Privacy Policy

Last updated: September 8, 2026

1. Introduction

This Privacy Policy is intended to ensure transparency in how personal data is managed within HCL Global Advisors ("HCL"). It sets out the principles HCL follows when collecting, using, and protecting personal data in the course of providing advisory services, and explains the rights available to clients under Mauritius's Data Protection Act 2017 (the DPA).

This Privacy Policy applies to personal data of any client or prospective client that is processed by or on behalf of HCL, whether in physical or electronic form. It applies to all advisory services and business activities of HCL, including those conducted through appointed agents or service providers, whether located in Mauritius or in foreign jurisdictions. This includes circumstances where personal data is shared with or held by HCL.

2. Collection of Personal Data

Personal data typically collected by HCL includes, but is not limited to:

• Contact details: name, address, telephone number, email address
• Identification documentation: identity and passport documents, proof of address
• Financial information: source of wealth, bank account and transactional data, tax residency and reporting status
• Due diligence information: other client data required to open and administer the relationship, such as occupation, income, and signature
• Communication records: records of telephone conversations with HCL staff, where applicable
• Screening information: data used for verification purposes such as PEP and sanctions screening, collected and used only where permitted by law

This data may be collected directly from a client, from a person linked to the client, or from a regulatory body.

3. How Personal Data Is Used

Personal data is processed for purposes that include:

• opening, administering and managing client accounts and portfolios;
• providing investment advisory and related services and executing client instructions;
• meeting legal, regulatory and anti-money laundering obligations, including under FIAMLA and applicable FSC rules;
• managing risk, security and the integrity of HCL's systems; and
• responding to enquiries and improving the services offered.

4. Legal Basis for Processing Personal Data

Personal data supplied by a client or obtained on the client's behalf from other sources is held and used by HCL to provide advisory services and maintain the ongoing client relationship. This information is only used where a lawful basis exists. The lawful bases currently relied on are as follows.

A. Performance of Contract

• Opening a client relationship once an application, subscription agreement, or investment agreement has been signed and submitted, together with any supporting documentation requested
• Advising on and administering a client's portfolio and related accounts on an ongoing basis, including processing data connected to redemptions, payment distributions, and future subscriptions
• Sharing relevant data with third parties named in the governing agreements or offering documents, such as auditors, regulators, tax authorities, and technology providers
• Sending periodic reports on portfolio activity
• Responding to client queries and providing support
• Any further purpose set out in the agreements governing the relationship with HCL

B. Legitimate Interest

• Producing statistical analysis and market research to support the advisory business
• Recording of communications, as described in Section 6

A legitimate interest applies only where HCL has a genuine business reason to use the data, and that reason does not unfairly override a client's own rights and interests.

C. Consent

• HCL may, from time to time, send information on financial markets by phone, email, or other reasonable means. Clients can opt out of receiving this at any point
• Consent is not required for the processing purposes described above, but is sought separately before personal data is used for direct marketing
• Consent, once given, can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before that point, and HCL may still be required to process data to meet its regulatory or statutory obligations even after consent for marketing is withdrawn

5. Disclosures to Third Parties and Transfers Abroad

HCL does not sell or rent personal data to third parties. However, data may be handled by HCL or authorised third parties when necessary for service delivery, legal compliance, or legitimate business interests. These parties may include:

• Service providers and appointed agents
• Professional advisers and auditors
• Regulatory and tax authorities

Any data processor acting on HCL's behalf is legally bound to protect personal data to a standard consistent with the DPA. If personal data is transferred outside Mauritius, HCL ensures appropriate safeguards are in place. These safeguards comply with applicable Data Protection Laws. They include adequacy decisions, contractual safeguards, or other legally recognised mechanisms.

6. Security Measures

HCL maintains security measures designed to protect client data against loss, misuse, unauthorised access, disclosure, alteration, and destruction. Access to personal and financial data is restricted to personnel who require it to perform their role.

7. Data Subject Rights

Subject to the DPA, clients hold the following rights over their personal data:

• Right of access: to obtain a copy of personal data HCL holds and to check that it is being used lawfully
• Right to rectification: to have inaccurate or incomplete personal data corrected
• Right to erasure: to request deletion of personal data where there is no good reason for HCL to continue processing it
• Right to restrict processing: to request that HCL suspend the use of personal data in specific circumstances
• Right to data portability: to receive personal data in a portable format
• Right to object: to processing carried out on the basis of legitimate interest, including for direct marketing
• Right to withdraw consent: for processing that relies on consent, at any time

Requests can be sent to the Data Protection Officer. A client who believes personal data has been processed in a way that breaches Mauritius's data protection rules may also lodge a complaint with the Data Protection Office of Mauritius.

HCL aims to respond to requests within one month; if a request is complex, the client will be notified and provided with an updated timeframe.

8. Retention of Personal Data

Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected, including meeting contractual, tax, and regulatory record-keeping requirements. Once the relevant purpose has been achieved, data is securely deleted or anonymised, unless a longer retention period is required or permitted by law. Further detail on specific retention periods can be requested from the Data Protection Officer.

9. Termination of the Client Relationship

Where a client exercises a right of erasure or objects to processing that HCL relies on to provide its services, HCL may, subject to its legal and regulatory obligations, be unable to continue the relationship. This does not affect data HCL is required to retain by law, such as AML/KYC records.

10. Handling of Personal Data Breaches

If a personal data breach is identified, HCL will take immediate steps to assess, contain, and address the incident. Where required under the DPA, HCL will notify the Data Protection Office and any affected individuals without undue delay, and will keep a record of the breach in accordance with its legal obligations.

11. Refusal to Provide Personal Data

The personal data described in Sections 2 and 3 is needed for HCL to open a client relationship, administer a portfolio, and meet the contractual, tax, legal, and regulatory obligations referred to above. If that data is not provided, HCL may be unable to proceed with the contract or meet its legal obligations.

12. Queries and Complaints

Should you have any questions or concerns regarding the processing of your personal data, please contact HCL.

13. Local Data Protection Office in Mauritius

Data subjects have the right to lodge a complaint with the Data Protection Commissioner (see more at dataprotection.gov.mu) if they believe their personal data has been processed in a manner that infringes applicable Data Protection Laws.

14. Changes to This Policy

HCL Global Advisors may update this Privacy Policy from time to time. Any changes will be posted on this page, and the "last updated" date above will reflect the most recent revision.

Disclaimer

HCL Global Advisors is incorporated in Mauritius and licensed as an Investment Adviser (Unrestricted), regulated by the Financial Services Commission (FSC) of Mauritius under the Financial Services Act 2007. This website is for general information only and does not constitute investment, financial, or legal advice.