0

Items

0

Privacy Policy

Jabites Food Delivery Service - Privacy Policy

Effective Date: April 16, 2025

1. Introduction

Welcome to Jabites ("Jabites," "we," "us," or "our"). Jabites operates a technology platform, including our website and mobile applications (collectively, the "Platform"), designed to connect customers ("Customers") seeking food and potentially other goods with restaurants and stores ("Merchants") and independent delivery personnel ("Delivery Personnel") in Jamaica.

We are committed to protecting the privacy and security of the personal data of all users of our Platform. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data in compliance with the Jamaica Data Protection Act, 2020 ("DPA").

This Policy applies to Customers, Merchants, and Delivery Personnel interacting with our Platform. Please read this Policy carefully.

2. Scope of this Policy

This Policy applies to all personal data processed by Jabites in relation to the use of our Platform and Services by Customers, Merchants, and Delivery Personnel.

3. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person ('data subject').
     
  • Processing: Any operation performed on personal data (collection, use, storage, sharing, etc.).
     
  • Data Controller: Jabites is the Data Controller for the personal data processed through the Platform.
     
  • Data Processor: An entity processing personal data on behalf of Jabites (e.g., payment processors, cloud hosting).
     
  • Data Subject: An identified or identifiable natural person (Customer, Merchant representative, Delivery Person).
     
  • Sensitive Personal Data: Includes genetic data, data concerning health, sex life, sexual orientation, political opinions, religious beliefs, philosophical beliefs, trade union membership, and data relating to criminal convictions or offences.
  • OIC: The Office of the Information Commissioner, the Jamaican data protection supervisory authority.

4. Information We Collect

We collect different types of personal data depending on your interaction with the Platform:

(A) For Customers:

  • Identity & Contact Data: Full name, email address, telephone number.
     
  • Location Data: Delivery address, billing address (we may use Google Maps services to help determine and verify addresses). Real-time location may be collected while using the app for delivery coordination if enabled.
     
  • Transaction Data: Order history, items purchased, interaction with promotions, details regarding top-ups to your Jabites digital wallet.
     
  • Financial Data: We do not directly collect or store full credit/debit card numbers. When you make a purchase or top up your wallet, your payment details are securely provided directly to our third-party payment processors (Amber Pay, FAC, PayPal, Stripe – all PCI-DSS Level 1 compliant). We receive confirmation of payment, transaction identifiers, and limited card information (e.g., card type, last four digits) from the processor to facilitate the order.
     
  • Account/Profile Data: Login credentials (password, or confirmation of successful login via social media), preferences, feedback.
     
  • Technical & Usage Data: IP address, device type, operating system, browser type, app version, usage patterns within the Platform, interaction data collected via cookies and similar technologies (see Section 14).
     
  • Communications Data: Records of communications with Jabites support or feedback provided.
     

(B) For Merchants (Restaurants/Stores):

  • Business Information: Registered business name, business registration certificate copy, business address(es).
     
  • Contact Person Data: Name, telephone number, email address of the primary contact(s) or owner(s).
     
  • Identity Verification Data: Copy of national identification for the primary account holder/owner to validate legitimacy.
     
  • Location Data: Physical store address(es) (we may use Google Maps services for verification and display to Customers/Delivery Personnel).
     
  • Financial Data: Bank account details (for disbursement of payments from Jabites). If subscribing to Jabites packages, payment details are collected via our payment processors (Amber Pay, FAC, PayPal, Stripe), similarly to customer payments.
     
  • Account/Profile Data: Login credentials, subscription details, operational preferences.
     
  • Technical & Usage Data: As described for Customers, related to Platform interaction.
     
  • Communications Data: As described for Customers.
     

(C) For Delivery Personnel:

  • Identity & Contact Data: Full name, residential address, email address, telephone number.
     
  • Verification Data: Copy of valid driver's license, vehicle registration, vehicle insurance (if applicable), copy of a police record or background check results (see Sensitive Personal Data below).
     
  • Location Data: Real-time location data collected via the Jabites app (using device GPS and potentially Google Maps services) while online and particularly during active deliveries, for dispatching, tracking progress for the Customer and Merchant, and calculating payments.
     
  • Financial Data: Bank account details (for disbursement of payments from Jabites).
     
