Mercy Group of Schools - General Privacy Notice
Effective Date: 29/08/2024
Purpose of this Document
The Sisters of Mercy of Jamaica, British West Indies, operator of the Mercy Group of Schools (“Sisters of Mercy” / “we” / “our”), is committed to protecting the privacy and security of your personal data.
This privacy notice outlines how the Sisters of Mercy, through its institutions within the Mercy Group of Schools, may collect, use and disclose personal data relating to you. This General Privacy Notice applies to any individual who:
• Contacts us by any means;
• Provides services to us;
• Provides donations, gifts or grants to us;
• Requests information about a product or service offered by us;
• Visits our offices, institutions or other premises;
• Takes part in a survey, competition or promotion conducted by us; or
• Otherwise provides us with their personal data.
It is important that you read and retain this notice, together with any other privacy notice or other communication we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using that data.
Data Controller and Data Protection Officer
As operator of the Mercy Group of Schools, the Sisters of Mercy is a data controller regarding the processing of your personal data for the purposes of the Data Protection Act (“DPA”).
Our details are outlined below:
Data Controller:
The Sisters of Mercy of Jamaica, British West Indies
A corporation formed pursuant to the Sisters of Mercy of Jamaica, British West Indies (Incorporation and Vesting Law,) 1954
26 South Camp Road, Kingston 4, St. Andrew
876-618-2980
The institutions within the Mercy Group of Schools are: Convent of Mercy Academy, Alpha Primary, Alpha Infant, Alpha School of Music, Alpha Vocational Training Centre, Jessie Ripoll Primary, St. John Bosco Vocational Training Centre and Mt. St. Joseph Prep School.
We appointed a Data Protection Officer (“DPO”) who is responsible for monitoring compliance with the DPA and assisting individuals with the exercise of their rights under the DPA.
You may contact the DPO regarding the handling of your personal information at:
Kimonia Herman-Howell
Sisters of Mercy of Jamaica Business Office
26 South Camp Road
Kingston 5.
876-353-1624
dpo@rsmjm.org
Personal Data We Collect About You
In summary, the term “personal data” for the purposes of this notice refers to any information relating to a person who can be identified from that information alone, or from that information and any other information that is in our possession or likely to come into our possession.
Depending on the nature of your relationship with us, we may collect, store and use different kinds of personal data about you, which have been grouped together as follows:
- Identity Data, which includes full name, any previous names, TRN or other identification numbers, other identifiers, marital status, next of kin, title, date of birth and gender.
- Contact Data, which includes residential address, business address, delivery address, email addresses, telephone numbers, social media profile information.
- Financial Data, which includes bank account and payment details.
- Transaction Data, which includes details about payments to and from you and other details of products and services you have purchased from us.
- Technical Data, which includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access our website.
- Audiovisual Data, which includes photos, videos and audio recordings of you.
- Marketing and Communications Data, which includes your preferences in receiving marketing from us and your communication preferences.
- Survey Data, which includes your responses to surveys we may ask you to complete for research purposes.
- Any other personal data you post, email or otherwise send to us.
You may choose not to provide your personal data if/when we request it. If you choose not to provide your personal data, it may impact or restrict our relationship with you and our ability to provide anything you may have requested of us. We may also be prevented from complying with certain legal obligations applicable to us.
How We Collect Your Personal Data
We will only use your personal data as permitted under the DPA and other applicable laws.
We will most commonly use your personal data in reliance on one or more of the following legal bases:
- Contract: To perform a contract we have entered into with you, or to take steps at your request with a view to entering into a contract.
- Legal Obligation: To comply with a legal obligation that we are subject to.
- Legitimate Interests: Where the use of the data is necessary for legitimate interests pursued by us or any third party to whom the data is disclosed, unless the processing is unwarranted by reason of prejudice to your rights and freedoms or legitimate interests.
- Consent: Where we have your consent to do so.
Without limiting the above, we may use your personal data for the following purposes and other purposes that are compatible with same:
- To register you or the entity you represent as a supplier
- To manage and administer our relationship with you or the entity you represent
- To manage transactions, invoices, payments and charges, and to collect and recover funds owed to us
- To send technical alerts, updates and administrative communications
- To deal with requests and queries
- To administer and protect our business and IT resources
- To monitor activities at our facilities
- Archiving, historical purposes and record-keeping
- To invite and enable you to participate in a survey
- For certain direct marketing purposes, including bringing charitable and benevolent causes to your attention (where we have the appropriate consent to do so)
Sharing of Personal Data
We may share your personal data with third parties in certain circumstances depending on the relationship you have with us. The entities/persons that your personal data may be shared with include:
- Group and/or affiliated institutions and entities
- Tax authorities
- Government departments, agencies and authorities
- Regulators and public, administrative or judicial bodies
- Professional advisors
- Banks and financial institutions
- Marketing and event agencies
- Third-party service providers who provide services regarding data processing, payments, IT, telecommunications and storage
We will share your personal data with third parties where required to do so by law, where it is necessary for the performance a contract we have with you, where we have a legitimate interest in doing so or where there is another clear legal basis for such disclosure.
Your personal data will primarily be shared with third parties in Jamaica. However, in some instances, your personal data may be transferred outside of Jamaica in accordance with the DPA and any other applicable laws.
We require all third parties to take appropriate security measures for the protection of your personal data, and they may only act in accordance with our instructions in relation to such data.
Data Security
We have implemented appropriate security measures to prevent accidental loss and unauthorised use of your personal data. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a need to access such data. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
We have also implemented procedures to address data breaches and will notify you of any breaches affecting your personal data where we are legally required to do so.
Expected Retention Period
We will only retain your personal data for as long as is reasonably necessary to fulfil the purposes for which it was collected, including for the purposes of compliance with legal, accounting or reporting requirements. The periods for which we will retain different types of personal data shall be determined on a consideration of:
- The nature of your relationship with us
- The nature and sensitivity of the personal data
- The potential harm that may result from misuse or unauthorised disclosure of the personal data
- The purposes for which we process the personal data
- Any applicable legal requirements
Having regard to the foregoing, we expect to retain the following types of personal data for these periods:
- Supplier Personal Data (or their representatives) – For the duration of the engagement/relationship and up to 7 years after it ends
- Current banking details – These will be deleted as soon as practicable after our relationship with you ends
- CCTV footage – 6 months from the date of recording
The period for which we will retain any personal data may be longer or shorter depending on the particular circumstances of a given situation, the nature of the data in question, any applicable limitation periods and whether it is needed in connection with the exercise of our legal rights or the performance of our legal obligations.
Changes to Personal Data
We have a duty to ensure that your personal data is accurate and, where necessary, kept up to date. In the event of any changes to your personal data, you should immediately inform the DPO. We may invite you to review and update your personal data from time to time.
Changes to this Privacy Notice and Other Communications
We reserve the right to amend or update this privacy notice at any time. We may also notify or communicate with you in other ways from time to time regarding the processing of your personal data.
If you have any questions regarding this privacy notice, please contact our DPO.