GraceKennedy Foundation (“GKF”, “we”,“us”, or “our”) is an authorised charitable organisation. GraceKennedy Foundation is a member of the GraceKennedy Group of companies (“theGroup”). The Group is dedicated to complying with data protection lawsin all jurisdictions where we operate. Our goal is to bolster the trust and confidence of all our stakeholders including our team, customers, business partners, shareholders, and the beneficiaries of our community outreach initiatives, in our stewardship of their personal data.
This privacy notice aimsto give you information on how we collect and process your personal data.
Please ensurethat you read this privacy notice carefully and along with any additionalprivacy policy we may release periodically. This will help you understand whyand how we use your personal information.
We collect your personal data to provide you with customised products and services that cater to your needs. The types of personal data we collect varies based on the business you conduct with us. Other examples of the types of personal data we may collectdirectly or indirectly from you include:
· Beneficiary Information
· Contact Details
· Demographic Details
· Employment Information
· Filiation Data
· Financial Information
· Identity Data
· Technical Data
Your personal information is collected using:
· Direct interactions. By completing data collection forms, corresponding with us by post, phone, email, via our website, mobile applications, or when you contract with us for the provision of our products orservices.
· Automated technologies or interactions. As you use our websites, technical information regarding your equipment, browsing behaviourand patterns may be collected. We gather your personal information through theuse of cookies and similar technologies.
· Third Parties. Where we use third party suppliers to assist us withour business operations to enable us to provide you with products and services.
Use
We only use your personal data for the purposes for which it was acquired, or where we have a lawful reason for using it, such as:
· To administer, manage and offer the products and services we provide to you, including opening, and maintaining your account, and providing customer/member care services.
· To meet our regulatory and legal obligations, and to ensure adherence with internal controls.
· To conduct market research to develop and enhance products and services, improve existing processes, and evaluate the effectiveness of ourmarketing campaigns.
· To manage our human resources, including recruitment, on-boarding, and benefits administration.
· To improve the operation of our websites and provide those services which you have requested us to provide.
· To provide you with relevant updates on discounts, offers, competitions, and other promotions related to our products and services, orwhere you have given your consent, those of selected third parties. You maywithdraw your consent or object at any time.
Disclosure
Your personal data will only be disclosed to our employees or third parties who require access in order to fulfil one or more lawful purposes for which the personal data was collected. This may include:
· employees and internal personnel who require access toperform their duties;
· agents and third party service providers who supportour operations, including IT support, cloud hosting, cybersecurity, marketingand administrative services;
· professional advisers such as legal counsel, auditors, accountants and consultants engaged to provide advice or services;
· financial institutions, payment service providers anddebt recovery agents involved in processing transactions or managingoutstanding obligations;
· regulatory authorities, law enforcement agencies,courts and dispute resolution bodies, where disclosure is required by law, ornecessary to establish, exercise or defend legal claims;
· other companies within the Group, where necessary forinternal administrative purposes or to fulfil contractual obligations.
Your personal data willnot be disclosed to any other individuals or entities unless there is alawful basis to do so.
International Transfer
It may be necessary foryour personal data to be transferred to another member of the Group, or to a third partyoutside of the jurisdiction in which your data was collected.
Unless an exemption applies, wewill only transfer your personal data out of the jurisdiction it was collectedif:
· Your data is being transferred to a jurisdiction that providesan adequate level of protection for personal data.
· The third party to whom the data is being transferred agrees to protect your personal data in the same way we do.
Retention &Destruction
We will only retain yourpersonal data for the time necessary to fulfil the purposes for which wecollected it, where we are required to retain it to satisfy legal orbusiness requirements, or other lawful purposes.
Werely on one or more of the following lawful bases for processing your data.
· Consent - We will obtain your clear, informed and freely given consent before processing your personal data, except in circumstances where wehave another lawful basis to process your data.