  • Account/Profile Data: Login credentials, delivery history, performance metrics, ratings/feedback.
     
  • Technical & Usage Data: As described for Customers, related to Platform interaction.
     
  • Communications Data: As described for Customers.
     

(D) Sensitive Personal Data:

  • Criminal Records Data (Delivery Personnel): We collect police records or conduct background checks as part of the screening process for Delivery Personnel. This is processed based on your explicit consent and our legitimate interest (and potentially legal requirements) in ensuring the safety and security of our Platform users and the public. Access to this data is strictly limited.

5. How We Collect Your Personal Data

  • Directly from You: When you register, create a profile, place orders, update information, contact support, respond to surveys, or otherwise directly provide information through the Platform.
     
  • Automatically: When you use the Platform, we collect Technical, Usage, and Location data via cookies, analytics tools (like Google Analytics), device permissions (like GPS for location), and server logs.
     
  • From Third Parties:
     
    • Payment Processors (Amber Pay, FAC, PayPal, Stripe): Provide transaction confirmation and limited payment details.
    • Google (Maps/Analytics): Provide location verification, mapping services, and usage analytics.
    • Social Media Platforms: If you use social login, they provide basic profile information (name, email, profile picture) based on your permissions.
    • Merchants/Customers/Delivery Personnel: May provide information about each other (e.g., feedback, ratings, incident reports).
    • Background Check Providers: Provide results for Delivery Personnel screening (with consent).
    • Public Sources: May be used occasionally for verification (e.g., business registries for Merchants).

6. Legal Basis for Processing Personal Data

We process your personal data based on the following legal grounds under the DPA:

  • Performance of Contract: Processing necessary to provide the Jabites service, including registering accounts, facilitating orders between Customers and Merchants, enabling deliveries by Delivery Personnel, processing payments (initiating via processors, receiving confirmations), disbursing funds, managing accounts, and providing support.
     
  • Legal Obligation: Processing necessary to comply with Jamaican laws (e.g., tax laws, record-keeping, responding to lawful requests from authorities, identity verification where required).
     
  • Legitimate Interests: Processing for purposes like:
     
    • Platform security and fraud prevention.
    • Improving our Platform and Services (using analytics, feedback).
    • Validating Merchant legitimacy and screening Delivery Personnel for safety.
    • Operational efficiency (e.g., dispatching Delivery Personnel).
    • Direct marketing of similar services (where permitted, with opt-out).
    • Enforcing our terms and conditions.
  • We conduct balancing tests to ensure our legitimate interests do not override your rights.
     
  • Consent: Where required by law or where we choose to rely on it, such as:
     
    • For specific marketing communications.
    • For collecting police records/background checks from Delivery Personnel.
    • For using certain non-essential cookies or tracking technologies.
    • For processing any other sensitive personal data not covered by another legal basis.
  • You can withdraw consent at any time (see Section 12).
     

7. How We Use Your Personal Data

We use your personal data for purposes including:

  • Providing Services: Registering users, connecting Customers, Merchants, and Delivery Personnel, facilitating order placement, payment processing (via processors), delivery tracking, and wallet management.
     
  • Onboarding & Verification: Verifying identity and eligibility (Merchants, Delivery Personnel), including background checks for Delivery Personnel.
     
  • Communication: Sending service updates, order confirmations, support messages, promotional offers (with consent/opt-out).
     
  • Payments: Facilitating payments from Customers, managing subscriptions for Merchants, disbursing earnings to Merchants and Delivery Personnel.
     
  • Platform Improvement: Analysing usage patterns (often using aggregated/anonymised data) to enhance user experience, features, and efficiency. Using Google Analytics for insights.
     
  • Safety & Security: Fraud detection/prevention, monitoring for violations of terms, ensuring safety during deliveries, resolving disputes.
     
  • Location-Based Services: Using Google Maps/device GPS for address verification, showing nearby Merchants, dispatching Delivery Personnel, tracking delivery progress.
     
  • Legal Compliance: Meeting legal and regulatory requirements.
     
  • Marketing: Sending information about Jabites services, promotions, or news (subject to consent/opt-out).
     

