Privacy policy

This Privacy Policy explains how the Mauritius Gymkhana Club ("the Club", "we", "us") handles personal data when you visit this website, contact us, apply for membership, request a booking or use our chat assistant, and what choices you have.

We process personal data in line with the Data Protection Act 2017 of Mauritius, and only as much as we need for the purposes described below. The website does not use advertising or analytics cookies, and we do not sell personal data.

This policy covers personal data collected through the website and the messages that follow from it, such as the emails we send about a booking. Please read it together with our Terms & Conditions.

The Club is the data controller for the personal data described in this policy. It is a private members' club governed by its Rules & Bye-Laws.

Controller

Mauritius Gymkhana Club

Address

Suffolk Road, Vacoas 73420, Mauritius

Telephone

+230 660 1844 (main office)

Privacy requests

adminsecretary@mgc.mu

Depending on how you use the website, we may collect the following.

• Identity and contact details: your name, title, email address, telephone numbers and postal address. Applicants for membership also give a date of birth, nationality, national ID or passport number, marital status and an emergency contact.
• Membership details: the type of membership, a membership account number or code, details of a spouse and children included in a family application, the names and account numbers of a proposer and seconder, typed signatures, and the supporting documents listed under Membership application data.
• Booking and enquiry details: the facility or venue, dates, times and number of people, answers specific to a sport (such as golf handicap or caddy preference), the notes and messages you write, and any file you attach.
• Chat conversations: the messages you type to the chat assistant, its replies and, if you ask for a person to follow up, your email address.
• Technical data: your IP address, browser and device type, the pages requested and the time of each request, plus the identifiers described under Cookies and similar technologies.
• Staff accounts: for Club staff who use the website's administration area, name, email address and role.

We do not ask for information about your health, religion, political opinions or similar. The one document that can reveal sensitive information is the certificate of morality required with an individual membership application, which can show criminal convictions (see Membership application data). Please do not put sensitive details in free-text fields or in the chat.

We collect personal data in three ways.

• Directly from you, when you fill in a form on this website (membership application, sport booking, table reservation, venue hire enquiry or contact form), message the chat assistant, upload a document or write to us.
• From you, about other people, such as your spouse, children, proposer, seconder, emergency contact or colleagues. Please make sure you are entitled to share their details and, where appropriate, that they know you have.
• Automatically, through our servers and the small files described under Cookies and similar technologies, when you load a page or send a form.

Where we rely on your consent, you can withdraw it at any time (see Your data protection rights). Withdrawing it does not affect what we did before.

We do not use personal data collected through the website for profiling, or for decisions made only by a machine that significantly affect you. Membership applications are decided by the Executive Committee, and booking requests are approved by Club staff.

Individual and family applications

The online form asks for:

• personal details: title, surname, first name, date of birth, nationality, national ID number, passport number if you have one, and marital status;
• contact details: postal addresses, telephone numbers and email addresses, and optional profession and business details;
• family details where relevant: your spouse's name and date of birth, and each child's forenames, gender, date of birth and nationality;
• your proposer and seconder: their names, membership account numbers and signatures;
• an emergency contact: name and telephone number;
• whether you have applied before, and when;
• supporting documents: birth certificate, ID card (both sides), proof of address, passport-size photograph, certificate of morality and, if you are married, your marriage certificate.

Corporate applications

The company form asks for the company's name, date and place of incorporation, address, telephone, email and nature of business; the names of its directors; the authorised signatory's name, capacity and signature; and, for each nominated representative, their name, residence address, telephone numbers, email address, the names of family members (and children's dates of birth) where given, and a signature.

How we handle it

• Applications are read by authorised Club staff and by the Executive Committee, which decides each one.
• Documents go from your browser straight to private cloud storage through short-lived secure links. They are not publicly accessible and can be opened only by authorised staff, after they sign in to the Club's administration area.
• The certificate of morality can reveal information about criminal convictions, which the Data Protection Act 2017 treats as a special category of personal data. We ask for it only to assess your application against the admission criteria in the Rules & Bye-Laws, and we limit access to the people who need it for that.
• If you give us details about a child or another family member, you confirm that you are their parent or legal guardian, or are otherwise entitled to do so. We use those details only to process the application and set up the membership.

