Privacy Policy

This Privacy Policy explains how Kosi Xpanda collects, uses, shares and protects your personal data when you visit https://www.kosi.mu (the “website”), contact us or use any of the forms and tools on the website. It is written in line with the Data Protection Act 2017 of the Republic of Mauritius (the “DPA 2017”).

1. Who we are

Kosi Xpanda (“we”, “us”, “our”) is the controller of the personal data described in this policy.

• Address: 8, DBM Building, Industrial Zone, Coromandel, Grand River, Mauritius
• Phone: +230 233 2968/69
• Email: dpo@kosi.mu

For any question about this policy or your personal data, please write to dpo@kosi.mu with the subject line “Data Protection”.

2. Personal data we collect

2.1 Data you give us

• Enquiry and contact forms (Home, Projects, Products and Contact pages): your name, email address, phone number, the type of request (product and service enquiry or job application), the products you are interested in, your preferred contact method, your message and any file you choose to attach (for example plans, photos of your space or a CV).
• Consultation request form (product pages): your name, email address, phone number and the details of your project.
• Job applications: the information and documents you send us, such as your CV and cover letter.
• Chat assistant (“Ask KOSI”): the questions and any information you type into the chat window.
• Direct contact: information you share when you call, email or visit our showroom, including site-visit details, measurements and quotation information.

Please do not send us sensitive personal data (such as health information, religious beliefs or identity documents) through the website. We do not need it to answer your enquiry.

2.2 Data collected automatically

• Technical data: IP address, browser type, device type, pages visited and the date and time of your visit, recorded in server and security logs.
• Website usage data (Google Analytics): if you accept analytics cookies, pages viewed, time spent, clicks, approximate location (city or country), device and browser information, and how you arrived on the website. Google Analytics does not give us your name or contact details.
• Cookies and similar technologies: see section 9 below.

3. Why we use your data and our legal basis

We do not sell your personal data and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Who we share your data with

We only share your personal data where necessary, and with service providers who act on our instructions and must keep it secure:

• Website hosting and email providers, who store the website and deliver form submissions to our team by email.
• Cloudflare, which protects and speeds up the website and may process your IP address and technical data.
• DeepSeek, which processes the messages you type into the chat assistant to generate replies. Messages are sent to DeepSeek’s servers, which may be located outside Mauritius. The chat assistant does not save your conversation on our website.
• Google (Google Analytics and Google Tag Manager, Google Fonts, Google Maps on the Contact page and YouTube videos on product pages), and Meta / Instagram (our Instagram feed), which may receive your IP address and set their own cookies when their content loads. Their use of your data is governed by their own privacy policies.
• jsDelivr, a content delivery network that serves some of the website’s code files.
• Professional advisers and authorities, such as our accountants, auditors, insurers or lawyers, or public authorities where the law requires it.

5. Transfers outside Mauritius

Some of the providers listed above store or process data in other countries. Where personal data is transferred outside Mauritius, we take the steps required by section 36 of the DPA 2017 so that it remains appropriately protected, for example by relying on the provider’s contractual safeguards. By using the chat assistant, you also consent to your messages being processed by DeepSeek outside Mauritius.

6. How long we keep your data

• Enquiries and quotations that do not lead to an order: up to 24 months after our last contact.
• Customer, order, installation and warranty records: for as long as needed to provide after-sales service and warranties, and at least as long as Mauritian accounting and tax laws require (generally up to 7 years).
• Job applications: up to 12 months after the recruitment ends, unless you are hired or ask us to delete your application sooner.
• Technical and security logs: normally no longer than 12 months.

When data is no longer needed, we delete it or make it anonymous.

7. How we protect your data

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS), restricted access to staff who need the information, and security protection for the website. If a personal data breach occurs, we will notify the Data Protection Commissioner and, where required, the people affected, as set out in the DPA 2017.

8. Your rights

Under the DPA 2017, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased or its use restricted in the cases provided by law;
• object to our use of your data, including for direct marketing;
• withdraw your consent at any time, without affecting what we did before you withdrew it;
• not be subject to a decision based solely on automated processing.

To exercise any of these rights, email dpo@kosi.mu. We may ask you to confirm your identity. We will reply within one month.

If you are not satisfied with how we handle your personal data, you may lodge a complaint with the Data Protection Office of Mauritius (dataprotection.govmu.org).

9. Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. We use essential cookies, which the website needs to work, and a cookie that remembers your language. We do not currently use analytics cookies; if we introduce them, they will only be set if you accept them, and you will be able to change your choice at any time. Full details are in our Cookie Policy.

The chat assistant and our forms do not set cookies. Once analytics is in use, you will be able to opt out of Google Analytics through our cookie banner or with Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout). You can also block or delete cookies at any time in your browser settings. Blocking some cookies may affect how the website works, for example remembering your language.

10. Children

Our website and services are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, please contact us so that we can delete it.

11. Links to other websites

The website may link to other websites and social networks, such as Facebook, Instagram and YouTube. We are not responsible for their privacy practices, so please read their own privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page with its update date.