Privacy Policy

Last updated: 6 October 2026

This Privacy Policy explains how Biro.mu ("we", "us", "our") collects, uses, stores, and protects personal data through the Biro platform. This policy complies with the Mauritius Data Protection Act 2017.

1. Identity of the Controller

2. Personal Data We Collect

Account Data

When a business registers its employees on Biro, we collect:

• Full name
• Email address

Customer Data

Businesses may store the following data about their customers:

• Name, email address, phone number, physical address
• National Identity Card (NIC) number
• Business Registration Number (BRN)
• Tax Account Number (TAN)

Supplier Data

Businesses may store the following data about their suppliers:

• Name, email address, phone number, physical address
• Business Registration Number (BRN)
• VAT registration number

Financial Data

• Invoices, payments, and expense records
• Bank statement data (uploaded for reconciliation)

Document Data

• Uploaded invoice and receipt images
• Text extracted from documents via OCR processing

Technical Data

• IP addresses (recorded in audit logs)
• Session cookies (for authentication)

3. Purposes of Processing

We process personal data for the following purposes:

• Inventory and purchase management
• Invoicing and MRA (Mauritius Revenue Authority) e-invoicing compliance
• Expense tracking and financial reporting
• User account management and access control
• Error monitoring and system stability (via structured logging)
• Product analytics to improve the service (PostHog)

4. Legal Basis for Processing

Biro is a business tool used by employees of subscribing businesses. The legal basis for processing is not consent but rather:

Contractual Necessity

Processing of user accounts, customer data, and supplier data is necessary for the performance of the contract between the business and Biro.mu to provide the Biro service.

Legal Obligation

Retention of financial records (invoices, receipts, bank statements) for 7 years is required under MRA tax compliance regulations. E-invoicing submission to the MRA is a legal requirement.

Legitimate Interest

The following processing is based on our legitimate interest:

• Security logging and audit trails (to detect and prevent unauthorised access)
• Error monitoring (to maintain system stability and resolve issues)
• Product analytics via PostHog (to understand usage patterns and improve the service, without directly identifying individual users)

5. Data Recipients and Third Parties

We share personal data with the following third parties:

6. Cross-Border Transfers

Some data may be processed outside of Mauritius:

• PostHog Cloud may process data in the United States or European Union. PostHog's privacy practices comply with applicable data protection standards.
• Discord servers are located in the United States. Only obfuscated operational data (partially masked names/emails, no IP addresses) is transmitted.
• Sanjay OCR: hosting location to be confirmed. If processing occurs outside Mauritius, adequate protection measures are in place via a Data Processing Agreement.
• MRA API: processed on Mauritius government servers (no cross-border transfer).

Where personal data is transferred outside Mauritius, we ensure that adequate safeguards are in place in accordance with the Data Protection Act 2017.

7. Data Retention

8. Your Rights

Under Part VII of the Data Protection Act 2017, you have the following rights regarding your personal data:

• Right of access: obtain a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your data (subject to legal retention obligations)
• Right to restriction of processing: request that we limit how we use your data
• Right to object: object to processing based on legitimate interest

9. Cookies

Biro uses only essential cookies:

No consent banner is required as the session cookie is strictly necessary for the service to function. Analytics processing is covered by legitimate interest and does not use cookies that track individual users on this website.

For more details, see our Cookie Policy.

10. Contact