Version: 2026-09-22
Effective date: 22 September 2026
Applies to: Anyone holding a Paspartou account
Governing law: Republic of Mauritius
1. Who is responsible for your information
1.1 Paspartou is operated by Paspartou App Limited, a private company incorporated in Mauritius (company file no. C238927, business registration no. C26238927), with its registered office at Old Moka Road (L. Baden Powell Avenue), Trianon, Quatre Bornes, Republic of Mauritius. We are the controller of the personal data described in this policy.
1.2 Our registration with the Data Protection Office as a controller is pending. We will add our registration number to this policy once it is issued. We have not appointed a data protection officer. You can contact us about privacy at hello@paspartou.com.
1.3 We follow the Data Protection Act 2017 of Mauritius.
2. What we collect
|
Information |
Why we have it |
|
Mobile number |
Required. It identifies your account and is where we send your sign-in code by SMS. |
|
Name |
So a shop can greet you and confirm the right account at the counter. |
|
Date of birth |
To confirm you are at least 16, and to know whether the protections for 16- and 17-year-olds in clause 11 apply to you. |
|
Gender |
Optional. You may choose not to say, and this never blocks anything. |
|
District and town |
To show you shops near you and to understand where the service is used. |
|
Email address |
Optional. Used only to contact you if you give it. It is never used to sign in to the app. |
|
Preferred language |
So the app and our messages reach you in English, French or Kreol. |
|
Your PIN |
Stored only as a one-way scrambled value. We cannot see or recover your PIN. |
|
Your devices |
Which phones are signed in, so you can see them and remove any you no longer use. |
|
Notification token |
Only if you allow notifications, so we can send them. |
|
Your loyalty history |
What you earned and claimed, at which shop and when. This is the record your balance is calculated from. |
|
Technical records |
Sign-in times, IP address and actions taken on your account, kept as a security record. |
2.1 We do not ask for your identity card number, your address, or any payment card details. You never pay us anything.
2.2 We do not track your location. Where the app shows nearby shops, it uses the district and town you told us.
3. Why we use it, and on what basis
|
Purpose |
Basis |
|
Running your account and your loyalty balances |
Necessary to provide the service you asked for |
|
Sending sign-in codes by SMS |
Necessary to provide the service, and to keep your account secure |
|
Notifying you about your points, rewards and expiry |
Necessary to provide the service. You can switch these off |
|
Detecting and investigating fraud or misuse |
Our legitimate interest in protecting customers and shops |
|
Keeping a security and accountability record |
Our legitimate interest, and where we are required to keep records |
|
Marketing messages |
Your consent, given separately and withdrawable at any time. Never sent to customers under 18 (clause 11) |
|
Understanding overall use of the service |
Our legitimate interest. This uses grouped figures, not individual records |
4. Consent
4.1 When you sign up you are asked to accept our Terms of Use and this Privacy Policy. These are necessary to hold an account.
4.2 Marketing is always a separate choice. It is never bundled with accepting the Terms, and declining it does not limit your account in any way.
4.3 You can withdraw consent for marketing at any time in the app. Withdrawing it does not affect anything we did while it was in force.
4.4 We record which version of each document you accepted, and when.
5. Who we share it with
5.1 We are not in the business of selling personal data and we never sell yours.
5.2 Shops you use Paspartou with. A shop can see your name, the balance you hold with them, and your history with them. A shop cannot see your history with any other shop, and cannot see your date of birth, gender or email.
5.3 Shops are told in their agreement with us that they may use that information only to run their loyalty programme and serve you, and that they may not export it, keep it outside Paspartou, or use it for their own marketing without asking you separately.
