Data Protection Policy

Version: 2.0
Effective date: 8 October 2026
Next scheduled review: 8 April 2027
Document owner: Xavier Coiffic, Managing Director and Data Protection Officer

This Policy is reviewed at least every six months, and sooner after a material legal, operational, security or service change.

1. About this policy

WOHO SOLUTIONS LTD (“WOHO”, “we”, “us” or “our”) respects the privacy of individuals and is committed to handling personal data responsibly. This Policy explains how we collect, use, disclose, protect, retain and otherwise process personal data in connection with our business, website, communications and services.

We aim to process personal data fairly and lawfully, for specified purposes, in a way that is adequate, relevant and not excessive, accurate where necessary, retained only for as long as needed, and protected by appropriate technical and organisational measures.

This Policy is intended to be read alongside our Privacy Policy, which includes our cookie information, our Terms and Conditions, the applicable service agreement and service-level agreement and, where WOHO processes personal data on behalf of a client, the applicable Client Data Processing Agreement (“DPA”). If a signed or otherwise validly accepted agreement contains more specific data-protection terms for a service, those terms apply to the extent stated in that agreement and permitted by law.

2. Who we are and how to contact us

WOHO SOLUTIONS LTD
Emilien Street, Baie Du Cap, Mauritius, 60101
Company registration number: C16139840
General enquiries: [email protected]
Telephone: +230 615 69 06

Data Protection Officer: Xavier Coiffic, Managing Director
Data protection enquiries: [email protected]

WOHO is registered with the Mauritius Data Protection Office as a data controller and data processor:

• Controller registration: C7715, valid from 1 August 2026 to 31 July 2029.
• Processor registration: P2087, valid from 1 August 2026 to 31 July 2029.

Registration should not be interpreted as a certification that every processing activity or service is compliant with every applicable legal requirement.

3. Scope

This Policy covers personal data processed by WOHO in its own business activities and, where relevant, personal data processed on behalf of clients. It applies to:

• website visitors, prospective clients, clients and their representatives;
• suppliers, business partners and professional contacts;
• individuals who contact us for sales, support, consulting, hosting, maintenance or other services;
• employees, contractors, job applicants and prospective personnel, to the extent WOHO processes their personal data;
• end users whose personal data is processed through a client’s website, application, infrastructure or other service managed or supported by WOHO, subject to the client contract and DPA.

The responsibilities WOHO has depend on the processing activity. WOHO may act as a controller for its own business purposes and as a processor when processing personal data on a client’s documented instructions.

4. Controller and processor roles

4.1 WOHO as controller

WOHO generally acts as controller when it determines the purposes and means of processing personal data for its own business activities, such as enquiries, client relationship management, contracting, billing, business communications, recruitment, website security and compliance.

4.2 WOHO as processor

WOHO generally acts as processor when it hosts, stores, backs up, monitors, maintains, secures or technically supports personal data on behalf of a client and in accordance with the client’s documented instructions.

In that situation, the client is generally responsible for determining the purposes and lawful basis of the processing, providing appropriate privacy information, deciding which data may be processed, determining retention requirements and responding to data-subject requests. WOHO will provide assistance where required by the applicable DPA, service agreement or law.

The parties’ actual roles must be assessed in context. Labels in a contract do not override the facts or applicable law.

5. Personal data we may process

Depending on the relationship and service, WOHO may process the following categories of personal data.

5.1 Business, enquiry and account information

• names, business names, job titles and professional roles;
• business and contact email addresses, telephone numbers and business addresses;
• enquiry, quotation, correspondence, support-ticket and account records;
• service preferences, order details, contract information and client instructions.

5.2 Billing and business records

• invoice, payment, bank-transfer and payment-reference information;
• billing and contact addresses;
• company registration and VAT information;
• accounting, tax, transaction and dispute records.

WOHO may use a third-party payment provider for card payments. WOHO does not intend to store full payment-card details itself.

5.3 Website, device and technical information

• IP addresses, browser and device information, timestamps and relevant diagnostic information;
• website access, authentication, security, server and service logs;
• account identifiers, login records and technical configuration details;
• cookie preferences and information collected through strictly necessary website cookies.

