Data Protection Notice

This notice is given under the Data Protection Act 2017. It describes how personal data is handled when we arrange, service and claim on insurance — who sees it, why, on what legal basis, and what you can do about it. Our privacy policy covers the same ground more briefly and also deals with this website.

Last updated: 10 August 2026.

Global Equity Insurance Brokers is the controller of the personal data described here, and is registered as a controller with the Data Protection Office as section 14 of the Act requires. We have designated a person responsible for data protection compliance, who can be reached at info@globalequity.mu or by writing to Suite 217, Ebene Junction, Rue de La Democratie, Ebene, Mauritius.

Insurers and loss adjusters to whom we pass your data are generally controllers in their own right for what they then do with it, and they will have their own notices. Our IT and administrative suppliers act as processors, under written terms that allow them to act only on our instructions.

Insurance cannot be arranged without disclosure. A single motor or medical proposal may pass, in whole or in part, to several of the following.

• Insurers approached for a quotation, and the insurer that finally accepts the risk.
• Other insurers and underwriting markets with whom a risk is shared or placed, in Mauritius and internationally.
• Loss adjusters, claims professionals and surveyors appointed on a claim.
• Medical practitioners and medical advisers, where a health, life, travel or personal accident risk or claim requires it.
• Lawyers and experts instructed on a disputed or complex claim.
• Premium finance providers and banks, where payment is arranged through them.
• Regulators and authorities — the Financial Services Commission, the Financial Intelligence Unit, the Data Protection Office, the Mauritius Revenue Authority, the police and the courts — where the law requires disclosure.

We hold identity and contact details; details of the risk to be insured; your insurance and claims history; financial and payment information; the policy documents, correspondence and claims records themselves; and, where the product requires it, special category data — most commonly health information, and information about criminal convictions where a motor or fidelity proposal asks for it.

Section 28 of the Act requires a lawful basis for each purpose. We rely on the performance of your contract, or steps taken at your request before entering one, to obtain quotations and to place, service and claim on your insurance. We rely on compliance with a legal obligation for our regulatory duties under the Insurance Act 2005 and our customer due diligence and reporting duties under the Financial Intelligence and Anti-Money Laundering Act 2002. We rely on our legitimate interests to administer our business, keep proper records, prevent fraud and protect our own legal position. And we rely on consent for marketing and, in the manner section 29 requires, for special category data.

Insurers increasingly use automated systems to rate risk, price premium and detect fraud, and some decisions on a proposal may be reached by such a system without a person reviewing them. Section 38 of the Act gives you the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you — subject to the exceptions the Act allows, which include where the processing is necessary for entering into or performing a contract, or where you have given explicit consent.

If a decision about your cover has been reached this way and you want it looked at by a person, tell us and we will take it up with the insurer.

Section 21 of the Act requires that personal data be processed lawfully, fairly and transparently; collected for explicit, specified and legitimate purposes and not further processed incompatibly with them; adequate, relevant and limited to what is necessary; accurate and kept up to date; kept in a form permitting identification for no longer than necessary; and processed in accordance with your rights. We hold ourselves to that list, and we keep the records of processing that section 33 requires.

Section 31 requires appropriate technical and organisational security. Ours includes access controls, encryption where appropriate, resilient systems and backups, supplier due diligence, staff training, and periodic testing of whether the measures work in practice rather than only on paper.

If a personal data breach occurs, section 25 requires us to notify the Data Protection Commissioner without undue delay and, where feasible, within seventy-two hours of becoming aware of it, with an explanation if we are late. Where the breach is likely to result in a high risk to your rights and freedoms, section 26 requires us to tell you as well, without undue delay, describing what happened and what we recommend you do.

Placing specialist risks means approaching markets beyond Mauritius, so some personal data will be transferred abroad. Section 36 permits a transfer where the controller provides proof of appropriate safeguards for the protection of the data; where you have given explicit consent after being informed of the possible risks; or where the transfer is necessary for the performance of your contract, for a contract concluded in your interest, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

We rely principally on contractual safeguards with the parties we transfer to, and we send only what a market needs in order to quote or to handle a claim.

We keep personal data for as long as the purpose requires: the life of the policy, plus the period in which a claim, complaint or legal proceeding could still arise, and at least seven years for the customer due diligence and transaction records required by the anti-money-laundering legislation. Where the purpose has lapsed, section 27 requires us to destroy the data as soon as is reasonably practicable and to instruct any processor holding it to do the same.

Under Part VII of the Act you have the right to:

• be told whether we hold your personal data and receive a copy, with information about how it is used — we will respond within one month, extendable by a further month where the request is complex, and without charge unless the request is manifestly excessive;
• have inaccurate data corrected, have data erased where there is no longer a ground to hold it, and have processing restricted while a question about it is resolved;
• object in writing at any time to processing based on legitimate interests, which we must stop unless we can demonstrate compelling legitimate grounds — and to object to direct marketing, where the right is absolute; and
• not be subject to a solely automated decision of the kind described above.

These rights may be exercised by you, by a parent or guardian on behalf of a minor, by a guardian on behalf of a person who is mentally unfit, or by someone you authorise in writing. Write to info@globalequity.mu. We will verify your identity before acting, so that we do not disclose your data to somebody else.

Bear in mind that erasing or restricting data we need in order to maintain your cover may make it impossible for us to continue acting for you, and that some records must be retained by law regardless of a request.

Please raise it with us first through our complaints procedure. You may also complain at any time to the Data Protection Commissioner: Data Protection Office, telephone 460 0251, email dpo@govmu.org, website dataprotection.govmu.org.

We review this notice periodically and publish changes here with a revised date. Where a change materially affects how your personal data is used, we will bring it to your attention directly rather than relying on you to check.