GDPR Privacy Notice

This notice supplements our Privacy Policy with information specific to the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR. It applies where AcuFin processes personal data of data subjects in the EEA or the UK.

AcuFin Corporate Limited, acting from Mauritius. Where required by Article 27 GDPR, we will appoint an EU representative, please contact dpo@acufin.global for current details.

Contract (Art. 6(1)(b)), to provide the services you have engaged us for. Legal obligation (Art. 6(1)(c)), to meet AML, FATCA, CRS, beneficial-ownership and FSC obligations. Legitimate interests (Art. 6(1)(f)), to operate the firm, secure our systems, and defend or pursue legal claims. Consent (Art. 6(1)(a)), where required, for example for marketing.

We avoid processing special-category data (Art. 9 GDPR) unless an exception applies (notably substantial public interest under AML/CFT obligations, or your explicit consent).

Personal data may be transferred to Mauritius and other jurisdictions. Where we rely on Article 46 GDPR mechanisms, we typically use the European Commission's Standard Contractual Clauses, supplemented as required by transfer-impact assessments. Mauritius is recognised by some authorities as providing an adequate level of protection; please contact us for the current position.

Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decision-making with legal effects. To exercise rights, email dpo@acufin.global.

You have the right to lodge a complaint with your local supervisory authority, for example the Information Commissioner's Office in the UK (https://ico.org.uk/) or the CNIL in France (https://www.cnil.fr/). We would, however, ask you to contact us first.

Retention periods are set in our Privacy Policy and align with our regulatory obligations under Mauritian law (typically seven years from the end of the engagement for client and KYC records).