· Vital Interest – To protect your life, in instances that the same cannot be reasonably achieved by a means other than processing your data.
· Contractual Obligation - In contemplation of entering acontract with you or to fulfil our existing contractual obligations to you.
· Legitimate Interest – We may process your personal datain the interest of our business in maintaining and enhancing its goodwill and reputation, avoiding or minimising legal claims, conducting and managing our business to enable us to provide you with the best products and services and asecure customer experience.
· Legal Obligation - To comply with our obligations under the law.
We are committed to observing your rights as an individual in respect of your personal data. The rights which you may exercise are:
· Request access to your personal data (commonly known as a "data subjectaccess request"). This enables you to receive a copy of the personal datathat we hold about you and to check that we are lawfully processing it.
· Request correction of the personal data that wehold about you. This enables you to have any incomplete or inaccurate data thatwe hold about you corrected.
· Object to processing of your personal data where weare relying on a legitimate interest (or those of a third party) where you feelit impacts on your fundamental rights and freedoms.
· Request erasure of your personal data. You may ask us to delete orremove personal data where there is no lawful basis for us to retain it.
· Request restriction of processing of your personal data. You may ask us to suspend the processing of your personal data in thefollowing scenarios: (a) if you want us to establish the data's accuracy; (b)where our use of the data is unlawful but you do not want us to erase it; (c)where you need us to hold the data even if we no longer require it as you needit to establish, exercise or defend legal claims; or (d) you have objected toour use of your data but we need to verify whether we have overriding legitimate grounds to use it.
· Withdraw consent where we rely on consent to process your personal data. Ifyou withdraw your consent, we may not be able to provide certain products orservices to you. You also have the right to withdraw consent where we process your personal data for direct marketing purposes.
· Request data portability of your personal data. You mayrequest that the personal data that we hold about you be transmitted to anotherentity or organisation in a structured and/or machine-readable format, where technically feasible and where no legal restrictions apply.
· Object to automated decision-making regarding your personal data. You may object to decisions made solely through automated processing, including profiling, where such decisions may have legal consequences for youor otherwise significantly affect you.
We are committed to protecting your personal data. We (and our third party service providers) use a variety of industry-standard security technologies and procedures, as well as organisational measures to help protect your personal data from unauthorised access, use, ordisclosure, such as:
· Vulnerability scanning.
· Malware scanning.
· Secure networks and access management
· Encryption
· Multi-Factor Authentication
Notifiable data breaches
Wetake data breaches very seriously. If a data breach occurs, we will endeavourto meet the deadlines stipulated by data protection laws to report data breaches to the supervisory authority. Where there is likely to be an impact on your rights because of thebreach, we will endeavour to notify you without undue delay.
Wewill inform you of:
· the nature of the data breach;
· the measures taken or proposed to be taken to mitigate oraddress the possible adverse effects of the breach; and
· the contact information of our Data Protection Officer orrepresentative to whom you may address any concerns.
We will review every breach and take action to prevent future breaches.
Ourwebsite may contain links to third party websites that are not operated orcontrolled by us. We are not responsible for the privacy practices, content, orsecurity of these third party websites. We encourage you to review the privacypolicies of any third party websites you visit.
We reserve the right, in our sole discretion, to modify any part of this Privacy Notice. It is your responsibility to check this Privacy Notice periodically for changes. Continued use of our website indicates your acknowledgement that it is your responsibility to review this Privacy Notice periodically and become aware of any modifications. Changes to this notice are effective once they have been uploaded to our website.
If you have a question or comment regarding this Privacy Notice or you would like to make a complaint related to data privacy, please contact our Privacy Office using the details below.
GraceKennedy Foundation
73 Harbour Street,Kingston
(876) 922-3440
You may submita complaint to the supervisory authority in the jurisdiction that your information was collected if you feel that we have not addressed your complaint:
· Jamaica - Link
· United Kingdom - Link
· Cayman - Link
· Bahamas – Link
