Jamaica Data Protection Act, 2020

Our approach

RentThyme is designed to help landlords, property managers, tenants, staff and authorized vendors manage rental activities with appropriate access controls and clear responsibilities.

Personal information should be collected, used, stored, shared and retained only for legitimate, specified purposes and handled with appropriate safeguards.

Personal information

Depending on how the platform is used, personal information may include:

• Account details and contact information.
• Property, tenancy, lease and rental payment records.
• Rental applications and tenant-screening documents.
• Government-issued identification and supporting income documents.
• Maintenance requests, communications and related records.

Users should submit only information they are authorized to provide and that is reasonably necessary for the relevant rental activity.

Jamaica's eight data protection standards

The Data Protection Act establishes eight standards governing the processing of personal data:

1. Fairness and lawfulness: Personal information must be processed fairly and lawfully.
2. Purpose limitation: Information should be obtained for specified and lawful purposes and not used incompatibly with those purposes.
3. Data minimization: Information collected should be adequate, relevant and limited to what is necessary.
4. Accuracy: Reasonable steps should be taken to ensure personal information is accurate and, where necessary, kept up to date.
5. Storage limitation: Information should not be retained longer than necessary, subject to applicable legal requirements.
6. Rights of individuals: Personal information must be processed in accordance with the applicable rights of the individuals concerned.
7. Security safeguards: Appropriate technical and organizational measures must protect personal information against unauthorized processing, loss, destruction or damage.
8. International transfers: Transfers outside Jamaica must satisfy the applicable protections, conditions or exceptions established by the Act.

Data handling and security

RentThyme's data-protection approach includes:

• Authentication and role-based access permissions.
• Database and document-storage access controls.
• Protection of account credentials and authentication codes.
• Appropriate handling of records shared between authorized users.
• Identifying, assessing and responding to suspected security incidents and privacy requests.

No online platform can guarantee absolute security. Users are also responsible for protecting their credentials and granting access only to authorized individuals.

Roles and responsibilities

RentThyme

Depending on the processing activity, RentThyme may act as a data controller or a data processor. Its responsibilities depend on the purposes and means of processing and its arrangements with customers and service providers.

Landlords and property managers

Account holders must have appropriate authority and a lawful basis to collect, upload, use and share tenant information.

They are responsible for managing staff permissions and ensuring that information is used only for authorized rental purposes.

Tenants and other individuals

Individuals may exercise applicable rights concerning their personal information, including access and correction, subject to the Act and any lawful exemptions.

Third-party services and international processing

RentThyme uses Firebase, a Google-provided application development platform, alongside other relevant cloud infrastructure, database, document-storage, email and notification services to operate the platform.

Depending on the services and configurations used, personal information may be stored or processed outside Jamaica.

International processing and transfers must be assessed and managed in accordance with applicable data-protection requirements, including the Act's cross-border transfer provisions and relevant service-provider responsibilities.

Privacy requests

Individuals may submit requests concerning their personal information, including requests for access, correction and other applicable rights under the Act.

Requests may be directed through RentThyme's designated Data Request Center or published privacy contact.

RentThyme may need to verify the requester's identity and coordinate with the relevant landlord, property manager or other responsible data controller before responding.

Requests are handled in accordance with applicable legal requirements, including relevant exemptions.

Data retention and deletion

Personal information should not be retained longer than necessary for its intended purpose, subject to applicable legal, contractual, accounting and other lawful retention requirements.

Account closure does not necessarily mean that every associated record can be deleted immediately. Certain information may need to be retained or handled differently where the law permits or requires it.

Data breaches

Suspected breaches affecting personal information should be promptly identified, assessed, documented and escalated to the appropriate responsible parties.

Under Jamaica's Data Protection Act, the responsible data controller is required to report applicable contraventions and security breaches affecting or potentially affecting personal data to the Office of the Information Commissioner within 72 hours after becoming aware of them.

Affected individuals must also be notified in accordance with the Act and applicable regulations.

Where RentThyme acts as a data processor, it should support the responsible controller in meeting applicable breach-response obligations.

Legal information

This page provides general information about Jamaica's Data Protection Act, 2020. It is not a substitute for the Act, applicable regulations, a complete privacy notice or professional legal advice.

The legal responsibilities of each party depend on the circumstances and their role in processing personal information.

For official information, visit the Office of the Information Commissioner of Jamaica:

https://oic.gov.jm