This Privacy Policy explains how Okami Capital Management Ltd collects, uses, shares and protects personal data, and the rights you have over it. It applies to personal data of any individual processed by or on behalf of the Company, in physical or electronic form, including prospective clients, clients, authorised signatories and representatives of corporate clients, and visitors to this Website.
1. Who is responsible for your data.
Okami Capital Management Ltd, 8th Floor, Ebene Tower, 52, Cybercity, Ebene, Republic of Mauritius, is the controller of your personal data. We process personal data in line with the Data Protection Act 2017 (the “DPA”), its regulations and guidance issued by the Data Protection Office, and, where it applies to you, the EU General Data Protection Regulation (EU) 2016/679.
Our Data Protection Officer monitors compliance and is your point of contact for any privacy matter: info@okami-capital.com, marked “For the attention of the Data Protection Officer”.
2. Personal data we collect.
- Identification data: name, email, postal address, telephone number, country of residence, passport and national identity card details, tax identification number.
- Personal characteristics: date of birth, nationality, marital status and family information.
- Professional information: employer, function, title, place of work, education.
- Financial data: source of wealth and funds, financial situation, assets and liabilities, investment objectives, experience, risk profile and preferences.
- Account and transaction data: positions, transactions, instructions and powers of attorney.
- Due diligence data: information required by the Financial Intelligence and Anti-Money Laundering Act 2002 (“FIAMLA”), including politically exposed person and sanctions screening results.
- Communications: emails, letters, notes of meetings and, where applicable, recorded telephone conversations.
- Online data: IP address, device and browser information and cookies, as described in our Cookie Policy.
3. How we collect it.
We collect personal data directly from you, for example when you complete the contact form on this Website, apply for a service, speak to us or sign an agreement. We may also receive it from people linked to you or your business, introducers and service providers, custodians and banks, public registers and screening databases, and regulatory or public authorities.
4. Why we use it and our legal basis.
Under the DPA we process personal data only where we have a lawful basis, in line with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
- To perform a contract or take steps you request before entering one: onboarding, opening and managing accounts, executing instructions and transactions, and providing investment management, advisory and brokerage services.
- To meet our legal and regulatory obligations: customer due diligence and ongoing monitoring under FIAMLA, record keeping and reporting under the Securities Act 2005 and the Financial Services Act 2007, tax reporting including FATCA and the Common Reporting Standard, and responding to lawful requests from the FSC, the Financial Intelligence Unit and other authorities.
- For our legitimate interests, where these are not overridden by your rights: managing risk and our business, preventing and detecting fraud and financial crime, improving our services, security of people and premises, and establishing or defending legal claims.
- With your consent: sending you newsletters, research and event invitations, and using non-essential cookies. You may withdraw consent at any time.
We do not make decisions that produce legal or similarly significant effects for you based solely on automated processing, including profiling, except where permitted by law and with appropriate safeguards.
5. Marketing.
We will send you marketing communications only where you have agreed or where the law otherwise permits it. You can object at any time, free of charge, by using the unsubscribe link in any message or by emailing us, and we will stop processing your data for direct marketing.
6. Who we share it with.
We do not sell, rent or trade personal data. We share it only where necessary with:
- custodians, banks, brokers, trading platforms and other financial institutions involved in providing our services;
- our professional advisers, auditors, management company and IT and service providers, under written contracts that require them to protect your data;
- persons you appoint or authorise;
- the FSC, the Financial Intelligence Unit, the Mauritius Revenue Authority and other regulatory, tax, law enforcement or judicial authorities where required by law.
7. International transfers.
Some recipients are located outside Mauritius, for example custodians and execution platforms. We transfer personal data outside Mauritius only where the DPA permits it, such as where appropriate safeguards are in place and proof has been provided to the Data Protection Commissioner, where the transfer is necessary to perform a contract with you, or where you have explicitly consented after being informed of the possible risks.
8. Recording of communications.
We may record and keep telephone conversations and electronic communications relating to services provided, instructions given or transactions executed, as evidence of instructions and to meet regulatory record-keeping requirements. Recordings are processed and retained in accordance with the DPA.
9. How long we keep it.
We keep personal data only as long as needed for the purposes for which it was collected. Customer due diligence and transaction records are kept for at least seven years after a transaction or the end of the business relationship, as required by FIAMLA, and longer where another law, a regulator or a legal claim requires it. Data is then securely deleted or anonymised. Enquiries that do not lead to a client relationship are deleted within 30 days.
10. Your rights.
Subject to the DPA, you have the right to:
- be informed about and access the personal data we hold about you;
- have inaccurate or incomplete data rectified;
- have data erased, or its processing restricted, on legitimate grounds;
- object to processing based on legitimate interests and to direct marketing;
- not be subject to decisions based solely on automated processing;
- withdraw consent at any time, without affecting earlier processing;
- where the GDPR applies to you, receive your data in a portable format.
To exercise a right, email info@okami-capital.com or write to the Data Protection Officer at our registered office. We may need to verify your identity. Some rights are limited where we must keep data to meet legal obligations, and if you ask us to erase data we need to provide our services, we may be unable to continue the relationship.
11. Security.
We apply technical and organisational measures proportionate to the risk, aligned with recognised frameworks including the NIST Cybersecurity Framework 2.0. They include access on a least-privilege basis, encryption where applicable, secure configuration, monitoring, regular vulnerability assessments, and annual data protection and security training for staff and relevant contractors.
12. Personal data breaches.
If a breach occurs we act immediately to contain and remedy it. Where required, we notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it, and we inform affected individuals without undue delay where the breach is likely to result in a high risk to them.
13. Complaints.
If you are unhappy with how we have handled your personal data, please contact our Data Protection Officer first. You also have the right to complain to the Data Protection Office, 5th Floor, SICOM Tower, Wall Street, Ebène, Republic of Mauritius, telephone +230 460 0251, website dataprotection.govmu.org.
14. Changes to this policy.
We may update this Privacy Policy from time to time. Changes take effect when published on this page, unless the law requires otherwise. Where changes are significant, we will tell clients directly.