5.4 Sales and marketing information

• business contact details and communication preferences;
• records of enquiries, meetings, sales discussions and marketing opt-outs;
• business contact details obtained from professional or business sources, publicly available sources, or commercial business-contact databases and lead-generation platforms.

Where personal data is obtained from a source other than the individual, WOHO will take reasonable steps to assess the source, relevance, accuracy and lawfulness of the data and to provide information where required by law.

5.5 Support, hosting and client data

Depending on the service, client data may include account records, website content, application data, databases, server files, logs, backups, support attachments and other information stored or accessed in the client environment. The client determines the content and purposes of client data, subject to the service agreement and DPA.

5.6 Personnel and recruitment information

Where relevant, WOHO may process contact details, applications, CVs, work history, qualifications, contract information, payment information and other personnel-related information reasonably required for recruitment, engagement, administration, legal compliance or business operations.

WOHO does not routinely seek or process special-category or sensitive personal data for its own HR purposes. If such information is lawfully required or specifically justified, WOHO will assess the legal basis and safeguards before processing it.

WOHO does not normally request National Identity Card or passport details for its ordinary client relationship processes. This statement does not prevent processing where a specific legal obligation or legitimate, documented requirement makes it necessary.

6. Purposes and lawful grounds

WOHO processes personal data only where an applicable lawful ground is available. Depending on the circumstances, this may include:

• taking steps at an individual’s request before entering a contract, or performing a contract;
• complying with legal obligations, including accounting, tax and lawful regulatory requirements;
• pursuing legitimate business interests where permitted, proportionate and not overridden by the individual’s rights and interests;
• consent, where consent is the appropriate legal ground and is validly obtained;
• establishing, exercising or defending legal claims, or responding to lawful requests;
• providing, securing, maintaining and supporting contracted services.

Possible purposes include responding to enquiries, preparing quotations, managing client accounts, delivering services, providing technical support, invoicing, collecting payment, maintaining business records, protecting systems, investigating security events, improving service reliability, recruiting personnel and conducting lawful business-to-business marketing.

The lawful ground is assessed for the relevant activity. WOHO does not assume that legitimate interests or consent automatically makes every activity lawful. Where consent is relied upon, it may be withdrawn, subject to the legal consequences of withdrawing consent for processing already carried out lawfully.

7. Client instructions and client responsibilities

When acting as a processor, WOHO will process personal data on documented client instructions, including instructions in the applicable service agreement, DPA, order, support request or other agreed written record, unless applicable law requires otherwise.

Instructions must be lawful, documented and within the agreed service scope. If WOHO reasonably believes an instruction breaches applicable law or creates an unacceptable security or data-protection risk, WOHO may seek clarification, propose safeguards, decline the instruction or suspend the affected activity where reasonably necessary and permitted by contract and law.

Clients are responsible for, as applicable:

• identifying a lawful basis and complying with their obligations as controller;
• providing privacy information and obtaining consent where required;
• ensuring they are entitled to place data with WOHO and its providers;
• determining what categories of data are placed in the service and setting appropriate retention periods;
• notifying WOHO before processing high-risk, sensitive or specially protected data;
• telling WOHO about mandatory data-residency or transfer restrictions before the service begins;
• managing application code, CMS installations, plugins, extensions, user permissions and credentials unless WOHO has expressly agreed to manage them;
• maintaining independent backups unless a specific WOHO backup or disaster-recovery service expressly covers that responsibility;
• responding to data-subject requests, regulator enquiries and other controller obligations, with WOHO’s assistance where required.

8. Sensitive data, children and high-risk processing

WOHO’s standard hosting services are not intended or approved for sensitive, special-category or otherwise high-risk personal data unless the parties expressly agree in writing following an appropriate assessment.

Clients must notify WOHO before placing such data into a service. WOHO may request additional information, a data-protection impact assessment (“DPIA”), technical or contractual safeguards, or changes to the proposed processing. WOHO may decline or suspend the affected service if risks cannot reasonably be mitigated, subject to contract and law. WOHO cannot guarantee that it can technically detect or prevent all sensitive data from being uploaded.

