Privacy Notice

“Personal data” or “personal information” means any information about an individual from which that individual can be identified. This privacy notice (“Privacy Notice”) applies to personal information processing activities carried out by GuarantCo Limited.  GuarantCo Limited (GuarantCo) is a Mauritian limited liability company, whose registered office is at Level 3, Alexander House, 35 Cybercity, Ebene, Mauritius. In this notice, references to “we”, “us” or “our” are references to GuarantCo.

We, through our manager GuarantCo Management Company Limited (“GMC”), collect, use and are responsible for certain personal information about you.  In doing so GMC is the Data Processor and regulated under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

This Privacy Notice explains why we need to collect your personal information, what information we collect, how we collect it and how we use it. It also sets out the legal basis on which we collect and use your information and the rights you have under the current data protection legislation.

We ask that you read this notice carefully and if you require any further information contact us using the contact details in section 12 below.

We may collect, use, store and transfer different kinds of personal information about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth and gender. This may also include images (such as copies of passports or CCTV images) and photographs, films and video recordings which may be taken at special events organised or attended by GuarantCo.
• Contact Data includes postal address, email address and telephone numbers.
• Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website. Security data such as passwords or memorable information is always encrypted and cannot be accessed by us.
• Profile Data includes your username and password, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing and other information from us and our third parties and your communication preferences.

We may also process certain Special Categories of information for specific and limited purposes, such as detecting and preventing any form of abuse, if it is in the wider public interest (for example, to protect individuals’ well-being) or to make our services accessible. We will only process special categories of information where we have obtained your explicit consent or are otherwise lawfully permitted to do so.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

We use different methods to collect information from and about you including through:

• Direct interactions. You may give us your identity, contact and financial information by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal information you provide when you:
  • apply for financing for a project
  • apply for a job with us
  • submit a response to an invitation to tender (or equivalent)
  • subscribe to our service or publications
  • give us some feedback or submit a complaint.
• Information that we learn about you through our relationship with you.
• Automated technologies or interactions. As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns which may include personal information. We collect this information by using cookies, and other similar technologies. Please see our Cookie Policy for further details.
• GuarantCo Stakeholders: we may receive personal information about you from other associated Companies and entities that provide our funding, or we provide funding to.
• Third parties or publicly available sources. We may receive personal information about you from various third parties and public sources including:
  • analytics providers
  • advertising networks
  • search information providers
  • data brokers or aggregators.
• Know your client (“KYC”) and due diligence. We may carry out KYC and other due diligence checks on potential employees, directors or officers, contractors, clients and suppliers.

We will only use your personal information for the purposes for which we collected it. The main purposes for which we use your information are as follows:

• For procurement and recruitment purposes
• To contract with you
• To manage our relationship with you which will include notifying you about changes to our terms or Privacy Notice
• To administer and protect our business
• To improve our website, products/services, marketing, customer relationships and experiences
• To make suggestions and recommendations to you about services that may be of interest to you
• To keep you informed about GuarantCo
• To process and respond to your enquiry, application or complaint, for example, in respect of an investment proposal, working for GuarantCo or providing products or services to GuarantCo.

We may use your information for another reason where we reasonably consider that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

The data protection legislation allows us to use your personal information for a range of reasons.  These include:

• Consent: where you have consented to our use of your information for a specific purpose
• Contract performance: where your information is necessary to enter into or perform our contract with you (or to take steps at your request before entering into such a contract)
• Legal obligation: where we need to use your information to comply with our legal and regulatory obligations
• Legitimate interests: where we use your information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights
• Vital interests: in rare situations it may be necessary to use your information to protect someone’s life
• Public interest: there may be times when we need to share your personal information to perform a task in the public interest.

Most commonly, we rely on the following lawful reasons to use your personal information:

• to perform the contract, we are about to enter into or have entered into with you
• it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• to comply with a legal or regulatory obligation.

Generally, we do not rely on consent as a lawful reason for processing your personal data other than in relation to sending marketing information and communications to you. You have the right to withdraw consent to this at any time by contacting us.

We may share your personal information with:

• Other companies within our group who provide products or services that you may require or who may be interested in your products or services
• Third parties providing services to us, such as market analysis and benchmarking, agents and sub-contractors acting on our behalf
• Social media companies (in a secure format) or other third-party advertisers (subject to your consent) so they can display relevant messages to you and others about us and our activities
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.

We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

We may need to transfer your personal information within our group and with other organisations including international customers and business ventures in connection with the purposes set out in this Notice.   Typically, your personal information may be transferred between the UK, Mauritius, Kenya, Singapore and the Netherlands, as well as other jurisdictions.

Whenever your personal information is subject to international transfer, we ensure an adequate degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• we only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data; or
• we use specific contract clauses as approved for use in the UK which give personal information the same degree of protection it has in the UK.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorised use or disclosure of your personal information; the purposes for which we process your personal information; and whether we can achieve those purposes through other means, as well as the applicable legal requirements.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are processing it lawfully.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) however, based on your particular situation, it is causing you damage or distress or impacts your rights. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios:
  • if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful, but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal information to you or to a third party, in a structured, commonly used, machine-readable format. This right only applies where we process your personal information by automated means for contractual purposes or with your consent.
• Withdraw consent at any time where we are relying on consent to process your personal information. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

If you have a concern or complaint about the way we have used your information, please contact us and we will do our best to put things right. You may also report any concerns using the following link https://www.pidg.org/report-a-concern.  Additionally, you may have the right to complain to data protection authorities.

The supervisory authority overseeing data protection in Mauritius is the Data Protection Commissioner’s Office who may be contacted at dpo@govmu.org.

In the UK, the supervisory authority overseeing data protection is the Information Commissioner’s Office, who may be contacted at https://ico.org.uk/concerns/handling/ or telephone: 0303 123 1113.

If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact us using the details set out below:

Compliance Manager
c/o GuarantCo Management Company Ltd
6 Bevis Marks
London
EC3A 7BA
United Kingdom
Email address: compliance@guarantco.org

We may update our Privacy Notice from time to time. When we do, we will publish the updated Privacy Notice on our website. If we make significant changes to how we use your personal information we will communicate these to you.  This Privacy Notice was last updated on 26 March 2024.