Privacy Policy

My Car JA Effective date: [TO BE CONFIRMED: effective date] · Last updated: [TO BE CONFIRMED: last updated date]

DRAFT v3. Updated for the Data Protection Act, 2020 (Jamaica) and the My Car JA data strategy. To be reviewed by a Jamaican attorney when possible.

1. Who we are

My Car JA ("we", "us", "our") is operated by [TO BE CONFIRMED: legal entity name], [TO BE CONFIRMED: registered address], Jamaica. We run an online automotive platform at https://esson.store and in our apps (the "Platform") that helps people find car parts, automotive businesses, services and car-ownership information.

We are the data controller for the personal data described in this policy under the Data Protection Act, 2020 of Jamaica (the "DPA"), and are registered with the Office of the Information Commissioner (OIC). Registration number: [TO BE CONFIRMED: OIC registration number].

Data Protection Officer (DPO): [TO BE CONFIRMED: Data Protection Officer] · [TO BE CONFIRMED: privacy email] · [TO BE CONFIRMED: phone number]

2. The short version

• We collect what we need to run the Platform and help you with your car.
• We share your request details with businesses only when you ask us to, or with your consent.
• We do not sell your personal data.
• We send marketing only with your consent, and you can stop it at any time.
• We keep a de-identified record of Platform activity (for example, "a 2016 Toyota Axio owner in St. Catherine requested brake pads") to understand the market over time. It does not include your name or contact details, and it is disconnected from you if you delete your account.
• You can access, correct, delete or stop the use of your data, and complain to the Information Commissioner.

3. How we follow the data protection standards

We process personal data fairly and lawfully; for specified, lawful purposes; only as much as we need; accurately; no longer than necessary; respecting your rights; securely; and transferring it outside Jamaica only with adequate protection.

4. Information we collect

4.1 Information you give us

• Account details: name, email, phone, WhatsApp number, password (stored hashed), parish and town.
• Vehicle details (My Car): make, model, year, engine, trim, mileage, nickname, photos, and optionally your VIN/chassis number and plate.
• Requests and enquiries: part requests, quote requests, messages to businesses, photos of parts, contact preferences.
• Records you keep: maintenance history, expenses, reminders, and documents you upload.
• Assistance requests (My Assist): the help needed, including location if you share it.
• Business accounts: business name, contact person, address, registration details, logo, photos, products, prices and stock.
• Communications: messages to us, surveys and feedback.

We do not intentionally collect sensitive personal data (such as health, religious, political or biometric data). Please don't include it in messages or uploads.

4.2 Information collected automatically

• Device and usage data: IP address, device type, operating system, browser, app version, pages viewed, searches, clicks and times of activity.
• Location: approximate (from IP); precise only if you allow it.
• Cookies and similar technologies: see our Cookie Policy.

4.3 Information from others

Businesses that reply to your requests; partner garages (only with your consent); vehicle data providers (to decode a VIN); public business information for listed businesses.

5. How and why we use your information

6. Automated decisions

We use automated systems to match parts to vehicles, suggest equivalents, rank results, route requests and detect fraud. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. You can ask for a person to review any automated restriction on your account at [TO BE CONFIRMED: privacy email].

7. When we share information

• Businesses you contact or request quotes from: only what they need to respond. They must use it only for that purpose.
• Partner garages and service providers: only with your consent.
• Service providers (processors): hosting, storage, backups, messaging, analytics and security, under written agreements requiring confidentiality and security.
• Referral links: a partner may learn you came from us; we don't send your details unless you submit them.
• Legal reasons and business transfers: as required by law, or if the company is merged or sold, under this policy.

We do not sell your personal data, and we never sell or share individual-level activity records.

8. How we keep and use data over time (our three data tiers)

To run the Platform responsibly and understand Jamaica's automotive market over the years, we keep data in three forms:

1. Identifiable data (your name, phone, email, VIN, plate, messages, precise location, documents): kept only as long as needed, under the retention periods in section 10.
2. De-identified activity history: records of Platform activity where your identity is replaced with a random code. Examples: which vehicle make, model, year and engine; which part; which parish; the time; quoted prices; and how quickly businesses replied. It contains no name, phone, email, VIN, plate or precise location. It is kept long-term, strictly inside the company, under access controls, and is used for market research, product improvement and producing aggregated statistics. It is never sold or shared at the individual record level.
3. Aggregated statistics: combined totals and trends (for example, "brake pad requests in St. Catherine rose 20% this quarter"), only for groups large enough that no one can be identified. We may share or sell these insight reports to businesses such as parts importers, distributors, insurers and dealers. They may be kept indefinitely.

When you delete your account: your identifiable data is deleted (except where the law requires us to keep it), and the link between you and your de-identified activity history is permanently destroyed, so it can no longer be connected to you.

You can object to the use of your de-identified data for market research by contacting [TO BE CONFIRMED: privacy email]. We will consider your request under the DPA.

9. Transfers outside Jamaica

Some providers (e.g. cloud hosting and backup storage) may be outside Jamaica. We transfer personal data abroad only with adequate protection, appropriate safeguards (such as contractual protections), or another basis permitted by the DPA.

10. How long we keep identifiable data

• Account data: while your account is active, then deleted or de-identified within [TO BE CONFIRMED: account retention period] after closure, unless the law requires longer.
• Requests and messages: [TO BE CONFIRMED: request retention period].
• Uploaded documents: until you delete them or close your account.
• Security logs: [TO BE CONFIRMED: log retention period].
• Backups: overwritten on a rolling schedule of [TO BE CONFIRMED: backup retention period].
• De-identified activity history and aggregated statistics: see section 8.

11. Security and breaches

We use HTTPS encryption, encryption of sensitive fields, files and backups, access controls, two-factor authentication for staff and business accounts, audit logs, monitoring and regular testing. No system is completely secure.

If a security breach affects or may affect your personal data, we will report it to the Information Commissioner within 72 hours and notify you within 72 hours, explaining what happened, the data involved, what we're doing, what you can do, and how to reach our DPO.

12. Your rights under the DPA

You have the right to: access your data; correct it; request deletion; prevent processing likely to cause you substantial unwarranted damage or distress; stop direct marketing at any time; withdraw consent; ask that significant decisions are not solely automated, and ask for human review; portability (a copy of data you provided); and to complain to the Office of the Information Commissioner (oic.gov.jm).

Use Account Settings or contact our DPO at [TO BE CONFIRMED: privacy email]. We may verify your identity and will respond within the time limits set by the DPA.

13. Marketing choices

Marketing only if you opt in; an easy opt-out in every message (Unsubscribe / reply STOP); preferences in Account Settings. Service messages are not marketing.

14. Children

The Platform is not intended for anyone under 18. Contact us if a child has given us data and we will delete it.

15. Third-party links

Other websites and businesses have their own privacy practices.

16. Changes

We will post updates with a new "Last updated" date and notify you of significant changes.

17. Contact

[TO BE CONFIRMED: legal entity name] · [TO BE CONFIRMED: registered address] · DPO: [TO BE CONFIRMED: Data Protection Officer] · [TO BE CONFIRMED: privacy email] · [TO BE CONFIRMED: phone number] Office of the Information Commissioner, Jamaica: oic.gov.jm