WOHO will not knowingly collect children’s personal data for its own purposes unless lawfully required or specifically authorised and appropriately safeguarded. A client remains responsible for the lawfulness and safeguards of any client-hosted processing involving children.

A controller is responsible for conducting a DPIA where required by the Mauritius Data Protection Act 2017. Where WOHO acts as processor, it will provide reasonable assistance and relevant information available to it, as required by law and contract. Prior consultation with the Data Protection Office will be undertaken where legally required.

9. Cookies and website technologies

At the date of this Policy, WOHO’s website uses no analytics, advertising or tracking tools. It relies only on the following strictly necessary items:

• __cf_bm and _cfuvid: cookies set by Cloudflare when a contact or newsletter form loads, for security, bot management and protection of the forms from automated abuse.
• woho-theme: kept in your browser’s local storage if you choose a light or dark theme, so the site remembers your choice.
• woho-consent: kept in your browser’s local storage to remember your cookie-consent preferences.

The full details, including how long each item lasts, are in the cookies section of our Privacy Policy.

If WOHO introduces analytics, advertising, social-media tracking or other non-essential cookies, pixels or similar technologies, WOHO will update its cookie information and configure an appropriate consent mechanism before activating those technologies where consent is required. Visitors will be given a meaningful choice to accept, reject or customise non-essential categories and to change or withdraw their choice.

10. Marketing and business communications

WOHO may use relevant business contact information for business-to-business communications where permitted by applicable law. Contact details may come from direct enquiries, existing business relationships, professional sources, public business information or commercial contact databases.

WOHO will assess the source and lawfulness of such data, provide required transparency information, respect applicable consent requirements and honour valid objections or unsubscribe requests. Individuals may ask WOHO to stop direct marketing by using an unsubscribe mechanism where provided or contacting [email protected].

A marketing opt-out does not necessarily require WOHO to erase records that must be retained for contractual, legal, security or suppression-list purposes. WOHO may retain a minimal record of an opt-out to avoid contacting the individual again.

11. Sharing and disclosure

WOHO may disclose or make personal data available, as appropriate, to:

• infrastructure, hosting, cloud, backup, disaster-recovery and security providers;
• email, communication, support, payment, accounting, CRM and business-contact services;
• professional advisers, insurers, auditors and service providers who need the information for a legitimate business purpose;
• clients, where the disclosure is part of a service;
• courts, regulators, law-enforcement bodies or other competent authorities where disclosure is required or authorised by law;
• a successor or transaction party in connection with a genuine business reorganisation, subject to appropriate safeguards and applicable law.

WOHO does not sell personal data. It does not disclose personal data to unrelated parties for their own marketing merely because it holds the data.

11.1 Providers we use

The providers below are part of the services WOHO uses. Not every provider processes client personal data: some handle only WOHO’s own business data, and which ones are involved for a client depends on the service and how it is configured.

• Hosting and cloud infrastructure: Hetzner, Amazon Web Services, Google Cloud, Microsoft Azure, Vultr, Cloud.mu, Vercel and Railway.
• Backup, disaster recovery and file storage: Wasabi, Backblaze and Dropbox, where configured.
• CDN, DNS and website delivery: Cloudflare and BunnyCDN.
• Domain registration: AutoDNS, Domainbox, Namecheap and Porkbun.
• Server and website management: RunCloud, WHMCS and cPanel, WP Umbrella and WPMU DEV.
• Email, collaboration and business software: Google Workspace (including Google Drive), Zoho, Odoo and Adobe.
• Secure remote access: OpenVPN, Twingate and Tailscale, used to restrict and secure administrative access to servers.
• Development: GitHub, Lovable and Meilisearch.
• AI services: Anthropic and OpenAI, depending on what is submitted to them.
• Security and monitoring: server security, threat-detection, uptime and logging tools. These are not named individually, for security reasons.

Providers used may change as services evolve. WOHO is verifying, for each provider, its exact role, the locations involved and the safeguards in place; clients can ask for the current version of this register at [email protected]. Contractual and technical controls will be applied as appropriate to the provider, processing and risks.

