Privacy Policy

Effective date: 15 October 2026 (as may be amended from time to time in accordance with Clause 12 hereof).

Clause 1 — Status, Acceptance and Scope

1.1  This Privacy Policy (the "Policy") is issued by Setu Investments Ltd, a private company incorporated in the Republic of Mauritius (the "Company", "we", "us" or "our"), and governs the collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure by transmission or otherwise making available, and erasure of personal data (collectively, "Processing") arising out of or in connection with the website operated at setu.ltd (the "Website").

1.2  By accessing, browsing or otherwise making use of the Website, and by submitting data through any form, scheduling interface or communication channel made available thereon, the person so acting (the "Data Subject", "you" or "your") acknowledges that they have read, understood and accepted this Policy in its entirety, and expressly consents to the Processing described herein, save where an alternative legal basis is stipulated.

1.3  This Policy applies solely to Processing conducted by the Company through the Website. It does not extend to, and the Company accepts no responsibility whatsoever for, the data practices of third-party platforms, websites or services to which the Website may link or through which the Website may operate, each of which is governed by its own terms and privacy instruments.

Clause 2 — Definitions

2.1  For the purposes of this Policy: "Personal Data" means any information relating to an identified or identifiable natural person; "Act" means the Data Protection Act 2017 of Mauritius, as amended; "Commissioner" means the Office of the Data Protection Commissioner established under the Act; and "Third-Party Providers" means the service providers enumerated in Clause 5.

Clause 3 — The Controller

3.1  The Company is the data controller in respect of all Personal Data processed through the Website. Registered office: New Grove, Grand Port, Republic of Mauritius. Correspondence regarding this Policy or the Processing of Personal Data shall be directed to info@setu.ltd.

Clause 4 — Categories of Personal Data Collected and Purposes of Processing

4.1  Inquiry correspondence. Where a Data Subject transmits an inquiry via the electronic contact form made available on the Website, the Company Processes the Data Subject's name, electronic mail address, subject matter and message content, for the purposes of responding to such inquiry and maintaining a record of business correspondence.

4.2  Document requests. Where a Data Subject requests access to the Company's published whitepaper via the gated download form, the Company Processes the Data Subject's name and electronic mail address for the purposes of delivering the requested document and evidencing legitimate interest in the Company's project materials.

4.3  Meeting scheduling. Where a Data Subject elects to schedule a meeting through the scheduling interface made available on the Website (operated by Calendly), the Data Subject's name, electronic mail address and any voluntarily supplied meeting particulars are Processed for the purposes of arranging, conducting and following up upon such meeting. Such data is processed on the Third-Party Provider's platform and subject to that provider's own privacy instrument.

4.4  Technical and operational data. The Company's hosting provider records standard server log data — including internet protocol address, browser type and version, resources requested, and timestamps — for the purposes of network security, fault diagnosis, abuse prevention and operational integrity of the Website.

4.5  The Company does not, through the Website, engage in automated decision-making or profiling, nor does it collect special categories of personal data. The Company does not sell, rent or trade Personal Data to any person whomsoever.

Clause 5 — Legal Bases, Third-Party Providers and International Transfers

5.1  Processing of inquiry correspondence, document requests and meeting data is founded upon the Data Subject's freely given, specific, informed and unambiguous consent, manifested by the voluntary submission thereof, it being understood that such consent may be withdrawn at any time by written notice to info@setu.ltd without affecting the lawfulness of Processing carried out prior to withdrawal. Processing of technical log data is founded upon the Company's legitimate interest in preserving the security and availability of the Website.

5.2  The Company engages the following categories of Third-Party Providers: (a) Web3Forms, for the transmission of form submissions to the Company's designated mailboxes; (b) Calendly, for meeting scheduling; (c) Spaceship, for web hosting and server log retention; and (d) Google Fonts and Cloudflare (cdnjs), for the delivery of display assets, in the course of which standard request metadata may be transmitted to such providers.