8. Disclosure of Your Personal Data

We may share your personal data with:

  • Between Platform Users (Necessary for Service):
     
    • Customer's name, contact, delivery address, order details are shared with the selected Merchant and assigned Delivery Person.
    • Merchant's name and location shared with Customers and Delivery Personnel.
    • Delivery Person's name, photo (if applicable), real-time location (during active delivery) are shared with the Customer and Merchant.
  • Service Providers (Data Processors):
     
    • Payment Processors: Amber Pay, FAC, PayPal, Stripe handle payment card data directly.
    • Cloud Hosting Providers: Store our data securely.
    • Analytics Providers: Google Analytics (usage insights).
    • Mapping Services: Google Maps (location features).
    • Background Check Providers: For screening Delivery Personnel.
    • Communication Platforms: For OTP SMS or push notifications.
    • Customer Support Software Providers.
  • We have contracts requiring processors to protect your data.
     
  • Professional Advisors: Lawyers, accountants, auditors, insurers, where necessary.
     
  • Legal Authorities: If required by law, court order, or governmental request.
     
  • Business Transfers: In connection with a merger, sale of assets, financing, or acquisition of our business.
     
  • With Consent: To other third parties if you explicitly consent.
     

9. International Data Transfers

Some of our service providers (e.g., Google, Stripe, and potentially cloud hosting) may be located outside Jamaica. Therefore, your data may be transferred, stored, and processed outside Jamaica. We ensure such transfers comply with the DPA by relying on:

  • Adequacy decisions (where applicable).
     
  • Standard Contractual Clauses approved for use under the DPA.
     
  • Your explicit informed consent for specific transfers.
     
  • Other safeguards permitted by the DPA.
     

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, use, alteration, or disclosure. This includes encryption, access controls, staff training, and secure data handling procedures. Our payment processors (Amber Pay, FAC, PayPal, Stripe) are PCI-DSS Level 1 compliant, providing high security for payment card data. Access to sensitive data like background checks is highly restricted. However, no internet transmission is 100% secure.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, reporting, or dispute resolution requirements. Retention periods vary based on data type and context (e.g., transaction data kept longer for legal reasons than temporary location data). We consider the nature, sensitivity, potential risk, processing purposes, and legal obligations when determining retention periods. You may request deletion under certain circumstances (see Section 12).

12. Your Data Protection Rights

Under the Jamaica DPA, you have rights including:

  • Right to be Informed: About how we process your data (via this Policy).
     
  • Right of Access: To request copies of your personal data.
     
  • Right to Rectification: To correct inaccurate or incomplete data.
     
  • Right to Erasure ('Right to be Forgotten'): To request deletion where data is no longer necessary, consent is withdrawn (and no other basis applies), etc.
     
  • Right to Restrict Processing: To limit how we use your data in certain situations.
     
  • Right to Data Portability: To receive your data in a machine-readable format or transfer it to another controller (where applicable).
     
  • Right to Object: To processing based on legitimate interests or for direct marketing.
     
  • Rights Related to Automated Decision-Making: To safeguard against purely automated decisions with significant effects.
     
  • Right to Withdraw Consent: At any time, where processing relies on consent.
     
  • Right to Lodge a Complaint: With the OIC (see Section 17).
     

To exercise rights, contact us using the details in Section 16. We will respond according to DPA timelines and may need to verify your identity.

13. Children's Privacy

The Platform is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware of such a collection, we will take steps to delete the information.

14. Cookies and Tracking Technologies

We use cookies, pixels, device identifiers, and similar technologies for functionality, analytics (Google Analytics), location services, and potentially targeted advertising (with consent where required). You can manage cookie preferences through your browser settings and potentially within our Platform. Disabling essential cookies may affect Platform functionality. 

15. Changes to This Privacy Policy

We may update this Policy. We will notify you of significant changes via the Platform or email and update the “Effective Date.” Please review periodically.

16. Contact Us

For questions about this Policy or to exercise your rights, please contact:

Jabites

Attention: Privacy Team

36 High Street, B93

Black River, St. Elizabeth, Jamaica
Email: [email protected]

17. Supervisory Authority

You have the right to lodge a complaint with the Jamaican data protection authority:

Office of the Information Commissioner

Masonic Building, 2nd Floor. 

45 – 47 Barbados Avenue , Kingston 5

Email: [email protected]

Phone: (876) 929-8568

Website: https://oic.gov.jm/