1. Scope and Data Controller
This Privacy Policy explains how BPTA Business Directory (“BPTA”, “we”, “us”, “our”) collects, uses, stores, shares and protects personal data when individuals use BPTA. BPTA will process personal data in accordance with applicable Jamaican data-protection law and the principles of fairness and lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, data-subject rights, security and appropriate safeguards for international transfers.
2. Personal Data We May Collect
Depending on how you use BPTA, we may process name, email address, telephone number, account credentials, profile photograph, business affiliation and role; business registration/profile information; enquiries, messages and engagement records; requested and agreed goods/services; quotations, estimates, pro-forma invoices and invoices; payment records and proof-of-payment uploads; reviews, ratings, likes, follows, saved businesses and referrals; job-related information submitted through Platform features; delivery details and status; advertising campaign information; support communications; IP address, browser/device information, security logs and Platform activity.
3. Purposes of Processing
We process information to create and secure accounts; verify users/businesses where applicable; publish and search business listings; facilitate enquiries, engagements, documents, payments and deliveries; operate reviews and reputation features; provide jobs and advertising functionality; send service communications; prevent fraud, abuse and security incidents; provide support; maintain records; analyse and improve the Platform; enforce our Terms; and comply with legal obligations.
4. Legal Basis and Consent
Processing will be undertaken where there is an appropriate lawful basis under applicable law, including where necessary to provide requested services or perform contractual arrangements, comply with legal obligations, pursue legitimate purposes compatible with users’ rights, or where valid consent is obtained. Where processing relies on consent, consent should be informed, specific, freely given and capable of withdrawal where applicable.
5. Public Information
Approved business profiles and information deliberately submitted for public display may be visible to anyone, including search engines. Do not place private personal information in public profile fields unless it is appropriate for publication.
6. Sharing and Recipients
We may disclose information to the business or customer involved in an engagement; authorised staff and service providers that support hosting, email, storage, security, analytics, communications or payment-related functions; professional advisers; regulators, courts or law-enforcement bodies where legally required; and parties involved in a lawful business restructuring. Service providers should receive only information reasonably necessary for their functions and be subject to appropriate protections.
7. International and Cloud Processing
Some technology or cloud providers may process or store information outside Jamaica. Where personal data is transferred internationally, BPTA will seek to ensure that the transfer is permitted under applicable Jamaican law and that appropriate protection for data-subject rights is maintained.
8. Retention
BPTA retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including account operation, transaction and audit records, fraud prevention, dispute handling and legal obligations. Retention periods may differ by record type. Information that no longer needs to be retained should be securely deleted, anonymised or otherwise disposed of in accordance with applicable requirements.
9. Security
BPTA uses reasonable technical and organisational measures intended to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage. Measures may include access controls, authentication safeguards, encryption where appropriate, logging, backups, software maintenance and administrative controls. No Internet service can guarantee absolute security.
10. Cookies and Similar Technologies
BPTA may use session cookies and similar technologies required for authentication, security, preferences and Platform operation, and may use analytics or other optional technologies where implemented. Where consent is legally required for non-essential technologies, appropriate controls should be provided.
11. Your Data-Protection Rights
Subject to applicable law and exemptions, individuals may have rights to be informed about processing, request access to personal data, request correction of inaccurate data, seek restriction of processing in specified circumstances, withdraw consent where processing is based on consent, and object to decisions based solely on automated processing. Applicable law may provide additional rights, including rights concerning transmission of personal data and review of automated decisions.
12. Privacy Requests and Complaints
Privacy requests should be submitted through BPTA’s published privacy/contact channel. We may need to verify identity before fulfilling a request. Individuals may also have the right to complain to Jamaica’s Office of the Information Commissioner where they believe their personal data has not been processed in accordance with applicable law.
13. Children
BPTA is primarily a business and commercial platform and is not designed for children to independently enter commercial transactions. Where minors’ data is processed, additional legal and safeguarding requirements may apply. Users must not knowingly submit a child’s personal data without appropriate authority and lawful justification.
14. Data Breaches
BPTA maintains processes for assessing security incidents involving personal data and will make notifications to regulators and affected data subjects where required by applicable law.
15. Automated Processing
If BPTA introduces automated decision-making that produces legally significant or similarly significant effects, relevant information and safeguards will be provided as required by law. Ordinary search ranking, recommendations, spam detection and security signals may involve automated processing but should not be represented as professional or legal determinations.
16. Changes to this Policy
Each published Privacy Policy carries a version and effective date. Material changes may be highlighted and, where appropriate, users may be asked to acknowledge or consent to updated processing.
17. Contact
Privacy enquiries and data-subject requests may be submitted through the contact information published on upcjbpta.com. BPTA should maintain current contact details for its data controller and, where required, its Data Protection Officer.