Privacy Policy

The South African Chamber of Commerce (“the Chamber”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This notice explains how we collect, use and protect your personal data when you visit our website or deal with us, and what rights you have under the Data Protection Act 2017 of Mauritius (“the Data Protection Act”). It should be read together with our Terms and Conditions of Membership.

1. Who we are

The Chamber is an association registered under the Registration of Associations Act. We are the controller responsible for your personal data, and we are registered as a controller with the Data Protection Office of Mauritius.

Our officer responsible for data protection compliance is Kim Wightman. To ask a question or exercise any of your rights, contact us at:

  • The South African Chamber of Commerce
  • Suite C 208 La Croisette, Grand Baie, Mauritius
  • Telephone: (+230) 269 4400
  • Email: [email protected]

This website is not intended for children, and we do not knowingly collect data relating to children. If a person under 16 is ever admitted as a member or registers for an event, we will ask for the consent of their parent or guardian.

2. The data we collect about you

Personal data means any information from which you can be identified. We may collect, use and store the following:

  • Identity and contact details: name, title, company name, job title, address, telephone number and email address.
  • Membership data: your membership tier, start and renewal dates, and any profile or directory information you choose to give us.
  • Financial and transaction data: invoices, subscription and payment status, and records of payments made to us. Card and other payment details are entered directly with our payment provider, Peach Payments, and are not stored by us.
  • Event data: your registrations and attendance at our events, and any accessibility or dietary requirements you tell us about.
  • Communications data: your marketing preferences, subscriptions, and our correspondence with you.
  • Technical data: IP address, login data, browser type and version, time zone and location, operating system and the devices you use to access this website.
  • Usage data: information about how you use our website and services.

We may also use anonymised statistical data, such as the percentage of visitors who use a particular website feature. This is not personal data because it does not identify you.

We do not intentionally collect special categories of personal data, such as details about your racial or ethnic origin, religious or political beliefs, trade union membership, health, sexual orientation, or genetic and biometric data. We also do not collect information about criminal convictions. The only exception is accessibility or dietary requirements that you choose to tell us about for an event, which may reveal health or religious information. We will use this only with your explicit consent, only to manage that event, and we will delete it shortly afterwards.

If you do not provide the personal data we need to deliver our services or your membership, we may not be able to provide them to you. Where we ask for information that is optional, we will tell you.

3. How your personal data is collected
  • Directly from you: when you complete a form or the membership application, register for an event, make a payment, send us an email, call us, request marketing, or give us feedback.
  • Automatically: as you use our website, we collect technical data about your device and browsing using cookies and similar technologies.
  • From third parties: we may receive technical data from analytics providers such as Google, who may be based outside Mauritius; payment status from our payment provider; and contact details from your employer or organisation where it nominates you as its contact or representative.
4. How we use your personal data

We only use your personal data when the law allows us to. We use it to:

  • respond to your enquiries, because it is in our legitimate interests to do so;
  • register you as a member, administer your membership, invoice you and collect your subscription, and advise you of events and services, because we need to perform our membership services to you;
  • manage event registrations and attendance, because we need to perform the services you have asked for;
  • list your organisation’s name and logo in the Members area of the website, because it is in our legitimate interests to promote the Chamber and its members. We will list an individual’s name or contact details only with your consent. You can ask us to remove or limit any listing at any time;
  • improve our website, services and marketing using analytics, because it is in our legitimate interests to keep our website relevant and develop our business;
  • send you marketing emails, WhatsApp messages or text messages, but only with your consent; and
  • comply with legal or regulatory obligations, including our duties under the Registration of Associations Act to keep a register of members and accounting records and to file an annual return.

Marketing. We do not sell, rent or trade email lists. We will get your express consent before sharing your personal data with any outside company for marketing, including event sponsors and strategic partners. You can withdraw your consent or opt out of marketing at any time by
contacting us or using the unsubscribe link. This does not affect personal data we need to provide the services you have asked for.

