritius Data Protection Commissioner. Information is available from the Mauritius Data Protection Office.
This notice may be updated to reflect legal, operational or technical changes. The effective date and version are shown above.