Privacy Policy

1. Who is responsible for your data

For the purposes of the Data Protection Act, 2020 (Jamaica) ("DPA"), the data controller is the Jamaica Hotel and Tourist Association, which owns and operates the Portal.

2. What we collect

• Account data: name, email address, and password (stored as a secure hash), for managers and team members.
• Property data: property name, type, parish, hazard selections, resource locations, emergency contacts, branding, and uploaded property maps.
• Team data: names, roles, phone numbers, and email addresses of emergency response team members and staff, entered by the property's manager.
• Usage data: drill notices sent, check-in confirmations and their timestamps, decision drill activity, drill records, sign-in events.
• Technical data: log records and the essential cookies described in section 9.

3. Where it comes from

Most data comes from you. If you are a team member, your name, role, phone number, and email address were entered by your property's manager so that your property's emergency plan can reach you. You can view your own information at any time on your role page and ask your manager or us to correct it.

4. Why we process it

To provide the service: plans, role cards, invitations, drill notices, check-in boards, and real emergency alerts.

To send reminder emails about setup and practice, which you can turn off under Account, Notifications. Operational sends (invitations, role cards, drill notices, real alerts) are part of the service itself.

To keep the service secure and to keep records of alert and drill activity as your property's readiness evidence.

To report membership-level readiness to the Association in aggregate.

Legal bases under the DPA include performance of our agreement with your property, your consent where applicable, the Association's legitimate interests in member readiness, and, for real emergency alerts, the protection of vital interests.

5. Who we share it with

The JHTA Secretariat, for membership administration and aggregate readiness reporting.

Service providers that host the Portal and deliver its email, located in the United States and the European Union, under contractual safeguards. We do not sell personal data.

Authorities where the law requires it.

6. International transfers

Because our hosting and email providers operate outside Jamaica, personal data is transferred abroad under safeguards designed to meet the DPA's requirements for overseas transfer.

7. Retention

Account and property data are kept while the account is active. Drill and alert records are kept as the property's readiness evidence while the account is active. After account closure, data is deleted or anonymized within 24 months, except where law requires longer. Properties may request an export at any time.

8. Your rights

Under the DPA you may request access to your personal data, correction, erasure, or restriction, and you may object to certain processing. Write to admin@jhtareadiness.org. You may also complain to the Office of the Information Commissioner (Jamaica).

9. Cookies and technical data

The Portal uses essential cookies only: session sign-in and security. No advertising or cross-site tracking cookies are used.

10. Security

Data is encrypted in transit and at rest, access is restricted by row-level controls so each property sees only its own data, and administrative access follows least privilege.

11. Children

The Portal is a workplace tool and is not directed at children.

12. Changes and contact

We may update this policy; material changes will be notified. Contact: admin@jhtareadiness.org.