This privacy notice (“Privacy Notice”) is intended to ensure transparency in how Personal Information is managed within Okami Capital Management Ltd (the “Company”). It outlines the principles and practices governing the collection, use, disclosure, and protection of Personal Information across the Company, as well as the measures in place to uphold accountability and to comply with applicable privacy and data legislation and regulations.
This Privacy Notice also explains the rights of Data Subjects and the mechanisms available to them to exercise such rights, in accordance with applicable Data Protection Laws.
The Privacy Notice applies to Personal Data of any natural person that is Processed by or on behalf of the Company, whether in physical or electronic form.
It applies to all products, services, business activities, and operations of the Company, including where the Company acts directly or indirectly through intermediaries, partners, correspondents, agents, or service providers, whether located in Mauritius or in foreign jurisdictions. This includes circumstances where Personal Data is processed in connection with a direct relationship or an indirect relationship facilitated through another entity. It also applies to cases where an individual engages with the Company as an authorised signatory, representative, or authorised person of a non-individual entity.
The applicable terms and conditions of any product or service of the Company may contain additional provisions that operate alongside this Privacy Notice. The Privacy Notice does not restrict or limit any consent previously given or that may be given in the future for the benefit of the Company. Concerned individuals are therefore expected to read the specific terms and conditions relevant to the products or services they use, together with this Privacy Notice.
3.1. The headings contained in this Privacy Notice are for convenience and reference purposes only.
3.2. The use of the masculine shall include the feminine and vice versa and the use of the singular shall include the plural.
3.3. For the purposes of the Privacy Notice, the following definitions shall apply:
The Company may, for a Legitimate Interest, use, hold and process, process, by automated or non-automated means, and, where applicable, in jurisdictions inside or outside Mauritius, subject to appropriate safeguards under Data Protection Law, Personal Data and may collect it from various sources, including from a Customer, any person linked with the Customer, his business and services, people working on behalf of the Customer, a regulatory body or in circumstances such as:
The Company will collect and process various categories of Personal Information under the following circumstances (subject to appropriate retention periods set out in section 11 below) in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality:
6.1 Subject to the relevant Data Protection Laws, the Company will process Personal Data for the following Legitimate Interests:
6.2 The Processing of Personal Data by the Company may give rise to decision-making, including Profiling, which shall be effected within the legal and regulatory limits set out in the Data Protection Laws. Data Subjects shall not be subject to a decision based solely on automated Processing, including Profiling, which produces legal or similarly significant effects, except where permitted by law and subject to appropriate safeguards.
In its endeavour to provide Customers with optimised services that are constantly evolving in order to better meet the Customer needs, as well as to maintain and develop its business relationship, the Company may:
8.1. the Company may transfer Personal Data to the following categories of persons:
8.2. In transferring Personal Data, the Company shall ensure that the Third Parties with which it interacts are legally required to process Personal Data with the same or equivalent degree of care and confidentiality as required under the applicable Data Protection Laws. The Third Parties shall at least have the obligation to maintain appropriate technical and organisational security measures to protect the Personal Data against:
8.3. the Company does not rent, sell, or otherwise commercially trade Personal Data to any Third Party.
8.4. Where Personal Data is transferred outside Mauritius, the Company shall ensure that such transfers are subject to appropriate safeguards in accordance with applicable Data Protection Laws, including adequacy decisions, contractual safeguards, or other legally recognised transfer mechanisms.
These Third Parties may act as Controllers or Processors and have a duty to comply with legal and/or contractual obligations regarding the protection of Personal Data, including professional secrecy and the applicable confidentiality obligations.
The Company may record and keep records of conversations and meetings including telephone conversations and correspondences relating to any service provided, activity carried out or transaction executed by the Company on behalf of Customers. Personal Data collected in the course of telephone recording activities will be Processed and kept strictly in accordance with the applicable Data Protection Laws and shall serve, where appropriate, as proof of instructions.
10.1. Subject to the relevant Data Protection Laws, the Data Subjects’ rights regarding the Processing of Personal Data include the right to request:
10.2. Data Subjects may submit a request to exercise the rights set forth above through a registered letter sent to the Company Data Protection Team situated at the Company Head Office, Office 118, Rue De La Democratie, Ebene Junction, Republic of Mauritius, or by such other channels as may be communicated by the Company from time to time.
The Company retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including meeting any contractual, operational, or service-related requirements. Once the relevant purpose has been achieved, the data is securely deleted or anonymised, unless a longer retention period is required or permitted by law. Certain regulatory or legal obligations may require the Company to retain Personal Data for a specified duration e.g. retention requirements from the Bank of Mauritius or other competent authorities.
The Company ensures that all retention periods comply with applicable legal and regulatory frameworks and are guided by internal data retention policies. Further details on applicable retention periods may be obtained upon request from the Company Data Protection Team.
The Company implements appropriate technical and organisational measures to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are aligned with industry-recognised frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0. These measures are proportionate to the nature, scope, context and purposes of the Processing, as well as the risks to the rights and freedoms of Data Subjects.
By default, the Company applies privacy and security by design principles when developing or modifying systems and processes. Security controls include access management based on the principle of least privilege, encryption where applicable, secure system configurations, regular monitoring, and regular vulnerability assessments with formal review and remediation.
The Company conducts mandatory data protection and information security training for all staff and relevant contractors at least once per year and provides targeted or refresher training whenever necessary.
These measures are reviewed and updated periodically to reflect evolving threats, industry standards, and applicable legal and regulatory obligations.
The Company Data Protection Team, as required under the Data Protection Act 2017, reports to executive and board committees, to ensure appropriate oversight and governance of data protection compliance.
Upon identification of a Personal Data breach the Company shall take immediate actions to assess, contain, mitigate and resolve the incident. Where required by applicable Data Protection Laws, the Company will notify the relevant supervisory authority and affected individuals without undue delay. The Company also keeps records of all data breaches in accordance with its legal obligations and internal policies.
The Company may be subject to audits or inspections carried out by regulatory authorities to verify compliance with applicable Data Protection Laws. In addition to regular internal audits, the Company also engages independent external auditors to, at least annually, review its data protection practices, security controls, and internal processes. These audits help ensure that Personal Data is handled lawfully, securely, and in accordance with industry standards. Findings from such audits are assessed, and the Company implements corrective actions where necessary to continuously improve its data protection framework.
Under the prevailing Data Protection Laws, a Data Subject has the right to lodge a complaint regarding the Processing of Personal Data with the Company by:
Data subjects have the right to lodge a complaint with the Data Protection Commissioner (see more at https://dataprotection.gov.mu) if they believe that their Personal Data has been Processed in a manner that infringes applicable Data Protection Laws.
The Company reserves its right to amend at any time partly or wholly the provisions of the present Privacy Notice and such amendments shall be notified by posting on the Company website www.okami-capital.com or any other appropriate means it deems appropriate. Such amendments shall take effect on the date of posting on the Company’s website, unless otherwise required by applicable law.
If you are a high-net-worth individual, a family office, or an institution seeking a more disciplined, more transparent, and more considered approach to investment management and private brokerage, we would welcome the opportunity to speak with you.
Enquiries are handled with complete discretion. All consultations are obligation-free.