12. International transfers and data residency

Personal data may be processed or accessed outside Mauritius, depending on the service, provider, support arrangements, backup configuration and client requirements. Locations may include Mauritius, Germany or other EU locations, the United Kingdom, the United States, South Africa and the United Arab Emirates, including Dubai, where relevant to a particular service. These are possible locations, not a representation that every service uses every location.

WOHO’s standard hosting arrangement is generally based in Germany, and standard backup arrangements are generally in the EU. Enhanced disaster-recovery arrangements may use services with US data centres, including Dropbox or Backblaze, depending on the plan and configuration. The actual location for a client is confirmed against the current provider configuration.

Clients must inform WOHO before service commencement of specific legal, regulatory or contractual residency restrictions. WOHO will make reasonable efforts to accommodate agreed requirements and will record any specific residency commitment in writing. Unless expressly agreed in writing, WOHO does not guarantee that all ancillary processing, including backups, disaster recovery, monitoring, security tools, provider support access or technical diagnostics, remains in one specified country or region.

International transfers will be assessed and arranged in accordance with the Mauritius Data Protection Act 2017 and other applicable law, including applicable requirements for appropriate safeguards, authorisations or other permitted grounds. WOHO will not treat a general privacy-policy statement or consent alone as a universal substitute for any required transfer assessment or legal safeguard.

13. Security measures

WOHO applies technical and organisational security measures appropriate to the nature of the data, the services provided and the risks. Measures may include, where applicable to the environment:

• encryption in transit, encryption at rest and encryption of backups;
• individual accounts and restricted administrative access;
• multi-factor authentication, SSH keys and other secure authentication controls;
• VPNs or private networks, IP restrictions and access logging where applicable;
• access on a need-to-know basis and for legitimate operational, support, security or legal purposes;
• confidentiality obligations for authorised personnel;
• server, application and security logging and monitoring;
• security configuration, maintenance, patching and protective measures appropriate to infrastructure managed by WOHO;
• backup, restoration and incident-response arrangements appropriate to the contracted service.

The exact controls vary by provider, service plan, architecture and technical environment. WOHO does not claim to hold ISO 27001, SOC 2 or other independent security certifications unless this is separately confirmed in writing. Detailed configuration and security architecture may be withheld where disclosure would create security risks or expose confidential operational information.

No internet-based system can be guaranteed to be completely secure. WOHO will take reasonable steps to protect data within the scope of its responsibilities and will review relevant risks as appropriate.

14. Backups, availability and application security

Backups and disaster recovery depend on the service and plan purchased. Unless a written agreement expressly states otherwise, backups are a continuity measure and are not a substitute for a client’s independent backup of important application data, content, databases and configuration.

Restoration depends on the available backup, retention window, integrity, provider capabilities and technical feasibility. WOHO does not guarantee that every item of data can always be recovered.

WOHO is responsible for reasonable security of infrastructure and components it manages under the applicable service scope. Unless expressly contracted to do so, the client remains responsible for application code, CMS software, plugins, extensions, user permissions, application-level vulnerabilities and credentials. Clients must protect passwords, API keys, SSH keys and other credentials, restrict their use, and notify WOHO promptly if they suspect compromise.

15. Personal-data incidents and breaches

WOHO maintains an incident-handling approach intended to identify, assess, contain and mitigate suspected security incidents involving personal data, preserve relevant evidence, record material actions and review lessons learned.

Where WOHO acts as processor and discovers a personal-data breach affecting client data, WOHO will notify the affected client without undue delay and with a target of within 24 hours after discovery. The initial notification may be based on information reasonably available at the time. WOHO will provide further relevant information as it becomes available, including, where known, the nature of the incident, categories of data and individuals affected, likely consequences, containment or mitigation steps and information reasonably needed to support the client’s legal obligations.

The 24-hour target is a contractual operational commitment and does not replace or extend any statutory deadline applying to a controller or processor. The client remains responsible for deciding and making any notifications required of it, subject to law. WOHO will cooperate as reasonably required by the applicable DPA, service agreement and law.