When you ask to book a sport or facility (such as golf, tennis, squash, padel, five-a-side football, the gym or the swimming pool), join a studio class, or reserve a table at one of the Club's restaurants and bars, we collect:

• your name, email address and telephone number;
• whether you are a member (and your membership code) or a visitor;
• the facility, your preferred date and times, and the number of people;
• answers specific to the activity, such as golf holes, caddy and handicap, tennis court and format, or racket hire;
• any notes you add and, for golf, an optional copy of your MGF golf licence.

Club staff review each request and confirm or decline it. We use Brevo to email you an acknowledgement when you send the request and a message when the Club confirms it, and the same details are emailed to the Club desk that handles the facility (for example the Caddy Master for golf) so that it can act on your request.

A golf licence goes from your browser straight to private cloud storage and is kept with the booking. Only authorised staff can open it.

• Contact form. We collect your name, email address, chosen subject and message. We do not keep a copy in our database: the message is emailed through Brevo to the Club desk that handles your subject, and you receive an acknowledgement. It then sits in that desk's mailbox.
• Venue hire enquiries. We collect your company (optional), name, email address, telephone number, preferred venue and date, expected number of guests and message. We store the enquiry in our database so the events team can prepare a proposal, email it to the events team through Brevo, and send you an acknowledgement.
• Careers. There is no application form: applications reach the Club's HR officer by email, post or in person, with the documents listed on the Careers page. Spontaneous applications are kept on file for six months, as that page says.
• Telephone, WhatsApp and email. We use the details you give to reply. WhatsApp is operated by WhatsApp, under its own privacy policy.

We use your contact details to answer you and to send messages about your request. The website's forms do not add you to any mailing list. They use technical checks, such as a hidden field and rate limits, to stop automated spam.

The chat assistant answers questions about the Club using information from this website and from the Club. It is automated and cannot make bookings, and nobody at the Club will ask you for ID or a signature in the chat.

What we collect

• your messages and the assistant's replies, with the time of each;
• a random conversation identifier, stored in your browser so a conversation can continue (see Cookies and similar technologies);
• if the assistant cannot help and you choose to give an email address so that a person can follow up, that address.

How it works

• To write a reply, your message and the last few messages of the conversation are sent to our AI provider, Groq, together with relevant extracts from the Club's own information. Groq processes this content to produce the reply and may do so outside Mauritius.
• Finding those extracts happens on the Club's own servers.
• Conversations are stored in our database. Authorised staff can read them to follow up requests, check the quality of the assistant's answers and handle complaints.
• When you ask for a person, your email address and the conversation so far are emailed through Brevo to the Club's general and secretary mailboxes.

Conversations are not linked to your name. To ask us to find or delete one, tell us roughly when you used the chat and, if you gave one, the email address you used. Please do not share sensitive information, such as ID or card numbers or health details, in the chat.

Cookies are small text files stored on your device. The website uses only the few that are strictly necessary for it to work securely. It does not use advertising, analytics or social-media tracking cookies, so there is no cookie banner to accept.

Content loaded from other websites

• Google Fonts. The website's typefaces load from Google's servers, so your browser sends Google your IP address and browser details when a page opens.
• OpenStreetMap. The map on the Contact page loads from OpenStreetMap's servers, which may receive your IP address and set their own cookies.

These providers handle that data under their own privacy policies. You can block or delete cookies in your browser settings, but the forms and the chat assistant need the security cookies above and may stop working without them.

We do not sell personal data. We share it only as follows.

Inside the Club

With the staff, officers and committee members who need it to deal with your request: for example the Caddy Master for golf bookings, Reception for table reservations, the events team for venue hire, and the Executive Committee for membership applications.

Service providers

These companies work for us, and only for the purposes in this policy.

Others

• Reciprocal clubs. If you ask the secretary for a letter of introduction to an affiliated club, the letter gives that club the details it needs, such as your name and membership status.
• Authorities and advisers. Where the law requires it, or to establish, exercise or defend legal claims, and to professional advisers such as auditors and lawyers, who are bound by confidentiality.

