Privacy Policy

NRT Wealth Ltd ("NRT Wealth", "we", "us") is a company incorporated in Mauritius and licensed by the Financial Services Commission (FSC) as an Investment Adviser (Unrestricted). We take the privacy of our clients, prospective clients, business partners and website visitors seriously.

This policy explains what personal data we collect, why we use it, who we share it with, and what rights you have. It applies when you visit https://nrtwealth.com, use our services, communicate with us, or otherwise deal with us. We process personal data in line with the Data Protection Act 2017 of Mauritius (the "DPA") and, where applicable, other data protection laws such as the EU General Data Protection Regulation (GDPR).

If you give us information about other people, such as family members, beneficial owners, directors or authorised representatives, we assume you are entitled to do so and that the information is accurate. Please make sure those people are aware of this policy.

NRT Wealth Ltd is the controller of your personal data. For any questions about this policy or to exercise your rights, please contact:

NRT Wealth Ltd
40 Silicon Avenue, The Catalyst Building, Ebene, Mauritius
Email: office@nrtwealth.com
Data protection contact: Khenishta Kanhiya

Depending on how you deal with us, we may collect:

• Identity and contact data: name, date of birth, nationality, address, email, phone number, copies of passports or ID documents, photographs on ID.
• Know-your-client and compliance data: proof of address, source of wealth and source of funds information, tax residence and tax identification numbers, politically exposed person status, sanctions screening results, and information about beneficial owners, directors and authorised signatories of legal entities.
• Financial and investment data: details of your assets, accounts, portfolios and transactions, investment objectives, risk profile, knowledge and experience, and suitability assessments.
• Communication data: emails, letters, meeting notes and, where applicable, recordings of phone calls.
• Website data: IP address, browser type, pages visited and similar technical information (see section 10).
• Marketing data: your preferences and interests, where you have agreed to receive information from us.

Some of this data, such as information about criminal offences revealed through screening, may count as special category data under the DPA. We only process it where the law allows, for example to meet our anti-money laundering obligations.

We use personal data to:

• provide investment advice and related services, and manage our relationship with you;
• carry out client due diligence, identity verification and ongoing monitoring;
• comply with our legal and regulatory obligations, including under the Financial Services Act 2007, the Securities Act 2005, the Financial Intelligence and Anti-Money Laundering Act 2002 and FSC rules;
• detect and prevent fraud, money laundering, terrorist financing and other financial crime;
• communicate with you and respond to your enquiries;
• run and improve our website and IT systems, and keep them secure;
• manage risk, keep business records and handle audits;
• send you information about our services, where permitted;
• establish, exercise or defend legal claims.

We process your personal data on one or more of these grounds under the DPA:

• Contract: to enter into or perform an agreement with you.
• Legal obligation: to comply with the laws and regulations that apply to us as an FSC licensee.
• Legitimate interests: for example, managing risk, protecting our business and improving our services, where these interests are not outweighed by your rights.
• Consent: for example, for certain marketing. You can withdraw consent at any time, without affecting processing that took place before.

If you do not provide information we need to meet our legal or regulatory obligations, we may be unable to onboard you or continue providing services.

We do not sell your personal data. We may share it with:

• banks, custodians, brokers, product providers and other financial institutions involved in your investments;
• service providers acting on our behalf, such as IT, cloud hosting, compliance screening and professional advisers (lawyers, auditors);
• our management company, company secretary or administrator, where applicable;
• the FSC, the Financial Intelligence Unit, the Mauritius Revenue Authority and other regulatory, tax, law enforcement or judicial authorities, in Mauritius or abroad, where required by law;
• affiliated or partner firms where needed to deliver our services to you, subject to appropriate safeguards;
• a buyer or successor in the event of a merger, acquisition or sale of all or part of our business.

Anyone processing data on our behalf is bound by confidentiality and data protection obligations.

Because of the international nature of our business, your data may be transferred to other countries, including Switzerland, the European Economic Area, the United Kingdom and other jurisdictions where our service providers or counterparties are based. Where a country does not offer an adequate level of protection, we only transfer data in accordance with section 36 of the DPA, for example by putting appropriate safeguards in place such as contractual clauses, with your explicit consent, or where the transfer is necessary to perform a contract with you or for legal claims.

We keep personal data only as long as necessary for the purposes described above and to meet legal requirements. As a rule, we keep client records for at least seven years after the end of our business relationship or the relevant transaction, as required under Mauritius anti-money laundering legislation, and longer where needed for regulatory, tax or legal reasons. When data is no longer needed, we securely delete or anonymise it.

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. These include access controls, encryption where appropriate, secure storage and confidentiality obligations for our staff and service providers. If a personal data breach occurs, we will notify the Data Protection Commissioner and, where required, affected individuals in line with the DPA.

When you visit our website, we automatically collect basic technical data such as your IP address, browser type and the pages you view. We use this to operate the site, keep it secure and understand how it is used.

Our website only uses cookies that are strictly necessary for it to function.

Our website may contain links to third-party sites. We are not responsible for their privacy practices.

Under the DPA, you have the right to:

• ask for access to the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data or restrict its processing, where there is a legal basis to do so;
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• not be subject to a decision based solely on automated processing that significantly affects you;
• withdraw your consent where processing is based on consent.

Some of these rights are limited where we must keep data to meet legal or regulatory obligations. To exercise your rights, contact us using the details in section 2. We may ask you to confirm your identity before responding.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Data Protection Office of Mauritius:

Data Protection Office
5th Floor, SICOM Tower, Wall Street, Ebène, Mauritius
Website: dataprotection.govmu.org

We may update this policy from time to time. The version published on this page is the current one. This policy does not form part of any contract with you.

Last updated: 06.10.2026