Privacy Policy

This Privacy Policy explains how Exura Prime Ltd ("Exura Prime", "the Company", "we", "us" or "our") collects, uses, discloses, stores and protects personal data, including personal data collected through this website and in the course of our institutional client relationships. Exura Prime Ltd is authorised and regulated as an Investment Dealer (Full Service Dealer, excluding Underwriting) by the Financial Services Commission (FSC) of Mauritius, registration number 235905 GBC · FSC Licence No. GB26206361, with registered address at 5th Floor, Docks 1, The Docks Caudan, Port Louis, Mauritius.

Exura Prime provides institutional liquidity and infrastructure services to professional clients and eligible counterparties only. It is not directed at, and does not provide services to, retail clients. This policy is written primarily for the individuals connected with the institutions we deal with — for example the directors, officers, authorised representatives, beneficial owners and staff of our clients, prospective clients, counterparties and suppliers — as well as for visitors to this website.

1. Introduction and data controller

Exura Prime Ltd is the data controller responsible for the personal data processed as described in this policy. The protection of your personal data matters to us, and we are committed to handling it in accordance with the Data Protection Act 2017 of Mauritius (the "DPA 2017"), which is overseen by the Data Protection Office of Mauritius, the supervisory authority for data-protection matters in Mauritius.

If you have any questions about this policy, or wish to exercise any of your rights, please contact our privacy team at privacy@exuraprime.com.

"Personal data" means any information relating to an identified or identifiable individual. It does not include anonymised data, or data that has been aggregated so that it no longer identifies anyone.

2. The data we collect

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped as follows:

Identity Data — first name, last name, title, role or position and, where relevant for regulatory checks, date of birth, nationality and identification or registration details.
Contact Data — business address, email address and telephone numbers.
Financial Data — bank and payment-account details, and information about source of funds and source of wealth, collected as part of our onboarding and due-diligence checks.
Transaction Data — details of the transactions and dealings carried out through your institution's relationship with us, and payments to and from you or the institution you represent.
Technical Data — internet protocol (IP) address, login and connection data, browser type and version, device information and other technology on the devices you use to access our platforms, tools and FIX connections.
Profile Data — your role, preferences and information relevant to the products and services provided to the institution you represent.
Usage Data — information about how you use our website, platforms and services.
Aggregated Data — statistical or demographic data that we may derive from your personal data but which does not directly or indirectly reveal your identity. Aggregated Data is not personal data in law.

We do not collect any Special Categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade-union membership, and genetic and biometric data), nor do we collect any information about criminal convictions and offences.

3. How your personal data is collected

We collect personal data in the following ways:

Directly from you — when you complete our enquiry or onboarding forms, correspond with us by email, telephone or otherwise, enter into or perform an agreement with us, or use our platforms and services.
From third parties and publicly available sources — including analytics providers (for example Google), advertising networks, identity-verification and sanctions-screening databases, corporate registries and data aggregators, as well as providers of technical, payment and other services who supply information in connection with the services provided to you or the institution you represent.

4. How we use your personal data and our lawful bases

We will only use your personal data when the law allows us to. Most commonly, we will use it in the following circumstances, and sometimes we rely on more than one lawful basis at the same time:

where it is necessary for the performance of a contract we are about to enter into, or have entered into, with you or the institution you represent;
where you have given your consent;
where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
where it is necessary to comply with a legal or regulatory obligation to which we are subject.

We use personal data for purposes including:

to register and onboard a client, and to carry out the customer due-diligence, know-your-business (KYB) and identity checks we are required to complete before we can act;
to process and deliver our services, execute transactions, and collect and manage monies due to and from us;
to manage our relationship with you and the institution you represent, including related notifications and communications;
to administer and protect our business, systems and platforms, including troubleshooting, security and fraud prevention;
to use analytics to improve our website, products, services and client relationships;
to comply with our regulatory and anti-money-laundering and counter-terrorist-financing obligations, including those arising under the Financial Intelligence and Anti-Money Laundering Act (FIAMLA) and the FSC's AML/CFT requirements; and
to meet our regulatory transaction-reporting and international tax-reporting obligations, including under FATCA and the OECD Common Reporting Standard (CRS).

5. Marketing

From time to time we may send you business-to-business marketing communications about our products and services where we believe they may be relevant to the institution you represent, whether you are an existing or a prospective institutional contact. You can ask us to stop sending you marketing communications at any time by emailing us at privacy@exuraprime.com. We will only share your personal data with third parties for their own marketing purposes where you have given your express consent to do so.