5.4 Service providers who help us operate:
- Emtel, our SMS provider, to deliver your sign-in codes — they receive your mobile number and the message
- Google Firebase, our notification provider, to deliver app notifications — they receive a device token, not your identity
- Microsoft Azure, our hosting provider, which stores the data on our behalf and does not use it
5.5 We may disclose information where the law requires it, or to establish or defend a legal claim.
6. Where your information is held
6.1 Your information is stored by Microsoft Azure in its South Africa North region, in South Africa.
6.2 Google Firebase processes device tokens and notification content outside Mauritius.
6.3 We transfer information outside Mauritius only with the protection the Data Protection Act 2017 requires, through the contractual terms we hold with each provider.
7. How long we keep it
7.1 Account information. We keep it while your account is open and for 1 year after it closes. It is then deleted.
7.2 Loyalty transaction records. They stay linked to you while your account is open and for 1 year after it closes. After that we remove what identifies you, as described in clause 8.4. The entries themselves are kept, unlinked, because every shop’s balances and totals are calculated from them.
7.3 Security and accountability records. We keep them for 1 year.
7.4 If you ask us to delete your account, clause 8 applies instead of the 1-year periods in 7.1 and 7.2.
8. Your rights
8.1 Under the Data Protection Act 2017 you may ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete your data, in the circumstances the Act allows
- stop using it for a particular purpose, or object to how we use it
- withdraw consent you gave for marketing
8.2 Write to us at hello@paspartou.com. We will respond within 30 days. There is no charge in normal circumstances.
8.3 Deleting your account — how to ask. In the app, go to Settings and choose Delete my account. If you no longer have the app, use the form at paspartou.com/delete-account. We record your request, and a member of our team completes it within 7 days.
8.4 What we delete. Your name, mobile number, email address, date of birth, gender, district and town, PIN, and your devices and notification tokens. Every device signed in to your account is signed out.
8.5 What we keep, and why. Your loyalty history is a permanent record — entries are added, never edited or removed — because it is what proves each shop’s balances and totals are correct. We keep those entries, but remove everything that links them to you. We also keep security and accountability records for up to 1 year, for security, fraud prevention and to establish or defend legal claims.
8.6 Your points and rewards are lost. Once deletion is completed, any balance you held with any shop is gone and cannot be restored.
8.7 If you also run a shop on Paspartou. Your account is tied to your shop’s signed agreement and invoices. We will contact you to agree how the shop is closed before your account is deleted.
9. How we protect it
- Signing in needs a code sent by SMS to your mobile number; day-to-day access uses a PIN or your fingerprint or face. There are no passwords to steal.
- Your PIN is stored only as a one-way scrambled value.
- Data is encrypted in transit, and at rest by our hosting provider.
- You can see every device signed in to your account and remove any of them.
- We limit how often a sign-in code can be requested, to protect your number from being flooded.
- Actions taken on accounts are written to a tamper-evident record which is checked daily.
- Only a small number of our staff can look up a customer record, and every such lookup is recorded.
10. Automated decisions
10.1 We use automated checks to spot unusual patterns that may indicate fraud. These checks raise a flag for a person to look at — they do not by themselves suspend an account or refuse a reward.
10.2 Where an account is suspended, that decision is taken by a person, and you may ask us to explain it.
11. Age, and customers aged 16 and 17
11.1 You must be 16 or older to hold a Paspartou account. If we learn that an account belongs to someone younger, we will close it and delete the data.
11.2 If you are 16 or 17, these extra protections apply:
- We collect the same information as for any customer, and nothing more.
- We never send you marketing messages, even if you have ticked the marketing box.
- Your information is never used for anything beyond running your account, keeping it secure and the fraud checks in clause 10.
- A parent or guardian may contact us at hello@paspartou.com to exercise your rights on your behalf, including asking for your account to be deleted.
11.3 When you turn 18, these extra protections stop. You can then choose to receive marketing, and we will not send it unless you choose to.
12. Changes to this policy
12.1 We may update this policy. Each version is dated and the version you accepted is recorded against your acceptance.
12.2 Where a change materially affects how we use your information, we will tell you in advance and ask you to accept the new version.
13. Contact
13.1 Privacy questions: hello@paspartou.com.
13.2 General support: the number shown in the app, which you can reach without signing in.