The FutureList Platform Privacy Policy

Privacy notice

This notice explains:

• who we are
• what kinds of personal data we collect
• why we collect it
• where we get it from
• how we use it
• who we might share it with
• how we store and secure it
• how long we keep it
• your rights; and
• how to complain about our use of personal data

WHO WE ARE

Company name: African Leadership International Limited (“ALI”, “we”) Company type: private company limited by shares Registered in: Mauritius Business registration number: C14117099 Registered office address: 6th Floor, Tower A, 1 Exchange Square, Wall Street, Ebène, 72201,Mauritius. ALI acts as a controller of the personal data in the The FutureList platform.

WHY WE COLLECT PERSONAL DATA

The FutureList is a platform that maps the innovation ecosystem across the world. It provides an online community and searchable database to help connect:

• innovation- and technology-centered start-ups that need funding
• potential investors
• R&D collaborators;
• business accelerators /innovation hubs; and
• other support services.

The objective is to build meaningful connections and partnerships to support innovators and help them thrive. To do this, we use names and business contact details supplied by our members along with data from publicly accessible sources.

We never sell personal data to anyone for any purpose. We do not give personal data to others for their own use.

KINDS OF PERSONAL DATA WE COLLECT

We do everything possible to minimise the amount of personal data we collect.

Personal data we always collect:

• Names and email addresses of registered users
• your IP Address and referral IP addresses

Personal data we sometimes collect, depending on the circumstances:

• Information about your organisation, such as the names, roles, contact details, and social media profiles of key personnel.

WHERE WE GET YOUR PERSONAL DATA FROM

We collect personal data about registered website users directly from them when they register their accounts.

We also get any information about the organisations in the database directly from registered users.They can add new listings for organisations and then add details about the organisation’s personnel.

We may add new organisations to the database ourselves. However, we will only add personal data about an individual associated with these organisations where either: (i) we have the individual’s permission; or (ii) the personal data is available from a publicly accessible source, such as an official company registry

We may collect information about an organisation from publicly accessible sources, such as company registries. This could include, for example, the names of directors and persons with significant control.

HOW WE USE YOUR PERSONAL DATA – LEGAL BASIS FOR PROCESSING

Under the law, we must process your data lawfully, fairly, and transparently. Depending on our purposes for using data, we rely on one of four legal bases:

• our legitimate interests;
• to comply with the law;
• your consent; or
• to perform our contract with you (providing your user account)
• In greater detail:

We do not collect any “special categories” of personal data as defined in the Data Protection Act 2017 (Mauritius) or the GDPR (European Union).

DIRECT MARKETING

We may send you marketing materials or news articles by email if you are an existing or previously registered user, or if you are a potential business client. You have the right to opt out of receiving marketing from us at any time by:

• contacting us by email at [email protected]
• using the ‘unsubscribe’ link at the bottom of the email.

We never sell personal data to anyone for any purpose. Also, we will not give your data to others for their own use without your permission.

WHO WE SHARE PERSONAL DATA WITH

The personal data held in the platform is, for the most part, available for both guest users and registered users to search and view.

The personal data will also be accessible to the following external data processor: Start-Up Nation Central Ltd. (CC), whose principal place of business is 28 Lilienblum St., Tel Aviv, Israel (“SNC”).

SNC is the creator and owner of the Global Finder platform. SNC licenses this platform to ALI through a commercial agreement. This allows SNC to monitor ALI’s deployment of the platform, such as by checking the quality of the data, and how users are engaging with the platform in order to improve the usability (for example, where users click on the platform and where users stop their engagement with the platform and leave the site) and of the organisations that ALI includes in the database.

SNC is obliged by the contract not to act as a controller of the The FutureList data – in other words, they can access the data to monitor how Finder Africa is deployed, but they are not allowed to take copies or reuse the personal data for their own purposes; rather, they are only permitted to use aggregated anonymized data.

In addition, we may share your data with other third party processors including vendors who assist us to provide required services to you. Such third party processors are also not allowed to reuse your personal data for their own purposes.

HOW WE STORE AND SECURE PERSONAL DATA

The FutureList data is held in Google Cloud, and hosted in Montreal, Canada.

We have appropriate security measures to protect your personal data against misuse. Only those with a genuine business need have access to your data, and all are under a legal duty of confidentiality.

INTERNATIONAL TRANSFERS

The FutureList data is hosted in Canada, which is a country with adequate data protection laws according to the European Commission

To operate The FutureList, data is regularly accessed from ALI offices in Mauritius and Kenya.

SNC may access the data from their offices in Israel, which is a country with adequate data protection laws according to the European Commission, as well as from locations in the EU and any other country with adequate data protection laws according to the European Commission.

If we need to send data to a country outside Mauritius and Kenya, and that the European Commission has not found to have adequate data protection laws, we will only send the data after we: (i) agree with the data recipient standard data protection contract clauses approved by the European Commission; (ii) take supplementary measures, if necessary, to compensate for any lack of protection afforded by the laws of the recipient country.

If you would like further information about international data transfers, please contact us.

HOW LONG WE KEEP PERSONAL DATA

If you ask us to delete your user account, we will delete your account data promptly, as we will have no further use for it once you stop using the platform.

When we log the IP addresses of website visitors, we delete this data automatically after 30 days.

The remaining personal data in The FutureList is contact details of business owners and officers. We will keep this data until it is no longer accurate or relevant (such as where the company closes, or the officers change).

When it is no longer necessary to retain your personal data, we will delete or irreversibly anonymise it.

If you have any questions in this regard, or any concerns about how long we keep your information for, please contact us using the details below.

YOUR RIGHTS

You can ask us to:

• provide you with a copy of your personal data;
• correct mistakes in the data we hold about you;
• delete your personal data from our records (subject to the Data Protection Act 2017 and to other applicable privacy laws);
• restrict the processing of your personal data in some circumstances, such as where you contest the accuracy of the data; and
• in certain situations, provide you with a copy of the personal data you provided to us in an easily portable format.

You can object:

• at any time to your personal data being processed for direct marketing;
• in certain other situations to our continued processing of your personal data, such as where we carry out processing based on our legitimate interests.

If we are relying on your consent (permission) to use your personal data, you can withdraw your consent any time. However, in some cases we may still process your personal data without your consent as required or permitted by law, for example to defend our legal rights or meet our regulatory obligations.

In some cases, if you object or withdraw your consent, we can no longer provide you with services. We will advise you where this would be the case.

For further information, or to exercise any of these rights, please contact us by email or post: Privacy Team, African Leadership International Limited, 6th Floor, Tower A , 1 Cybercity , Ebène , Mauritius, [email protected]

COMPLAINTS

If you wish to complain about our use of personal data, we would appreciate the chance to deal with your concerns first. If you still wish to complain, please consult the Mauritius Data Protection Office website at https://dataprotection.govmu.org/

If you reside in the European Economic Area, the GDPR also gives you the right to lodge a complaint with the data protection regulator in your own country.

CHANGES TO THIS PRIVACY POLICY

This privacy policy was published on 15 November 2021 . We periodically review this policy and we will publish any changes on this website.

HOW TO CONTACT US

Please contact us by post or email if you have any questions about either this policy or the information that we hold about you:

Privacy Team , African Leadership International Limited , 6th Floor, Tower A 1 Exchange Square, Wall Street Ebène, 72201 Mauritius, [email protected].