Privacy Policy

1. Introduction

Codeblix Ltd ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal information when you use our Electronic Billing System (EBS) platform.

2. Our Data Protection Roles

Codeblix acts as a data controller for information that we determine how to use, including website enquiries, subscription administration, billing, account security and our own legal records.

When a business connects an accounting system or provides business, customer, invoice or fiscal records for Codeblix EBS, that business remains the controller of those records and Codeblix acts as its processor. We process those records on the customer's documented instructions to provide and support the configured EBS service, subject to applicable law and any customer-specific data processing agreement.

3. Data We Collect

Account Information

Business name, Business Registration Number (BRN), VAT number, contact details, and billing address.

Invoice Data

Customer information, invoice amounts, dates, items, and transaction history required by the Mauritius Revenue Authority (MRA).

Technical Data

IP addresses, browser type, device information, and usage logs necessary for security and operational monitoring.

4. EBS and Connected Accounting Data

For an authorised QuickBooks, Xero or other accounting-system connection, Codeblix may process the business identity, customer, invoice, item, tax, payment, currency and contact fields needed for the customer's configured workflow. We use this data only to:

• connect and verify the authorised business account;
• import, validate and map eligible source documents for MRA fiscalisation;
• transmit required fiscal data to the MRA and retain the resulting status, IRN, QR code and audit evidence;
• perform an enabled write-back, PDF attachment or customer delivery workflow; and
• provide onboarding, reconciliation, security, incident response and technical support.

Human access is restricted to authorised personnel with a legitimate need for those purposes. We do not sell EBS customer data, use it for unrelated advertising or marketing, or use one customer's records for another customer. Unless the law requires otherwise, we do not process customer-controlled EBS data outside the customer's documented instructions.

5. Legal Basis for Processing

We process your data under the Data Protection Act 2017 (Mauritius) based on:

• Contractual necessity: For providing our core invoicing services to you.
• Legal obligations: To comply with MRA EBS requirements and tax laws.
• Legitimate interests: To maintain platform security and structural improvements.

6. How We Use Your Data

• Generate and fiscalize invoices directly with the MRA.
• Maintain mandated audit trails as required by MRA regulations.
• Provide customer and technical support.
• Send service and system notifications.
• Comply with strict legal and accounting obligations.

7. Data Sharing

Your data is kept confidential and is only shared with:

• Mauritius Revenue Authority: Mandatory data transmissions as required by EBS regulations.
• Connected accounting platforms: Data exchanged with a platform such as QuickBooks or Xero only through the connection and workflows authorised by the customer.
• Service providers: Limited processing needed to host, operate, secure or support the service, subject to appropriate confidentiality and data-protection obligations.
• Payment Processors: Necessary data points for billing purposes.
• Accounting Partners: For customer-approved support services, where applicable.

8. Data Retention

• Invoice data: Retained for 7 years (tax law requirement).
• Account data: Retained for 2 years after account closure.
• Technical logs: Purged on a rolling 12-month basis.

9. Your Rights

Under the Data Protection Act 2017, you have the right to request access to your personal data, request rectification of inaccurate data, request erasure where legally permissible, object to processing, and request data portability in a machine-readable format.

To exercise any of these rights, please contact our Data Protection Officer.

10. Data Security

We implement strict security measures to prevent unauthorized access, disclosure, alteration, or destruction of your data. These include SSL/TLS encryption for all data in transit, secure cloud hosting, access controls, and regular security audits.

11. Optional Analytics and Cookies

Analytics is disabled until you choose “Allow analytics.” If you consent, the public website uses Google Analytics 4 for aggregated traffic and conversion measurement. The public website and EBS application use PostHog for product analytics, session replay, web-vital measurements, and sanitized frontend error diagnostics.

Our analytics event catalogue permits only predefined event names and low-cardinality properties. We exclude submitted form values, passwords, authentication tokens, request and response bodies, and full query strings from structured analytics events. During the current diagnostic period, public-site and EBS replay show page text, assets, interactions, and ordinary form entries such as email. Password fields remain masked. Replays do not record console logs, network bodies, headers, canvas content, fonts, or cross-origin iframes.

The public marketing site and authenticated EBS application currently use one business-owned PostHog project but remain separated by controlled surface and page-type properties. A one-way opaque identifier derived from the internal user ID may be used for EBS analytics; email addresses and customer or company identifiers are not sent as analytics identities.

Your analytics preference is stored in your browser so it can be respected on later visits. Advertising storage and advertising-personalisation signals remain disabled. You can reopen the consent choices at any time using the “Privacy settings” button; declining stops capture, resets the PostHog identity, stops recording, and removes Google Analytics cookies accessible to this site.

Google and PostHog process analytics data on our behalf under their respective service terms. Analytics retention, access, and deletion settings are managed separately from statutory invoice records. Contact us using the details above to ask about analytics data or exercise an applicable privacy right.