1. Data Controller & Legal Framework

Onyx Dynamics Ltd ("we", "us", "our") processes personal data in accordance with the Mauritius Data Protection Act 2017 (DPA) and, where applicable to EU data subjects, the General Data Protection Regulation (EU) 2016/679 (GDPR).

Data Controller:

Onyx Dynamics Ltd
The Trademark, 550 La Promenade
2nd Floor, Offices 201 & 202
Telfair, 80829, Moka, Republic of Mauritius

Data Protection Officer: Jan Nagel
Email: [email protected]

2. International Data Transfers (Schrems II Compliance)

We are domiciled in the Republic of Mauritius. However, our technical infrastructure relies on sub-processors located in third countries (specifically the USA and EU). We ensure the protection of your data through the following mechanisms:

  • Adequacy Decisions: Transfers to the EU (or from EU to Mauritius) are covered by the European Commission's adequacy decision regarding Mauritius.
  • Standard Contractual Clauses (SCCs): For transfers to US-based providers (Cloudflare, Google, Meta), we rely on the European Commission's 2021 Standard Contractual Clauses (Module 2: Controller to Processor) combined with supplementary technical measures (encryption at rest and in transit).

2.1 Authorized Sub-Processors

  • Cloudflare, Inc.: Website hosting, CDN, security, and performance. Data may be processed globally on Cloudflare's network.
  • Google LLC: Tag Manager, Analytics, Ads, Fonts, and embedded YouTube content where used on this site.
  • Meta Platforms, Inc.: Meta Pixel, Facebook/Instagram advertising measurement, and WhatsApp customer communication.
  • Microsoft Corp (Office 365): Email, scheduling, and administrative document storage.

3. Purpose & Legal Basis of Processing

We only process data where we have a clear legal basis. The following table outlines our processing activities:

Processing Activity Data Points Legal Basis (GDPR / DPA) Retention Period
Website Security IP Address, User Agent, Referrer Legitimate Interest (Art. 6(1)(f))
Network security and fraud prevention. 		30 days (log files)
Website Analytics & Marketing Device identifiers, browsing events, page views, campaign attribution Legitimate Interest (Art. 6(1)(f))
Audience measurement to improve the website and marketing effectiveness. See §7. 		Per vendor policy (typically 14–26 months)
Quotes & Invoicing Name, Billing Address, Email, Phone Contractual Necessity (Art. 6(1)(b))
Performance of service/sale. 		7 years
(Statutory tax obligation per MRA)
Demo Booking Name, Phone, Physical Location Contractual Necessity (Art. 6(1)(b))
Logistics coordination. 		3 years post-service
(Civil liability limitation)
Chatbot / WhatsApp Message Content, Phone No. Consent (Art. 6(1)(a))
Voluntary initiation of contact. 		Until thread deletion or 12 months inactivity

4. Communication via WhatsApp

Specific Disclosure Regarding WhatsApp

We offer communication via WhatsApp for your convenience. By initiating a chat with us on WhatsApp, you acknowledge and accept that:

  1. Metadata Processing: WhatsApp (Meta) processes metadata (who communicated with whom, when, and from where) independently of Onyx Dynamics Ltd.
  2. Jurisdiction: This metadata may be processed in the United States under US surveillance laws (e.g., FISA 702).
  3. Consent: If you do not wish to assume this risk, please contact us via email or telephone instead.

5. Your Rights (DSAR)

Under the Mauritius DPA and GDPR, you have the right to request access, rectification, erasure, or portability of your data.

  • To exercise rights: Email [email protected] with the subject line "DSAR Request".
  • Response Time: We are legally required to respond within 30 days.
  • Right to Complain: You have the right to lodge a complaint with the Mauritius Data Protection Office or your local supervisory authority.

6. Security Measures & Breach Protocol

Security Controls: We implement SSL/TLS encryption for data in transit. Access to personal data is restricted to employees with a specific operational need.

Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify:

  1. The Data Protection Office (Mauritius) within 72 hours of becoming aware of the breach.
  2. Affected users without undue delay, if the breach poses a high risk to their personal security.

7. Cookies, Analytics & Similar Technologies

When you visit e-foil.mu, we and our service providers use cookies, pixels, tags, and similar technologies to operate the site, measure traffic, and understand how visitors use our pages. By continuing to use the Website, you acknowledge this processing as described below. You may opt out at any time using the controls in this section.

7.1 Strictly necessary

These are required for security, delivery, and basic site function — for example Cloudflare bot protection and CDN delivery (__cf_bm, cf_clearance). They cannot be disabled without breaking the site.

7.2 Analytics & measurement

We use Google Tag Manager (container GTM-WPJWS7QL) to load Google Analytics 4 (measurement ID G-XG5EX3F8VV). These tools collect anonymised or pseudonymised usage data such as pages viewed, session duration, device type, approximate location, and referral source. We use this to improve content, measure demo and quote interest, and understand marketing performance.

Typical identifiers include _ga, _ga_*, and _gid. Retention is governed by Google's policies (typically up to 26 months).

7.3 Marketing & third-party embeds

We may use Meta Pixel and Google Ads tags when enabled for advertising measurement. Embedded YouTube videos and social links may set third-party cookies when you interact with them or leave our Website. WhatsApp links open Meta's platform under its own terms — see §4.

7.4 How to opt out or control cookies

  • Browser settings: Most browsers let you block or delete cookies. See your browser's help pages for instructions.
  • Google Analytics opt-out: Google Analytics Opt-out Browser Add-on.
  • Contact us: Email [email protected] with the subject "Cookie opt-out" and we will note your preference.

For a full list of services, cookie names, and retention periods, see our Cookie Policy.

See also: Imprint · Cookie Policy · Terms & Conditions