Last Updated: 10 December 2024
MERJ Exchange Limited ("MERJ," "we," "us," or "our") is committed to safeguarding your personal data in compliance with the Seychelles Data Protection Act, 2023 and, where applicable, the General Data Protection Regulation (GDPR). This Privacy Policy outlines how we collect, use, disclose, and protect your personal data
1. Who We Are
MERJ operates as a licensed securities exchange under the Seychelles Financial Services Authority. Our services include securities listing and trading, among others.
Contact Information:
- Data Protection Officer (DPO):
Email:
Address: F28 Eden Plaza, Eden Island, PO Box 360, Republic of Seychelles
Phone: +248 434 68 00
2. Applicability of GDPR
While MERJ is based in Seychelles and primarily governed by local laws, we may process personal data of individuals within the European Economic Area (EEA). In such instances, we adhere to GDPR requirements, including transparency, data subject rights, and lawful processing bases.
3. Personal Data We Collect
We collect various types of personal data, including:
- Identity Data: Name, date of birth, national ID or passport details, nationality, tax identification numbers.
- Contact Data: Email address, phone number, physical address.
- Financial Data: Bank account information, transaction history, trading activities.
- Technical Data: IP addresses, browser type, operating system, cookies (refer to our Cookie Policy).
- Regulatory Data: Information required for compliance with anti-money laundering (AML) and know-your-customer (KYC) regulations.
- Communication Data: Records of interactions with our support and communication channels.
4. Purposes and Legal Bases for Processing
We process personal data for the following purposes:
- Service Delivery: To facilitate account creation, manage trading activities, and provide related services.
- Regulatory Compliance: To comply with legal obligations, including AML and KYC requirements.
- Security and Fraud Prevention: To detect and prevent fraud, unauthorized activities, and ensure the security of our services.
- Customer Support: To address inquiries, provide assistance, and improve user experience.
- Business Operations: To analyze and enhance our services and operations.
5. Legal Bases for Processing:
- Consent: Where you have provided explicit consent for specific processing activities.
- Contractual Necessity: Processing necessary for the performance of a contract with you.
- Legal Obligation: Compliance with legal and regulatory obligations.
- Legitimate Interests: Processing based on our legitimate interests, provided they do not override your rights and freedoms.
6. Data Subject Rights
Under the Seychelles Data Protection Act, 2023, you have the following rights:
- Right to Be Informed: About the collection and use of your personal data.
- Right of Access: To request access to your personal data.
- Right to Rectification: To correct inaccurate or incomplete data.
- Right to Erasure: To request deletion of your data under certain conditions.
- Right to Restrict Processing: To limit the processing of your data in specific circumstances.
- Right to Data Portability: To receive your data in a structured, commonly used format and transfer it to another controller.
- Right to Object: To object to the processing of your data based on legitimate interests or for direct marketing purposes.
- Right to Lodge a Complaint: With the Information Commission if you believe your rights have been violated.
To exercise these rights, please contact our DPO at 
We will respond within the timeframes stipulated by applicable laws.
7. Data Sharing and Disclosure
We may share your personal data with:
- Regulatory Authorities: To comply with legal obligations and regulatory requirements.
- Service Providers: Third-party vendors who provide services on our behalf, subject to strict confidentiality agreements.
- Affiliates and Partners: As necessary to provide integrated services.
- Legal and Professional Advisors: For compliance, legal, or audit purposes.
We do not sell or rent your personal data to third parties.
8. International Data Transfers
When transferring personal data outside Seychelles or the EEA, we ensure appropriate safeguards are in place, such as:
- Adequacy Decisions: Transferring data to countries recognized as providing adequate data protection.
- Standard Contractual Clauses (SCCs): Utilizing contractual clauses approved by relevant authorities to ensure data protection.
9. Data Security
We implement robust technical and organizational measures to protect your personal data, including:
- Encryption: Securing data during transmission and storage.
- Access Controls: Restricting access to authorized personnel only.
- Regular Audits: Conducting periodic security assessments and audits.
10. Data Retention
We retain personal data only as long as necessary to fulfill the purposes outlined in this policy and comply with legal obligations. Retention periods are determined based on:
- Legal Requirements: Statutory and regulatory obligations.
- Business Needs: Operational and service requirements.
- Data Subject Rights: Consideration of your rights and requests.
11. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to enhance user experience and analyze website traffic. For detailed information, please refer to our Cookie Policy.
12. Data Breach Notification
In the event of a data breach, we will notify the Information Commission and affected data subjects as required by law, outlining the nature of the breach and mitigation measures taken.
13. Third-Party Links
Our services may contain links to third-party websites. We are not responsible for the privacy practices of these sites and encourage you to review their privacy policies.
14. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. The latest version will be available on our website, and significant changes will be communicated appropriately.
15. Contact Us
For any questions or concerns regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:
- Email:
- Address: F28 Eden Plaza, Eden Island, PO Box 360, Republic of Seychelles
- Phone: +248 434 68 00