Privacy Policy
Drovix (MU) Ltd
Authorized and regulated by the Financial Services Commission (FSC) of Mauritius
Investment Dealer (Full Service Dealer) excluding Underwriting, License No. GB21026813
Registered Address: C/o SALVUS (Mauritius) Ltd, Silver Bank Tower, Ground Floor, 18 Bank Street, Cybercity, Ebene 72201, Mauritius
Website: www.drovix.com
Effective Date: March 2026 | Model: A-Book STP Execution
1. Introduction
Drovix (MU) Ltd (hereinafter referred to as "the Company", "we", "us", or "our") is committed to protecting the privacy and confidentiality of personal data belonging to its clients, prospective clients, website visitors, and other individuals whose data the Company may process.
The Company is authorized and regulated by the Financial Services Commission (FSC) of Mauritius under Investment Dealer (Full Service Dealer) excluding Underwriting, License No. GB21026813. This Privacy Policy explains how the Company collects, uses, stores, discloses, and protects personal data in compliance with the Data Protection Act 2017 of Mauritius, the Financial Intelligence and Anti-Money Laundering Act 2002, and other applicable data protection legislation.
2. Purpose and Scope
This Policy applies to all personal data processed by the Company in connection with its business activities, whether collected from clients, prospective clients, employees, contractors, or third-party service providers. It covers personal data processed through the Company's website, Trading Platform, customer support channels, and any other means of interaction with the Company.
3. Definitions
For the purposes of this Policy:
- "Data Controller" means the Company, which determines the purposes and means of processing personal data;
- "Data Subject" means any identified or identifiable natural person whose personal data is processed by the Company;
- "Personal Data" means any information relating to an identified or identifiable natural person;
- "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, restriction, erasure, or destruction;
- "Special Categories of Data" means personal data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data.
4. Categories of Personal Data Collected
The Company may collect and process the following categories of personal data:
4.1 Identity and Contact Information
- Full legal name, date of birth, nationality, and gender;
- Government-issued identification numbers (passport, national ID, driving license);
- Residential address, email address, and telephone number;
- Tax identification number and tax residency information.
4.2 Financial Information
- Source of funds and source of wealth;
- Employment status, occupation, and annual income;
- Investment experience and knowledge;
- Bank account details and payment information;
- Trading activity, transaction history, and Account balances.
4.3 Technical and Device Information
- IP address, browser type and version, operating system;
- Device identifiers and geolocation data;
- Login timestamps, session duration, and access patterns;
- Cookies and similar tracking technologies data.
4.4 Communications Data
- Records of correspondence (emails, chat messages, telephone calls) between the Client and the Company;
- Customer support inquiries and feedback;
- Survey responses and marketing preferences.
5. How We Collect Personal Data
The Company collects personal data through the following methods:
- Directly from the Client: During account registration, identity verification, deposit/withdrawal processes, and customer support interactions;
- From Third Parties: Credit reference agencies, identity verification services, sanctions screening providers, and regulatory authorities;
- Automatically: Through cookies, web beacons, server logs, and similar technologies when the Client accesses the Company's website or Trading Platform.
6. Purposes and Legal Bases for Processing
The Company processes personal data for the following purposes and on the following legal bases:
6.1 Performance of Contract
- Opening and maintaining Client Accounts;
- Executing transactions and processing deposits and withdrawals;
- Providing access to the Trading Platform and customer support;
- Sending transaction confirmations and Account statements.
6.2 Legal and Regulatory Compliance
- Conducting KYC and CDD as required by the FIAMLA and FSC regulations;
- Screening against sanctions lists, PEP databases, and adverse media;
- Filing Suspicious Transaction Reports with the Financial Intelligence Unit;
- Maintaining records as required by applicable laws and regulations;
- Responding to requests from regulatory authorities and law enforcement.
6.3 Legitimate Interests
- Fraud prevention and detection;
- Risk management and internal reporting;
- Improving the Company's products and services;
- Website and platform analytics to enhance user experience;
- Ensuring network and information security.
