Privacy Policy

Who we are

SlipBox Technologies Limited is a managed IT services and cybersecurity company registered in Mauritius, with offices at 35 Lord Derby Street. For the purposes of the Data Protection Act 2017, we are the controller of the personal data described on this page.

If you have a question about this policy or about the data we hold on you, write to us at contact@slipbox.mu or call +230 615 6928.

What we collect, and why

We collect personal data in four situations, and only what each situation needs.

When you visit slipbox.mu. Our website uses Google Analytics 4 to understand how many people visit, which pages they read, and which link or advertisement brought them here. This creates information about your device, your approximate location at city level, and your behaviour on the site. We use it to judge whether our marketing is working, on the basis of our legitimate interest in running our business, and we do not use it to identify you personally.

When you contact us or request a service. If you complete a form on our site, submit one of our advertisement forms on Facebook or Instagram, message us on WhatsApp, or email us, we collect what you tell us: typically your name, your company, your role, your telephone number and your email address. We use it to answer you, to arrange and deliver the service you asked about, and to keep a record of the conversation. The basis is your request itself, that is, steps taken at your request before entering into a contract, and our legitimate interest in following up business enquiries.

When you ask for a prospecting penetration test or a phishing test. These are security assessments carried out only for organisations, only with written scope and permission agreed in advance, and only against systems the requesting organisation controls. Reports and findings are treated as confidential to that organisation.

When you become a client. We hold the contact and technical information needed to deliver the services contracted, under the contract between us and where applicable our legal obligations.

Cookies and similar technologies

Google Analytics sets cookies on your device to recognise repeat visits and measure traffic. You can refuse or delete cookies through your browser settings; the site will continue to work.

Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing.

We use service providers who process data on our behalf: Google, for website analytics; Meta, for advertising and for enquiries that arrive through Facebook, Instagram or WhatsApp; and Microsoft, for our email and document storage. These providers may process data outside Mauritius, which means a cross-border transfer under Article 36 of the Act. We rely on the data processing terms and standard contractual clauses each of them imposes as part of our agreement with them.

We may also disclose data where the law requires it, for example to the Data Protection Commissioner or another authority acting within its powers.

How long we keep it

Website analytics are retained by Google for up to 14 months. Enquiries that do not lead to work are kept for 12 months, so that we can recognise you if you come back. Client records are kept for the duration of the relationship and afterwards for as long as our accounting and legal obligations require. Assessment reports are kept for the period agreed in the engagement letter for that assessment. When a retention period ends, we delete or securely destroy the data.

How we protect it

We apply the same technical and organisational measures we recommend to clients: access on a least-privilege basis with multi-factor authentication, encryption in transit and at rest, logging, continuous vulnerability scanning of our own systems, periodic penetration testing, and security awareness training for our staff.

Your rights

Under the Data Protection Act 2017 you may ask us to confirm what personal data we hold about you and to give you a copy; to correct it if it is wrong or incomplete; to erase it, where we have no continuing basis to keep it; to restrict or object to how we use it, including objecting to marketing; and to receive it in a portable form where that applies.

Write to contact@slipbox.mu and we will respond within the time the Act allows. If you are not satisfied with our answer, you may complain to the Data Protection Office of Mauritius.

Changes to this policy

We update this page when our practices change. This version is dated 31 August 2026.