6. Disclosures of your personal data

We do not sell your personal data. We may share it with the categories of recipient set out below where this is necessary for the purposes described in this policy:

our group and affiliated entities;
service providers acting as processors on our behalf — including providers of IT, hosting, data storage, analytics, payment processing, and KYC/AML screening services;
professional advisers — including lawyers, auditors, bankers and insurers;
regulators, tax and law-enforcement authorities — including the FSC of Mauritius, tax authorities and law-enforcement agencies — where we are required to disclose information by law or regulation, including reporting under FATCA and the CRS;
trade- and transaction-reporting providers used to meet our regulatory reporting obligations; and
a buyer or other successor in the event of a merger, acquisition, reorganisation or sale of some or all of our business or assets.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes, and we only permit them to process it for specified purposes and in accordance with our instructions.

7. International transfers

Some of the recipients described above are located outside Mauritius, and some of our service providers process personal data outside Mauritius. Where we transfer your personal data outside Mauritius, we take steps to ensure that an appropriate level of protection is applied to it — for example by transferring to a country recognised as providing an adequate level of protection, by using standard contractual clauses, or by relying on binding group-wide data-protection policies — consistent with the DPA 2017.

8. Data security

We have put in place appropriate technical and organisational measures to protect your personal data against accidental loss and unauthorised access, alteration or disclosure. Access to your personal data is limited, on a need-to-know basis, to those employees, agents, contractors and other third parties who have a business need to know, and they are subject to a duty of confidentiality. We have procedures in place to deal with any suspected personal-data breach and will notify affected individuals and the Data Protection Office of Mauritius of a breach where we are legally required to do so.

9. Data retention

We will retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, regulatory, accounting or reporting requirements. Because we are a regulated financial-services firm subject to anti-money-laundering and record-keeping obligations, we are generally required to keep basic records about our clients — including Identity, Contact, Financial and Transaction Data — for at least seven years after the end of our relationship, consistent with FIAMLA and the FSC's record-keeping requirements. In some circumstances we may retain personal data for longer, for example where a legitimate interest, or an actual or potential legal claim, requires it.

10. Your legal rights

Under the DPA 2017, and subject to certain conditions and exemptions, you have the following rights in relation to your personal data:

the right to request access to your personal data;
the right to request correction (rectification) of your personal data;
the right to request erasure of your personal data;
the right to request restriction of processing of your personal data;
the right to object to processing of your personal data;
the right to request the transfer (portability) of your personal data to you or a third party;
the right to withdraw consent at any time where we are relying on consent to process your personal data;
rights in relation to automated decision-making and profiling, including the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; and
the right to lodge a complaint with the Data Protection Office of Mauritius (see section 11).

You will not usually have to pay a fee to exercise your rights. We may need to request specific information from you to help us confirm your identity before we act on your request. We try to respond to all legitimate requests within one month; occasionally it may take us longer, in which case we will notify you and keep you updated.

To exercise any of these rights, contact us at privacy@exuraprime.com or through our contact page.

11. Data-protection complaints

If you have a concern about how we handle your personal data, we would welcome the opportunity to address it. Please contact our privacy team at privacy@exuraprime.com; we will acknowledge your complaint within a reasonable period and work to resolve it. You also have the right to lodge a complaint with the Data Protection Office of Mauritius (Office of the Data Protection Commissioner), the supervisory authority for data-protection matters in Mauritius, 5th Floor, SICOM Tower, Wall Street, Ebène, Republic of Mauritius — tel +230 460 0251, email dpo@govmu.org, dataprotection.govmu.org. We would, however, appreciate the chance to deal with your concerns before you approach the Data Protection Office.

12. Cookies

This website uses cookies and similar technologies. For a full description of the cookies we use, the purposes for which we use them, and how you can manage your preferences, please see our Cookie Policy.

13. Glossary — lawful bases

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you and the institution you represent the best service and the most secure experience. We consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests, and we do not use your personal data where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to act by law).

Performance of Contract means processing your personal data where it is necessary for the performance of a contract to which you, or the institution you represent, is a party, or to take steps at your request before entering into such a contract.

Compliance with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.

14. Contact

Data protection / privacy enquiries — privacy@exuraprime.com

Compliance — compliance@exuraprime.com

Registered address — Exura Prime Ltd, 5th Floor, Docks 1, The Docks Caudan, Port Louis, Mauritius.

We may update this Privacy Policy from time to time to reflect changes in law, regulation, technology or our practices. The current version is always the one published on this website, with the effective date shown above.