6.4 Consent
- Sending marketing communications (where the Client has opted in);
- Placing non-essential cookies and similar tracking technologies.
7. Disclosure of Personal Data
The Company may share personal data with the following categories of recipients, subject to appropriate safeguards and contractual protections:
- Affiliated companies within the Drovix group;
- Liquidity providers and execution venues (limited to data necessary for order execution);
- Payment processors and banking institutions (for deposit and withdrawal processing);
- Identity verification and KYC/AML service providers;
- Professional advisers (legal, audit, and compliance consultants);
- Regulatory authorities, including the FSC and FIU, upon lawful request;
- Law enforcement agencies, where required by law or court order;
- Cloud service providers and IT infrastructure partners (under strict data processing agreements).
The Company shall not sell, rent, or otherwise commercially exploit Client personal data to third parties for marketing purposes without the Client's explicit consent.
8. International Data Transfers
The Company may transfer personal data to countries outside of Mauritius for processing purposes. Where such transfers occur, the Company shall ensure that appropriate safeguards are in place to protect the personal data, including contractual clauses, data processing agreements, and compliance with applicable data protection laws.
9. Data Retention
The Company retains personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods:
- Client identification and verification records: Seven (7) years after termination of the business relationship;
- Transaction records: Seven (7) years after the date of the transaction;
- Communications records: Five (5) years from the date of the communication;
- Marketing consent records: Until consent is withdrawn, plus one (1) additional year.
10. Security Measures
The Company implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include:
- Encryption of data in transit and at rest using industry-standard protocols;
- Multi-factor authentication for access to sensitive systems;
- Regular security assessments and penetration testing;
- Access controls based on the principle of least privilege;
- Employee training on data protection and information security;
- Incident response procedures for data breaches.
11. Automated Decision-Making
The Company may use automated decision-making processes, including profiling, in connection with AML/KYC screening, risk assessment, and appropriateness evaluations. Clients have the right to request human review of any decision made solely by automated means that significantly affects them.
12. Data Subject Rights
Under the Data Protection Act 2017 of Mauritius, Data Subjects have the following rights:
- Right of Access: The right to obtain confirmation of whether personal data is being processed and to access such data;
- Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
- Right to Erasure: The right to request deletion of personal data where there is no compelling reason for its continued processing, subject to legal retention requirements;
- Right to Restriction: The right to request restriction of processing in certain circumstances;
- Right to Object: The right to object to processing based on legitimate interests or for direct marketing purposes;
- Right to Data Portability: The right to receive personal data in a structured, commonly used, and machine-readable format;
- Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time.
To exercise any of these rights, the Client should submit a written request to the Company's Data Protection Officer at dpo@drovix.com. The Company shall respond within thirty (30) days of receipt of the request.
13. Children's Data
The Company's services are not directed at persons under the age of eighteen (18). The Company does not knowingly collect personal data from minors. If the Company becomes aware that it has inadvertently collected data from a minor, it will take prompt steps to delete such data.
14. Cookies Policy
The Company uses cookies and similar technologies on its website and Trading Platform to enhance user experience, analyze website traffic, and support marketing activities. Clients may manage their cookie preferences through their browser settings. Further details are available in the Company's Cookie Notice on the website.
15. Policy Updates
The Company reserves the right to update this Privacy Policy at any time. Material changes shall be notified to clients via email or through the Company's website. The Client's continued use of the Company's services after notification of changes shall constitute acceptance of the revised Policy.
16. Contact Information
For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:
Data Protection Officer
Drovix (MU) Ltd
C/o SALVUS (Mauritius) Ltd, Silver Bank Tower, Ground Floor, 18 Bank Street, Cybercity, Ebene 72201, Mauritius
www.drovix.com
Drovix (MU) Ltd | Financial Services Commission (FSC) of Mauritius | License No. GB21026813