Transfers outside Mauritius

Our providers are based, or may process data, outside Mauritius: for example in France, the European Union and the United States. Where the Data Protection Act 2017 requires safeguards for such a transfer, we put them in place.

We keep personal data only for as long as we need it for the purposes in this policy, or for as long as the law or the Club's Rules & Bye-Laws require. In practice:

• Messages and enquiries (contact emails, venue hire enquiries): while we reply and follow up, and afterwards only as long as needed to deal with a later question or dispute about the enquiry.
• Bookings and reservations: while the request is handled, and afterwards as long as the Club needs its records and to deal with queries or disputes, for example about a late-cancellation charge.
• Membership applications: if you are admitted, the application becomes part of your member record and is kept for as long as you are a member, and afterwards for as long as the Club's obligations require. If it is not approved, we keep it only as long as needed to deal with the decision and any related question. Supporting documents are removed when the application record is removed.
• Chat conversations: as long as needed to follow up requests, check the quality of the assistant's answers and handle complaints.
• Job applications: spontaneous applications are kept on file for six months, as stated on the Careers page.
• Cookies and technical logs: cookies last as shown in the table above; server logs are kept only as long as needed for security and troubleshooting.

When we no longer need personal data, we delete it or anonymise it, together with any files stored with it. We may keep some records for longer where the law requires, or to establish or defend a legal claim.

We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include:

• Encrypted connections. The website is served over HTTPS.
• Hosting. The website and its database run on servers hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France). The database and the chat assistant's internal components cannot be reached directly from the internet.
• Private file storage. Uploaded documents are not publicly accessible and can be opened only by authorised staff after they sign in.
• Access control. Staff have individual accounts and role-based permissions, so each person sees only what their role needs.
• Abuse protection. Rate limits and anti-spam checks protect the forms and the chat assistant.

No system is completely secure. Please keep your membership details private and do not send sensitive information through the chat or free-text fields. If a personal data breach is likely to put your rights at risk, we will act as the Data Protection Act 2017 requires, including notifying the Data Protection Commissioner and the people affected where the Act so provides.

Under the Data Protection Act 2017 you have the right to:

• be told how your personal data is used, which is the purpose of this policy;
• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• ask for your data to be erased, or its use restricted, in the circumstances the Act provides for;
• object to processing based on our legitimate interests, and to direct marketing;
• not be subject to a decision based only on automated processing that significantly affects you (we make no such decisions);
• withdraw your consent at any time, where we rely on it;
• complain to the Data Protection Commissioner.

To use a right, email adminsecretary@mgc.mu or write to the Club at the address in this policy, saying which right you want to use and giving enough detail for us to find your data. We may ask you to prove your identity first, so that your data never reaches someone else. We will reply within the time the Act allows. Some rights have limits: for example, we may have to keep certain records to meet a legal obligation.

If you are not satisfied with our answer, you can complain to the Data Protection Office of Mauritius (dataprotection.govmu.org). We would be glad to hear from you first and to put things right.

The website shows the names, roles and photographs of committee members and staff, and its news, events and gallery pages may show members and guests. If you appear in a photograph or article and would like it removed or corrected, email adminsecretary@mgc.mu and we will look at your request promptly.

The website links to other sites and services, such as social media sites like Facebook, LinkedIn and YouTube, WhatsApp, the websites of reciprocal clubs and the map provider. We do not control them and are not responsible for their content or for how they handle personal data. Once you follow a link, their own privacy policies apply, and we encourage you to read them.

We may update this policy, for example when we add a service or change a provider. The current version is always on this page, with its date at the top. If a change significantly affects how we use your personal data, we will tell you in a suitable way, such as a notice on the website.

For any question about this policy, or to use your rights, contact us. Please mark your message "Privacy request".

Email

adminsecretary@mgc.mu

Telephone

+230 660 1844 (main office)

Post

Mauritius Gymkhana Club, Suffolk Road, Vacoas 73420, Mauritius

Website hosting and development

Hosting

OVH SAS2 rue Kellermann, 59100 Roubaix, Francewww.ovhcloud.com

Design and development

Visylo Consultingvisylo.tech