GWT X TRUST CENTRE
Privacy notice
Version 3.0 · 27 July 2026
GWT X applies data minimisation. An access request may collect your name, organisation or operational alias, pool country or operating region, what you manage, your objective, preferred language and chosen contact route.
ISB TRADING CO LTD is the controller for website enquiries. Data is used to qualify and answer requests, protect the service and keep an accountable record. We do not request yacht-owner identities, guest details or exact itineraries during first contact. The sections below explain legal grounds, recipients, international transfers, retention, rights and complaints.
Controller, data and purpose
ISB TRADING CO LTD, trading as GWT X, is the controller. We receive data directly from you and process only the enquiry, waitlist, contact, consent and operational-context data needed to qualify and answer a request, protect the service, prevent abuse, keep an accountable record and, only with consent, send occasional updates.
Legal grounds and choice
Processing relies, as applicable, on steps you request before a contract, legitimate interests in handling and securing genuine enquiries, compliance with legal duties, and consent for optional measurement or marketing. Consent is optional and can be withdrawn without affecting earlier lawful processing.
Recipients
Access is limited to authorised GWT X personnel and necessary hosting, cloud, security, communications and support providers acting under suitable terms. A locally recognised partner receives only the information needed for an intervention you have requested or approved. Authorities or professional advisers receive information only where legally required or necessary to establish or defend rights.
International transfers
Data may be processed in Mauritius and in countries where selected infrastructure or communication providers operate. Where the GDPR applies and a recipient outside the EEA is not covered by an adequacy decision, GWT X uses an applicable safeguard such as approved Standard Contractual Clauses. Transfers from Mauritius are handled under the Data Protection Act 2017 and an appropriate lawful transfer basis. You may request information about the relevant safeguard.
Retention
Unactivated enquiry and waitlist records are kept for no more than 24 months after the last meaningful contact or closure. Essential server and security logs are normally kept for no more than 12 months unless an incident requires longer. Consent and data-rights request evidence may be kept for up to 5 years. If a service is activated, customer, contract and accounting records follow the accepted service schedule and any statutory period, generally up to 7 years where required, after which data is deleted or anonymised.
Rights, complaints and automated decisions
Subject to applicable law, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent. Contact info@e-bd.group. You may complain to the Data Protection Office of Mauritius at dpo@govmu.org and, where the GDPR applies, to your EEA supervisory authority. Website enquiries are not accepted or rejected by solely automated decision-making with legal or similarly significant effects; the public price calculation does not activate a contract.
Sensitive information
Do not submit owner identities, guest data, exact yacht routes, access codes, medical details or other unnecessary sensitive information through the public form or initial contact.