1. Our commitment
CH Elevate Consultancy Limited aims to process personal data responsibly and in accordance with Jamaica's Data Protection Act, 2020 and applicable regulations. This statement describes our operational approach and should be read with our Privacy Policy.
2. Data-protection standards
Our data-handling practices are guided by the Act's eight standards. Personal data should be:
- processed fairly and lawfully;
- obtained for specified, lawful purposes and not used incompatibly;
- adequate, relevant and limited to what is necessary;
- accurate and kept up to date where necessary;
- kept no longer than needed for its purpose;
- processed in accordance with the rights of data subjects;
- protected by appropriate technical and organisational measures; and
- transferred outside Jamaica only where the required level of protection is addressed.
3. Accountability and purpose
We identify why personal data is needed before collecting it, limit access according to job responsibilities, and use data for stated business, course-administration, security and legal purposes. We assess controller registration, data-protection-officer and impact-assessment obligations and will meet them where they apply to our operations.
4. Individual and organisation records
Individual applicants may provide their own data. For organisation-sponsored registration, an authorised coordinator may submit participant information and monitor the organisation's registration and payment records. Coordinators are limited to their own organisation and do not receive participant passwords or private individual certificates.
Approval controls access to protected materials. Registration decisions and offline payment status are maintained as separate records. Administrative actions and protected downloads may be recorded for accountability and security.
5. Your rights
Subject to the Act and its exceptions, you may be entitled to:
- receive information about how your personal data is used;
- request access to personal data held about you;
- have inaccurate or incomplete data corrected;
- object to or prevent certain processing, including direct marketing;
- withdraw consent where processing depends on consent;
- request transfer of data where the legal requirements are met;
- receive information about certain automated decisions and request human review; and
- complain to the Office of the Information Commissioner.
6. How to make a request
Email info@ch-elevateconsultancy.com with the subject “Data protection request”. Describe the information or action requested and provide a reliable way to contact you. We may ask for information needed to verify your identity and authority, particularly where a coordinator or representative makes the request.
We will acknowledge and respond within the period required by applicable law. A request may be limited or refused where the Act permits, in which case we will explain the basis where legally allowed.
7. Security and access controls
Our safeguards include role-based administrative access, authenticated participant and coordinator access, private storage for uploaded course files, authorisation checks before downloads, non-guessable file references, file-type and size restrictions, version records, and audit logging for relevant administrative and download activity.
We also use account-verification and password-reset controls and restrict course materials from registrations that are waitlisted, rejected or cancelled. Safeguards are reviewed according to risk and changes in the service.
8. Retention and disposal
We review the need for personal data and retain it only while necessary for service delivery, course history, certificates, security, disputes, audits and legal or financial recordkeeping. When data is no longer required, we delete, anonymise or securely dispose of it, subject to backup lifecycles and lawful retention needs.
9. Service providers and overseas transfers
Technology and professional service providers may process limited data on our behalf. We select providers and use contractual, access and security controls appropriate to the service. Before a relevant overseas transfer, we consider the destination's protection and any safeguards required by Jamaican law.
10. Personal-data incidents
Suspected loss, misuse, unauthorised access or disclosure is assessed and contained through our incident process. We document relevant facts, take corrective action, and notify the Information Commissioner and affected individuals when and within the timeframe required by law.
11. Concerns and complaints
Please contact us first so we can try to resolve your concern. You may also contact the Office of the Information Commissioner of Jamaica, the independent regulator responsible for oversight of the Data Protection Act.
This statement is a practical description of our approach and is not legal advice. We may update it as our operations, guidance or applicable law changes.