Privacy policy

At Grant Thornton we are committed to protecting personal data and to fair and transparent processing. Please read our privacy statement: it will help you to understand how we collect and use personal data from individuals, our clients, suppliers or others during the course of our business. We will only use personal data for the purposes described in this privacy statement or as stated at the point of collection.

We regularly review this privacy statement and may make changes at any time without giving notice.

Our lawful basis for processing

We rely on several lawful basis of processing when we collect and use personal data to operate our business and provide products and services to our clients. These include:

• Public interests – where the processing of data is necessary for providing certain services to clients (eg statutory audit) or for certain requirements we are subject to.
• Legal obligations – in order to comply with the legal and regulatory obligations we are subject to as a provider of regulated services and as a commercial business.
• Contract – in order to perform contractual obligations we may have with an individual or to take steps to enter into a contract with an individual.
• Consent – where an individual has freely given consent at the time their personal data was provided to us.
• Legitimate interests – the legitimate interests can be ours, our clients or other third parties (eg to provide our services, to develop or protect our business, or to keep people informed about relevant products and services) and we always balance the rights of individuals with ours’ and others’ legitimate interests.

Who we share data with? 

We only share personal data with others when absolutely necessary for the purposes for which we hold it and where appropriate contractual arrangements and security mechanisms are in place.

We may pass your personal data to:

• member firms of GTIL where needed to provide services to our clients and for administrative purposes
• suppliers that support us and help provide services to our clients, such as providers of cloud-based software, IT systems, security, archiving storage, recruitment, marketing and payment services
• professional advisors, auditors or insurers, where we are required by law or as reasonably required in the management of our business
• law enforcement or other government and regulatory agencies or to other third parties, where we are required by law, the courts or any legal or regulatory authority we are subject to. We will only provide personal data in this circumstances where permitted or there is a legal requirement.

Whilst we store personal data on servers within Grant Thornton Mauritius premise, we may transfer personal data outside our premise to member firms of GTIL or other third parties that help us run our business. Contractual obligations are imposed on the recipients of any data transferred in order to ensure all personal data is protected to the standard required by the Data Protection law.

How long do we keep personal data? 

We keep personal data only for as long as necessary and this will reflect the requirements of:

• the activity or service for which it is being processed
• any legal, regulatory or contractual requirements
• the time in which any litigation or investigations might arise from providing a service.

Individual's rights

Individuals have certain rights over their personal data that we process as data controllers.

If we process your personal data and you exercise any of your rights we will aim to respond promptly and within any required time limit. However, please note that the length of time it will take us to respond will be dependent on the nature and extent of your request.

You have a right to:

• access – you can ask us for a copy of the personal data that we hold on you
• rectification – if you become aware of any errors or inaccuracies concerning your personal data, please let us know either by updating your details on the website or applications you are registered with or contacting us
• withdraw consent – where we process personal data based on consent, you have a right to withdraw consent at any time. To stop receiving direct marketing emails from us, please click on the unsubscribe link in the relevant email or update your preferences. For any other withdrawals of consent please contact us
• erasure/deletion- you can ask us to erase or delete your personal data when we no longer need it for the purposes it was obtained
• data portability- you can ask for your personal data to be sent to you or to another organisation
• review automated decision making – if we make automated decisions about you, you can ask for those decisions to be reviewed
• restrict or object to our processing - you can ask to restrict or object to our processing of your personal data (eg removal from a marketing subscription list). If you wish to exercise any of your rights, please contact us.

Contacts

If you have any questions about this privacy statement, wish to complain about our use of personal data or exercise one of your rights, please send your correspondence to:

Data Protection Officer
Grant Thornton,
9th floor Ebene Tower,
52, Cybercity,
Ebene 72201,
Republic of Mauritius

This is the website of GTIL, a non-practicing, non-trading international umbrella organisation that does not deliver services. GTIL and its member firms are not a worldwide partnership.  GTIL and each member firm of GTIL is a separate legal entity.