Events. Delete this paragraph if you do not photograph or film events: We may take photographs and video at our events and use them in our communications, because it is in our legitimate interests to promote the Chamber. We will tell you at the event, and you can ask us not to use images of you.

Automated decisions. We do not make decisions about you based solely on automated processing, including profiling.

Cookies. You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you do, some parts of this website may not work properly.

Change of purpose. We only use your personal data for the purposes we collected it for, unless we reasonably need to use it for a compatible reason. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis.

5. Sharing your data and international transfers

We may share your personal data with:

  • Service providers who process data on our behalf, including Peach Payments (online payments), Xero (accounting), Mailchimp (email), WhatsApp (messaging), Google (website analytics), and the providers of our website, IT and administration services. We require them by written contract to keep your data secure and to process it only for specified purposes and on our instructions.
  • Professional advisers such as lawyers, accountants, auditors and insurers.
  • The Registrar of Associations. The law requires us to file an annual return that includes the names and postal addresses of our officers and a return of our membership, and the Registrar may inspect our books, documents and register of members.
  • Our members. Under the Registration of Associations Act, members are entitled to inspect the register of members at our office.
  • Regulators and authorities where the law requires it.

Some of these providers store or process data outside Mauritius, including in the United States (for example Mailchimp, Google and WhatsApp), and Peach Payments in South Africa. We transfer personal data outside Mauritius only where section 36 of the Data Protection Act allows it: where we have given the Data Protection Commissioner proof of appropriate safeguards (such as a written contract with the provider), where you have given your explicit consent after being told of the risks, or where another condition in section 36 applies. You can contact us for more information about the safeguards we use.

6. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed without authorisation, altered or disclosed. We limit access to your personal data to employees, agents and contractors who need it for their work, and who are subject to a duty of confidentiality.

If there is a personal data breach, we will notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is
likely to result in a high risk to your rights and freedoms, we will also tell you without undue delay.

7. Data retention

We keep your personal data only for as long as necessary for the purposes we collected it for. Our standard retention periods are:

  • Membership records, the register of members and records of payments by members: for the duration of your membership and [3] years afterwards. The Registration of Associations Act requires us to keep these for at least 3 years.
  • Invoices and accounting records: [7] years after the end of the financial year to which they relate, or longer if the law requires.
  • Event registration and attendance records: [12] months after the event.
  • Accessibility and dietary requirements: deleted within [30] days after the event.
  • Enquiries and correspondence: [12] months after our last contact with you, unless it forms part of a membership record.
  • Marketing preferences: until you withdraw your consent or unsubscribe. We keep a minimal record so that we respect your choice.
  • Website technical and usage data: up to [14] months.

If you ask us to delete your data, we will do so as soon as reasonably practicable unless the law requires us to keep it, for example the register of members. We may anonymise your data for research or statistical purposes, and may then use it without further notice to you.

8. Your legal rights

Under the Data Protection Act you have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct incomplete or inaccurate personal data.
  • Erase your personal data where there is no good reason for us to continue processing it, or where you have successfully objected to its processing.
  • Object to processing based on our legitimate interests, and to direct marketing at any time.
  • Restrict processing, for example while you challenge the accuracy of your data.
  • Withdraw consent at any time where we rely on consent. This does not affect processing already carried out.
  • Not be subject to a decision based solely on automated processing, including profiling, that significantly affects you.

To exercise any of these rights, please contact us using the details in section 1. Access is free of charge. We may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive or excessive, and if we do we will explain why. We may ask for information to confirm your identity. We will respond within one month, and may extend this by a further month for a complex request, in which case we will tell you. If we refuse a request, we will give you our reasons and tell you of your right to complain.

9. Complaints and changes to this notice

You have the right to complain at any time to the Data Protection Office of Mauritius, headed by the Data Protection Commissioner, the supervisory authority for data protection. We would appreciate the chance to deal with your concerns first, so please contact us in the first instance.

We may update this notice from time to time, and will publish the current version on our website. This notice was last updated on 6 November 2026. Please keep us informed if your personal data changes during your relationship with us.