Privacy Policy | Locus

1. Introduction

Locus("we", "our", "us") is a property management platform operated by iSlayer Consultancy Ltd (BRN C26231244), a company registered in Mauritius and the data controller for the personal data described in this policy. We are committed to protecting your personal data in accordance with the Mauritius Data Protection Act 2017 (DPA 2017) and the regulations issued by the Data Protection Office.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights as a data subject.

2. Data We Collect

We collect the following categories of personal data:

Account Information

Full name, email address, phone number, role (landlord, provider, or tenant), and profile photo.

Property Information

Property addresses, type, number of units, rental amounts, and property photos.

Service Provider Information

Business name, service categories, service areas, hourly rates, years of experience, certifications, NIC number (for identity verification), insurance details, and portfolio photos.

Transaction Data

Service request details, quotes, payment amounts, invoices, and payment status.

Communications

Messages exchanged between users through our platform.

Usage Data

IP address, browser type, pages visited, and actions taken on the platform. Collected automatically for security and performance.

3. How We Use Your Data

We process your data for the following purposes:

• To provide and operate the Locus platform
• To match landlords with service providers
• To process service requests, quotes, and payments
• To verify provider identities and qualifications
• To send transactional notifications (service updates, messages, payment confirmations)
• To display ratings and reviews for trust and transparency
• To prevent fraud and enforce our terms of service
• To improve our platform through anonymised usage analytics

4. Legal Basis for Processing

Under the DPA 2017, we process your data based on: (a) your consent provided at registration, (b) the necessity of processing for the performance of our service contract with you, (c) our legitimate interest in operating a safe and reliable platform, and (d) compliance with legal obligations.

4a. Legal Basis under GDPR Art. 6

Where users are located in the EU/EEA, processing is aligned with GDPR Article 6:

Activity	Legal basis (GDPR Art. 6)
Account creation, providing the service	6(1)(b): Contract
Payment processing, tax records	6(1)(c): Legal obligation
Fraud prevention, platform safety	6(1)(f): Legitimate interest
Marketing emails, analytics cookies	6(1)(a): Consent
Identity verification (NIC, KYC)	6(1)(c): Legal obligation

4b. Third-Party Processors

Locus shares limited data with these sub-processors strictly to operate the service. All are bound by data processing agreements and, where applicable, EU Standard Contractual Clauses. Our application, database, and uploaded files are hosted on our own servers at Hetzner in Germany (EU).

Processor	Purpose	Region
Hetzner Online GmbH	Cloud hosting, database, and file storage	EU (Germany)
Sentry	Error and performance monitoring	EU
MIPS (mips.mu)	Card / Juice / MyT Money / MauCAS payments (only when a landlord opts in)	Mauritius
Peach Payments	Card / MauCAS payments (only when a landlord opts in)	South Africa (intra-AU SCCs)
Resend	Transactional email delivery	EU / US (SCCs)
Mapbox	Maps and geocoding	US (SCCs)

A current list of sub-processors and their certifications is available on request from [email protected].

5. Data Sharing

We share your data only in the following circumstances:

• Between users: Your name, profile, ratings, and relevant service details are shared between landlords and providers when a service request is created or accepted.
• Sub-processors: We use Hetzner (cloud hosting, database, and file storage) and Resend (transactional emails), among the sub-processors listed above. These providers process data on our behalf under appropriate agreements.
• Legal requirements: We may disclose data when required by Mauritian law, court order, or regulatory request.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

6. Data Retention

• Active user data: Retained for the lifetime of your account, and for up to 2 years of inactivity before automated review.
• Financial / payment records: Retained for 7 years as required by Mauritian tax and accounting law and aligned with GDPR Art. 17(3)(e).
• Post-deletion residuals: Personal identifiers are erased within 30 days of a deletion request. Anonymized financial / review records remain.
• Messages: Retained for 24 months after the related service request is completed.
• Reviews: Rating retained indefinitely as part of the public trust record; comment text scrubbed on deletion request.
• Audit logs: Retained for 3 years for security and compliance forensics.

7. Your Rights

Under the Mauritius DPA 2017 and (where applicable) the EU GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data via /settings
• Erasure (right to be forgotten): request from /settings; we erase within 30 days, retaining only legally required financial records
• Portability: download a complete JSON export from /settings
• Object to processing based on legitimate interests
• Restrict processing while a complaint or correction is pending
• Withdraw consent at any time for analytics, marketing, and any other consent-based processing
• Lodge a complaint with the Mauritius Data Protection Office or, if applicable, your local EU supervisory authority

To exercise these rights, visit your account settings (/settings) or contact us at [email protected]. This policy is designed for alignment with both the Mauritius Data Protection Act 2017 and the EU GDPR.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including: encryption in transit (TLS), encrypted database connections, role-based access controls, rate limiting on authentication endpoints, webhook signature verification, and regular security audits.

9. Cookies

We use essential cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. Your theme preference (light/dark mode) is stored locally.

10. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email and in-app notification. Continued use of Locus after changes constitutes acceptance.

11. Contact

For privacy-related enquiries or to exercise your data rights, contact our Data Protection Officer:

Email: [email protected]
iSlayer Consultancy Ltd (BRN C26231244), Vacoas, Mauritius
Data Protection Office (Mauritius): www.dataprotection.govmu.org