Your data, and exactly where it goes.
Forming a company means handing over a passport and an address. Here is what we collect, who receives it, how long we keep it and how to get it deleted.
Reading from your country
Pick your country to see which data protection law covers you.
The short version
- We collect what a formation needs: who you are, who owns the company, and the documents the law asks for.
- Some of it becomes public on the register, depending on the place. Each country page shows exactly what.
- No advertising cookies, no trackers, and no data sold or rented to anyone.
- It goes only where the work needs it: the registry, the licensed agent, and a bank if you ask us.
- We keep identity records as long as the law says, usually five to seven years, then delete them.
- You can see, correct or delete your data by emailing us. We answer within one month.
01Who is responsible for your data
Heirson Formations Ltd in Mauritius (who we are) decides how your data is used.
The controller of your personal data is Heirson Formations Ltd, registered in Mauritius under file number C215328, at QG96+Q5R Moka, Mauritius. We follow the Mauritius Data Protection Act 2017, and the GDPR, UK GDPR or Swiss data protection law where they apply to you. For anything on this page, write to info@heirson.com.
02What we collect
What a company formation needs, plus the little a website needs to work.
When you order
- Names, dates of birth, nationality, addresses, email and roles of the directors and owners.
- Copies of passports or ID cards, proof of address, and how the money in the business was earned, as anti-money-laundering law requires.
- Your company's name, activity and ownership, and your signature on the service agreement.
When you pay
The coin, the amount and the transaction ID, and any refund address you give us. We never see your wallet's private keys. Remember that most blockchains are public: anyone can see a transaction, though not that it was for us. Monero transactions are private by design, but we still link them to your order.
When you visit the site
Cloudflare tells our pages your country, so we can show prices and rules that fit where you live. We use the country, not your IP address. To stop abuse, the order form counts requests per connection using a scrambled (hashed) form of the IP address that can't be turned back into it, and these counters are deleted within a day. If you pick a country yourself, that choice is stored in your own browser, not on our servers.
04How we use your data, and on what basis
To do the work you ordered, and to meet the law that comes with it.
- To form and look after your company: because you asked us to, under our contract with you.
- To identify you and check sanctions lists: because anti-money-laundering law requires it.
- To remind you of yearly filings and fees: because it is part of the service, and in your interest.
- To keep the site and your account secure: because we have a legitimate interest in stopping fraud and abuse.
We don't use your data for automated decisions that have legal effects on you, and we don't send marketing emails unless you ask for them. If you tick the box for our letter, we keep the date and the words you agreed to, and one click in any letter stops it.
06Data sent to other countries
Your data goes to the country you form in. That is the point of the service.
A company in the BVI needs a BVI agent, a Wyoming LLC needs a Wyoming registry, and so on, so your data travels to the place you choose and, for a bank account, to the bank's country. Where data leaves the EU, the UK or Switzerland, we rely on the contract with you, or on safeguards such as standard contractual clauses with our providers.
07How long we keep it
As long as the law tells us to, then we delete it.
- Identity documents and order records: for as long as anti-money-laundering law in Mauritius and in your company's place requires, usually five to seven years after our work for you ends.
- Payment and accounting records: as long as tax and accounting law requires.
- Messages with us: as long as your account is open, then up to two years.
After that, we delete the data or make it anonymous. Data that a registry has published stays on that public register under the registry's own rules.
08Your rights
See it, correct it, delete it where the law allows, and complain if we get it wrong.
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong or out of date;
- delete your data, unless the law requires us to keep it;
- stop or limit a use you object to, and give you your data in a format you can take elsewhere.
Write to info@heirson.com. We answer within one month, and we may ask you to confirm who you are first. You can also complain to the Data Protection Office in Mauritius, or to the data protection authority where you live.
Pick your country at the top of the page to see which authority covers you.
09How we protect it
Encrypted, limited to the people who need it, and logged.
Data is encrypted in transit and at rest. Identity documents are open only to the staff and agents working on your order, and access is logged. Uploaded files are stored privately under random names and are only ever downloaded, never opened in a browser, and every time we open one, your order records it. If a breach puts your data at risk, we tell you and the regulator as the law requires.
10Under 18s
Our services are for adults only.
We don't knowingly collect data from anyone under 18. If you think a child has given us their details, write to us and we will delete them.
11Changes to this notice
If anything important changes, we tell you first.
We update this notice when our services or the law change. The date at the top shows the latest version. If a change affects how we use data we already hold, we email account holders before it takes effect.
To use any of these rights, write to info@heirson.com from the email address on your account, so we know the request is yours.