The Jamaica Civil Aviation Authority (“JCAA”, “we”, “our”, “us”) respects your right to privacy and will protect it when you visit our websites. In order to understand how people use our sites generally, and to create more valuable experiences for you, we may collect data about your use of our sites. In this Notice, the JCAA explains how it collects, uses and protects your personal data and your rights regarding personal information.

This Privacy Notice applies to all individuals who interact with the JCAA as consumers or otherwise and explains the JCAA’S information processing practices. It applies to any personal information from or about you provided to the JCAA directly or through our websites and to any personal information we collect from other sources. The JCAA might aggregate personal data from different sources (websites, offline event) and across different devices. This Notice does not apply to your use of a third-party website which may be linked to the JCAA’s websites. We encourage you to read those privacy policies to learn how they collect and use your information.

If you do not provide the necessary personal data to us, we may not be able to provide you with our services.

This Privacy Notice provides important information on the following:

1. What is Personal Data?
2. What Personal Data does the JCAA collect and how?
3. How will the JCAA use your Personal Data?
4. Disclosure
5. How does the JCAA store your Personal Data?
6. What are your Rights?
7. What are Cookies?
8. How the JCAA uses Cookies
9. How to manage Cookies
10. Changes to the JCAA’s Privacy Policy
11. How to contact the JCAA
12. Consent

As business and technology evolve, the JCAA may need to change this Notice and we encourage you to regularly review same to ensure that you are up to date with how the JCAA uses your Personal Data.

A. WHAT IS PERSONAL DATA?

Throughout this Notice, you will see certain terms which are defined and have specific meanings in the context of this Notice. These definitions are set out below:-

1. ‘Personal Data/Personal Information’ means any information relating to a living individual or an individual who has been deceased for less than thirty years who can be identified from that information alone or from that information and other information in the possession of, or likely to come into the possession of the data controller and includes any expression of opinion about that individual and any indication of the intentions of the data controller or any other person in respect of that individual.

2. ‘Data processing’ means obtaining, recording or storing the information of personal data, carrying out any operation or sets of operations (whether or not by automated means) on the information or data including (a) organizing, adaptation or alteration of the information or data; (b) retrieving, consulting or using the information or data; (c) disclosing the information or data by transmitting, disseminating or otherwise making it available; or (d) aligning, combining, blocking, erasing or destroying the information or data, or rendering the data anonymous.

3. ‘Data processor’ means any person, other than an employee of the data controller, who processes the data on behalf of the data controller.

B. WHAT PERSONAL DATA DOES THE JCAA COLLECT AND HOW?

Depending on how you interact with the JCAA (online, offline, over the phone etc) the JCAA collects various types of information about you in order to best serve your needs. We collect information when you create an account, request a service from us, register with or use our websites or applications, pay fees, contact us with a complaint or query, provide feedback, fill in a form, send us an email, call us, share content on our websites or publicly share information about the JCAA, or contact us on social media.

We also collect data that we create, such as when you apply for licences and permits and data that is automatically collected when you access our websites or applications including IP address, device ID, browser used or how you interact with our websites prior to or after having a JCAA account.

Information collected includes:

