THE MAURITIUS CIVIL SERVICE MUTUAL AID ASSOCIATION LTD

PRIVACY POLICY STATEMENT

1. What the Mutual Aid does and why it collects Personal Data?

The Mauritius Civil Service Mutual Aid Association Ltd (the Mutual Aid Association) is a company incorporated under the Companies Act and its main functions are to grant loan facilities to its members from the public sector and to accept term deposits from the general public. It also runs a Retirement Savings Scheme (RSS) open to the general public where by on retirement the contributor is granted a lump sum. For those purposes the Association collects the name; NID no.; date of birth; place of birth; bank account number and occupation of its members and customers in the application or membership forms. The supply of the personal data is necessary for the processing of applications made to the Association for loan facilities; term deposits and the Retirement Savings Scheme.

2. The Definitions

The terms mentioned in this document carry the following meanings:

Personal data means any information relating to a data subject.

Data subject means an identified or identifiable individual, in particular by reference to an identifier such as a name, an identification number, location data, and an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

Processing means an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller means a person who or public body which, alone or jointly with others, determines the purposes and means of the processing of personal data and has decision-making power with respect to the processing.

Processor means a person who, or public body which, processes personal data on behalf of a controller.

Consent means any freely given specific, informed and unambiguous indication of the wishes of a data subject, either by a statement or a clear affirmative action, Page 2 of 4 by which he signifies his agreement to personal data relating to him being processed.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual�s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

3. The security of the Personal Data the Mutual Aid Association holds

In the fulfillment of its functions, the Association as a responsible financial institution is committed to protecting and keeping its customers� personal data confidential, and to processing the data in a fair and transparent manner, as per the principles laid down in the Data Protection Act 2017 effective from January 15, 2018.

In broad terms privacy principles, underlying the collection, processing and managing of the personal data, are rigorously followed as spelt out below:

(i) personal data of data subjects are processed as per law, and with fairness and transparency;

(ii) the personal data is collected explicitly and specifically for the purposes mentioned above, and are not subject to further processing incompatible with those purposes;

(iii) only personal data adequate, relevant and limited to those purposes are collected and are processed in relation to those purposes alone;

(iv) the personal data collected are accurate and regularly updated, and destroyed when no longer required by shredding or dumping;

(v) the personal data is kept in a form which permits identification of the data subjects, and for such time period as is defined in the Banking Act; the Data Protection Act or other relevant legislation;

(vi) the personal data is processed in accordance with the right of data subject including the giving or withdrawing of their consent; their right to access to or object to processing of their personal data including by automated decision making.

(vii) the personal data is subject to stringent security measures and the technologies and procedures used to protect personal information include the following:

- Protection against accidental loss

- Prevention of unauthorized access, use, destruction or disclosure

- Measures taken to ensure business continuity and disaster recovery

- Restricted access

4. Data Retention Period

As per legal and regulatory requirements your personal data will normally be kept for a minimum prescribed period after the end the contractual relationship with you� viz 7 years for purposes of Banking Act 2004.

5. Other purposes for which your personal data may be used

The personal data collected will normally be used to process the applications as mentioned at para.1 above. For official enquiries by authorised bodies, the personal data may have to be made available to the Courts; the Police; Bank of Mauritius; Ombudsman for Financial Services; FIU or FSC.

Upon your consent the Association may also use the personal data of its members and customers to inform them of new products and offers of the Association, for automated decision and profiling and to share same with regulatory bodies (e.g. the Bank of Mauritius for MCIB purposes); insurance companies (for purpose of insurance cover of their loans); postal services (for dispatch of automated statements and advices); lenders (for pari-passu security or pledge for loans) the Ombudsman for Financial Services (for customers complaints) and other third parties upon the latter�s request and consent.

6. Recipients of personal data for processing on behalf of the Mutual Aid Association Ltd.

The Association may have recourse to a processor for issue of credit advice and loan statement for loans; interest payment for Fixed Deposits; and statement for Retirement Savings Scheme, for which an appropriate confidentiality/Security Agreement has been signed with the Processor.

7. Use of cookies

The Association intends to use cookies and similar technologies to store and manage user preference on its website, and to advertise, enable content or otherwise analyse user and usage data. Further, information may be obtained in the Association�s cookies Policy from the website of the Association.

8. Reference to Data Protection Commissioner

For any issue related to the Data Protection Policy of the Association, the Data Protection Commissioner may be contacted.

9. Rights of data subject

You have a number of rights in relation to the information that we hold about you. These rights include:

� the right to access information we hold about you and to obtain information about how we process it;

� in some circumstances, the right to withdraw your consent to our processing of your information, which you can do at any time. We may continue to process your information if we have another legitimate reason for doing so;

� the right to request that we rectify your information if it is inaccurate or incomplete;

� in some circumstances, the right to request that we erase your information. We may continue to retain your information if we�re entitled or required to retain it;

� the right to object to, and to request that we restrict, our processing of your information in some circumstances. Again, there may be situations where you object to, or ask us to restrict, our processing of your information but we�re entitled to continue processing your information and/or to refuse that request. You can exercise your rights by contacting us using the details set out at Section 11 below.

10. Transfer of personal data abroad

At present your personal data is not transferred abroad. If it will be done in future, the data protection policy will be updated and data subject notified.

11. Queries

If you have any queries about this policy and how it affects you, please contact the Data Protection Officer at m.c.s.mutualaid@intnet.mu or write to the MCS Mutual Aid Association Ltd., 5 Guy Rozemont Square, Port Louis.

12. Change to the Policy

This policy is regularly reviewed and updated when necessary. If we make any significant change, we shall communicate same to you via our website.

***