Privacy Policy on Data Protection

The Data Protection Act 2017 (‘DPA’), which came into effect on 15 January 2018, strengthens the control and personal autonomy of data subjects over their personal data in line with international standards, namely with the GDPR and the European Convention for Protection of Individuals with regards to automatic processing of personal data. The DPA also aims to align the Mauritius provisions for data protection with the current and challenging technological and other advancements that have occurred. In this document, the terms “personal data” and “personal information” are used interchangeably.

Our commitment to Data Protection

Crowd Invest Ltd t/a Olive Crowd (‘Olive’ or ‘the Company’), as a trusted and specialist service provider, is committed to safeguard personal information of businesses and investors on its platform. We value your privacy and care on how your personal data is treated. As such, while collecting, processing and managing all such information, including your email addresses and contact numbers, we have processes in place to ensure that such information is kept securely on our systems and in compliance with the DPA. This commitment is driven by our compliance team that oversees, inter alia, the use of personal data in our services. This is acknowledged by all our employees through our Code of Ethics which sets out the standards of correct conduct expected of our employees and which emphasises on all the obligations we place on them, including that of confidentiality.

Moreover, in line with our Code of Ethics, all of our employees, in whatever capacity, are required to sign a confidentiality agreement by virtue of which they undertake to observe the strictest confidentiality in respect of any information acquired in the course of their duties or in connection with their employment relating to the affairs or business of the company, any member or employee of the company, the clients of the company or any person dealing with the company. All information obtained in the execution of the duties entrusted to any employee of the company is always of a confidential nature and is not to be divulged to anybody outside the company except in the course of its business operations.

The importance we give to Data Protection

Data protection is an important aspect of our operations and business, and we fully recognise that. Since the start of 2018, we have invested significant time and resources in our compliance team for it to ensure that our services, processes, policies and marketing materials, amongst others, are in line with DPA. This included a review of all aspects of our privacy and information security compliance, including identification of data processes, risk assessment, policies, and aligning same to the changes brought by the DPA.

Collection of personal data

We have a data protection policy (the “Data Protection Policy”) in place which governs, inter alia, the use and storage of businesses’ and investors’ contacts personal data. For the purposes of the DPA, Olive is a “Controller”. The information that is collected from you includes (but is not limited to): Names, addresses, email address, contact numbers, details on identification documents, employment details, client details.

Why we need personal data

Olive is licensed to operate an equity crowdfunding platform under the Regulatory Sandbox Licence by the Economic Development Board of Mauritius. As part of our licensing conditions and in order to fulfil our legal and regulatory requirements in Mauritius, we need to undertake “Customer Due Diligence” on our clients in their capacity as a principal of an entity to which Olive provides/shall provide services. We need your personal data in order to provide you with a full range of corporate, private wealth, fund and accounting services. All information provided to us is strictly confidential and are not disclosed or revealed to any person or party whatsoever unless we are legally required to do so to a regulatory body or a court of competent jurisdiction in Mauritius or abroad.

What we do with personal data

All personal data are processed at our registered office in Mauritius. No third party has access to such personal data, unless specifically required by law. In certain instances, Olive may be called upon to disclose and transfer personal data to certain jurisdictions which do not afford or guarantee that appropriate safeguards are in place to protect such personal data. In that connection, by providing us with your consent to such disclosure and transfer, you understand and expressly agree that there may be risks involved in such disclosure and transfer being made.

How long we keep it

Under Mauritian law, we are required to keep personal data as follows: • As long as one is a client and contact of Olive. • Where the purpose for keeping personal data has lapsed, Olive shall destroy the data as soon as is reasonably practicable and notify any processor holding the data to destroy the data as specified by Olive. • When a person is no more a client of Olive, for a period not exceeding ten (10) years in line with the prevailing laws of Mauritius. After this period, such personal data will be destroyed. Where you have consented to receive updates and similar materials from us, any personal data held by us for that purpose will be kept by us until such time that you notify us that you no longer wish to.

What are your rights?

Should you believe that any personal data we hold relating you is incorrect or incomplete, you may request to see this information, rectify it or have it deleted. Please contact us by either liaising to your usual contact at Olive or send us an email on [email protected]. com In the event that you wish to complain about how we have handled your personal data, please contact your usual contact at Olive or send us an email on [email protected]. com We will then look into your complaint and work with you to resolve the matter. If you still feel that your personal data has not been handled appropriately according to the law, you may contact the Data Protection Office in Mauritius and file a complaint with them.