For incidents that do not involve personal data, communications will be proportionate to severity, service impact and applicable contractual commitments.

16. Data retention and deletion

WOHO retains personal data only for as long as reasonably necessary for the purpose for which it was collected or processed, including service delivery, contract administration, accounting, tax, legal compliance, security, dispute resolution and the establishment or defence of legal claims.

Retention periods vary by data type and purpose. WOHO does not apply a blanket five-year retention period to all personal data. Financial and accounting records are retained for the period required by applicable tax and accounting rules. Routine technical logs are generally retained for approximately 30 days, unless a longer period is reasonably needed for a security investigation, legal obligation, dispute or audit.

Where practicable, data will be deleted or anonymised when it is no longer required. Data may remain in backups for the normal backup lifecycle, subject to access restrictions and secure deletion or overwriting.

For client data after termination, the production copy is deleted in accordance with the applicable service agreement and DPA. Under WOHO’s standard arrangement, backup copies may remain for up to three weeks through the normal backup lifecycle before deletion or overwriting, unless law, a legal hold, an active investigation or another lawful requirement requires retention for longer.

Clients should request and complete exports before termination. WOHO will provide reasonable technical means for export where supported. Additional migration or export assistance beyond standard arrangements may be charged at normal rates. Export format and compatibility depend on the service and technical feasibility.

17. Data-subject rights and requests

Individuals may have rights under the Mauritius Data Protection Act 2017, depending on the circumstances, including rights to request access, correction, erasure or destruction, to object to certain processing, to withdraw consent where consent is the basis, and other rights provided by applicable law.

Requests concerning WOHO’s own controller activities may be sent to [email protected]. We may ask for information reasonably necessary to verify identity and locate the relevant data. We will handle requests within the time limits and subject to the conditions, exceptions and restrictions provided by law. Requests are generally handled without charge, except where a fee or refusal is permitted by law, including in certain manifestly excessive or unfounded cases.

Where WOHO processes data on behalf of a client, the request should normally be directed to the client as controller. WOHO will refer the request to the relevant client where appropriate and provide reasonable assistance as required by the DPA and contract. WOHO will not independently decide a client’s response unless required by law or authorised by the client.

Individuals may also complain to the Mauritius Data Protection Office. Its official website is dataprotection.govmu.org.

18. Disclosure required by law

WOHO may disclose personal data where required or authorised by applicable law, court order or a competent authority. Where legally permitted and reasonably practicable, WOHO will notify the affected client before disclosure and will limit disclosure to the information required or lawfully requested.

19. Records, accountability and impact assessments

WOHO maintains or will maintain appropriate records of processing activities for its controller and processor activities as required by law. It also maintains appropriate supporting documentation for security, incidents, client instructions, subprocessors, retention and international transfers, proportionate to the nature and scale of the relevant processing.

Where a DPIA is legally required, the controller is responsible for ensuring that it is completed. When acting as processor, WOHO will provide reasonable assistance and relevant information available to it. Prior consultation with the Mauritius Data Protection Office will be undertaken where legally required.

20. Automated decision-making

WOHO does not currently use personal data for solely automated decision-making or profiling for its own purposes that produces legal effects or similarly significant effects on individuals. If this changes, WOHO will assess the applicable legal requirements and update this Policy where appropriate.

21. Confidentiality and access

Access to personal data is restricted to authorised persons who need it for legitimate business, technical, support, security or legal purposes. WOHO requires authorised personnel to observe confidentiality obligations. Access should be limited to the relevant systems and data, and removed when no longer needed.

22. Changes to this Policy

WOHO may update this Policy to reflect changes in law, services, providers, systems or processing practices. The current version will be published on our website with its effective or last-updated date. Where a change materially affects a client’s contracted processing, any additional notice or agreement required by the contract or law will be provided.

23. Contact

For privacy or data-protection enquiries, requests or complaints to WOHO:

Data Protection Officer: Xavier Coiffic
Email: [email protected]
Address: WOHO SOLUTIONS LTD, Emilien Street, Baie Du Cap, Mauritius, 60101

You may also contact the Mauritius Data Protection Office through its official website: dataprotection.govmu.org.