Privacy Policy

Trivanta Ltd ("Trivanta", "we", "us", or "our") operates the website at https://trivanta.cloudand provides the Nectra Suite of platforms and related professional services (the "Services").

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, engage with our Services, or contact us. It is published in alignment with the Mauritius Data Protection Act 2017 (DPA) and, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR).

The data controller responsible for personal data processed through this website is:

Trivanta Ltd
Gentilly Branch Road
Moka, Mauritius
Email: [email protected]
Phone: +230 5927 4240

We collect personal data only when it is necessary to operate our website and deliver our Services:

• Identification & contact data — name, business email, company, telephone number — when you submit our contact form or request a demo.
• Communications — content of messages you send us, including the message body and any attachments.
• Technical data — IP address, browser type and version, device type, operating system, referrer, language, and timestamps.
• Usage data — pages visited, navigation paths, and interactions, collected via Google Analytics (subject to your cookie preferences).
• Behavioural metrics (Microsoft Clarity, with consent)— heatmaps, click and scroll patterns, and anonymised session replays of how visitors interact with our pages. Clarity automatically masks form input values and other sensitive content. Collection only begins after you grant the "Analytics" consent category.
• Security data — anti-abuse tokens (Google reCAPTCHA v3 scores), rate-limit counters, and request logs.

We do not knowingly collect special categories of personal data through this website.

Under the DPA and GDPR, we rely on the following lawful bases:

• Consent — for optional analytics cookies and any marketing communications.
• Performance of a contract / pre-contractual steps — when you contact us about our Services.
• Legitimate interests — for security, fraud prevention, abuse mitigation, and the day-to-day operation of our website, balanced against your rights and freedoms.
• Legal obligation — where we must process data to comply with applicable law (e.g. accounting, taxation, regulatory requests).

• Responding to inquiries received through the contact form, email, or telephone.
• Delivering, supporting, and improving the Services.
• Operating the website, including security, abuse prevention, and reliability monitoring.
• Producing aggregated, anonymised analytics to improve our content and user experience.
• Meeting our legal, regulatory, and contractual obligations.

We do not sell personal data. We share it only with carefully selected processors and only as necessary:

• Hosting & infrastructure providers — to operate the website and Services.
• Email delivery (SMTP) — to deliver responses to your inquiries.
• Google Analytics (GA4) — for aggregated analytics, where you have provided consent.
• Microsoft Clarity & Microsoft Advertising — for behavioural metrics, heatmaps and session replays, where you have provided consent. See the dedicated disclosure section below.
• Google reCAPTCHA v3 — to protect our forms from automated abuse; subject to Google's privacy practices.
• Professional advisors and authorities — where legally required.

All processors are bound by contractual data-processing agreements consistent with the DPA and, where applicable, the GDPR.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioural metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. Additionally, we use this information for site optimisation, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

Microsoft Clarity automatically masks the values typed into form fields and other sensitive content. You can withdraw your consent to Microsoft Clarity and Microsoft Advertising at any time using the "Manage cookie preferences" link in the footer of this site. Withdrawing consent stops further data collection but does not undo data already collected lawfully prior to withdrawal.

Data processed by Microsoft Clarity may be transferred to Microsoft data centres outside Mauritius and the European Economic Area. Such transfers are governed by Microsoft's Standard Contractual Clauses and other safeguards described in the Microsoft Privacy Statement.

Where data is transferred outside Mauritius or the European Economic Area, we ensure appropriate safeguards are in place — such as adequacy decisions, Standard Contractual Clauses, or equivalent legal mechanisms — so that your rights under the DPA and the GDPR continue to be protected.

We retain personal data only for as long as necessary:

• Contact-form submissions — up to 24 months for follow-up and conversion attribution, then deleted or anonymised.
• Analytics data — in line with Google Analytics retention settings (typically up to 14 months).
• Security and access logs — typically 90 days unless required longer for investigation or legal obligation.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure (the "right to be forgotten") where applicable.
• Restrict or object to processing in certain circumstances.
• Request data portability where processing is based on consent or contract.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with the Mauritius Data Protection Office, or with your competent EU supervisory authority.

To exercise any of these rights, email us at [email protected]. We respond within statutory deadlines.

Trivanta applies technical and organisational measures aligned with the ISO 27001 control set, including encryption in transit (TLS 1.2+), least-privilege access, hardened infrastructure, continuous monitoring, and security-by-design product engineering. No method of transmission or storage is perfectly secure, but we work continuously to protect personal data against unauthorised access, loss, or alteration.

Our Services are intended for business use and are not directed at children. We do not knowingly collect personal data from individuals under 16 years of age.

For information about cookies and similar technologies used on this website, see our Cookie Policy.

We may update this Privacy Policy from time to time. Material changes will be highlighted on this page and the "Last updated" date above will be revised. We encourage you to review this page periodically.

Questions about this Privacy Policy or our data-handling practices can be sent to [email protected] or to the postal address listed above.