5.3  Certain Third-Party Providers may Process Personal Data in jurisdictions outside the Republic of Mauritius. In engaging such providers, the Company relies upon their contractual commitments and published privacy instruments as affording appropriate safeguards, and keeps such engagements under periodic review.

Clause 6 — Cookies and Similar Technologies

6.1  The Website does not deploy first-party analytics, advertising or marketing cookies. Embedded third-party components — including, without limitation, the Calendly scheduling widget — may set cookies or analogous local storage under their own policies, over which the Company exercises no control. Data Subjects are advised to consult the relevant Third-Party Provider's privacy instrument for particulars.

Clause 7 — Retention

7.1  Personal Data is retained only for so long as is necessary for the fulfilment of the purposes set out in Clause 4 and for the maintenance of legitimate business records — customarily for a period not exceeding twenty-four (24) months from the date of last interaction between the Data Subject and the Company — save where a longer retention is required by law, regulation, or the establishment, exercise or defence of legal claims. Server log data is rotated in accordance with the hosting provider's standard retention schedule.

Clause 8 — Rights of the Data Subject

8.1  Subject to the provisions of the Act, every Data Subject is entitled to:

(a)  request confirmation as to whether Personal Data relating to them is being Processed, and obtain access thereto together with information concerning the Processing thereof;

(b)  obtain the rectification of inaccurate Personal Data and the completion of incomplete Personal Data;

(c)  obtain the erasure of Personal Data where the conditions prescribed by the Act are met;

(d)  object to, or obtain the restriction of, particular categories of Processing; and

(e)  withdraw consent at any time, in respect of Processing founded upon consent.

8.2  Requests to exercise any of the foregoing rights shall be made in writing to info@setu.ltd and shall be addressed within the period prescribed by the Act. The Company reserves the right to require reasonable verification of the identity of the requesting Data Subject prior to acting upon any such request.

8.3  A Data Subject who considers that the Processing of their Personal Data contravenes the Act is entitled to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Republic of Mauritius.

Clause 9 — Security

9.1  The Website is served over hypertext transfer protocol secure (HTTPS). Personal Data transmitted to the Company or its Third-Party Providers is conveyed over encrypted connections, and access to correspondence repositories is restricted to authorised personnel of the Company. The Company implements technical and organisational measures appropriate to the risk presented by the Processing it undertakes; provided that no method of electronic transmission or storage is wholly secure, and the Company cannot warrant absolute security in respect thereof.

Clause 10 — Limitation of Liability

10.1  To the maximum extent permitted by applicable law, the Company shall not be liable for any loss or damage arising from (a) the acts, omissions or privacy practices of Third-Party Providers; (b) the use of external links made available on the Website, which use is entirely at the Data Subject's own risk; or (c) events of force majeure or circumstances beyond the Company's reasonable control.

Clause 11 — Severability and No Waiver

11.1  Should any provision of this Policy be held invalid or unenforceable, such holding shall not affect the validity or enforceability of the remaining provisions, which shall continue in full force and effect. No failure or delay by the Company in exercising any right hereunder shall constitute a waiver thereof.

Clause 12 — Amendment

12.1  The Company reserves the right to amend this Policy at any time to reflect changes in its Processing operations, legal obligations or commercial arrangements. The effective date appearing at the head of this Policy indicates the date of the most recent revision. Material amendments shall be effected by publication of the revised Policy upon the Website.

Clause 13 — Governing Law and Jurisdiction

13.1  This Policy, and any dispute or claim arising out of or in connection with it or its subject matter, shall be governed by and construed in accordance with the laws of the Republic of Mauritius, and the courts of Mauritius shall have exclusive jurisdiction to adjudicate any dispute arising therefrom.

Clause 14 — Contact

Setu Investments Ltd · New Grove, Grand Port, Republic of Mauritius · info@setu.ltd · +230 5754 1056