1. Personal details and contact information – including occupation, lifestyle and social circumstances, employment and education details and information that would allow us to contact you, such as your name, postal address, email address, social network details or phone number.
2. Licence numbers or other official document information – to verify your identity.
3. Aviation related background – such as whether you are a flight instructor or mechanic.
4. Account login information – that is required to give you access to your specific account profile, including your login ID/email address, screen name, password in unrecoverable form, and/or security questions and answer.
5. Demographic information and interest – which is information that describes your demographic or behavioural characteristics such as your date of birth, age or age range, gender, and geographic location.
6. Information from computer/mobile device – about the computer system or other technological device that you use to access our websites or applications, such as the IP address used to connect your computer or device to the internet, operating system type and web browser type and version. If you access the JCAA’s websites or applications via a mobile device such as a smartphone, the collected information will also include where permitted, your phone’s unique device ID, advertising ID, geo-location, and other similar mobile device data.
7. Websites/communication usage information – as you navigate through and interact with our websites/applications or newsletters, we use automatic data collection technologies to collect certain information about your actions. This includes information such as links you click on, which pages or content you view and for how long and other similar information and statistics about your interactions, such as content response times, download errors and length of visits to certain pages. This information is captured using automated technologies such as cookies and web beacons, and is also collected through the use of third party tracking for analytics and advertising purposes. You have the right to object to the use of such technologies in accordance with the provisions herein contained.
8. Market Research & Consumer feedback – that you voluntarily share with the JCAA about your experience of using our services.
9. Consumer-generated content – any content you create and then share with the JCAA on third party social networks or by uploading it to our websites or applications, including the use of third party social network applications such as Facebook, Instagram and Twitter. Examples include photos, videos, personal stories or other similar media content. Where permitted, we collect and publish consumer-generated content in connection with a variety of activities, including contest and other promotions, website community features, consumer engagement and third party social networking.
10. Payment and Financial information – any information that we need in order to fulfil a request or service, or that you use to make a payment, such as your credit card details (cardholder name, card number, expiration date, etc) or other forms of payment (if such are made available). In any case, the JCAA or its payment processing provider(s) handle payment and financial information in a manner compliant with applicable laws, regulations and security standards.
11. Customer Support – communication with the JCAA may be recorded or listened into, in accordance with applicable laws, for local operational needs (eg for quality or training purposes). Payment card details are not recorded. Where required by law, you will be informed about such recording at the beginning of your call.
12. Sensitive Personal Data – due to the nature of our business and regulatory requirements, we are likely to collect and otherwise process sensitive personal data in the ordinary course of our business. Where it becomes necessary to process your sensitive personal data for any reason, we rely on your express consent for any processing which is voluntary (eg marketing purposes). If we process your sensitive personal data for other purposes, we rely on the following legal bases: (i) detection and prevention of crime (including the prevention of fraud); and (ii) compliance with applicable law (eg regulatory requirements).

We process personal information about the following non-exhaustive list of persons:

• Customers
• Witnesses
• Employees
• Students
• Suppliers
• Complainants or their representatives
• Subject of a complaint or their representatives
• Individuals who we may contact when carrying out a complaint or enquiry
• Service providers
• Lobbyists
• Offenders and suspected offenders
• Applicants for a licence or registration
• Authors, publishers and other creators
• Individuals captured by CCTV images
• Consultants and advisers
• Survey respondents
• Journalists and the media
• Enquirers
• Workers (in addition to employees)
• Individuals attending training which we will be helping to organise
• Those working for the companies/entities we regulate
• Those seeking different types of approvals from the JCAA
• Applicants for national security vetting who work for the aviation industry

C. HOW WILL THE JCAA USE YOUR PERSONAL DATA?

The JCAA uses personal information including any sensitive personal data that you have provided to us with your consent, to deliver services, communicate with you, answer your queries, respond to your complaints, reply to your feedback comments, manage your access to restricted areas of the website, fulfil requests for reports and other similar information, register you for a member/online account, issue certificates (licences), fulfil contractual and legal obligations, and for our legitimate interests.

The gathering of personal data also allows the JCAA to inter alia comply with applicable laws and regulatory duties which may include:

• Consideration and investigation of complaints and policy issues
• Formal enforcement actions
• Providing advice and information
• Maintaining our own accounts and records
• Supporting and managing our employees
• Sending promotional communications about the services we provide
• Undertaking research
• Administration of licences and permits
• Maintenance of a public register
• Internal support functions
• Corporate administration and all activities we are required to carry out as a data controller and a public authority
• The use of CCTV and other systems for crime prevention
• Offering and conducting training exercises and assessment
• Processing and validating your application
• Facilitating payment of publication and other fees
• Protecting our systems, networks and staff
• Improving and developing new services
• Processing any other service you may request

The JCAA also uses personal data for its own purposes. When the JCAA uses personal data for its own purposes, it uses it to analyse and improve how it delivers and markets its services. For this purpose, the JCAA may use your e-mail address or mailing address in order to conduct a survey, to add you to our mailing list, or by your request, to have someone contact you for additional information. Whenever we request your identity, the JCAA will clearly indicate the purpose of the inquiry before the information is requested. The JCAA maintains a strict “No Spam” policy which means that the JCAA does not intend to sell, rent, or otherwise give your e-mail address to a third-party, without your consent.

In addition, our websites will not send you e-mails that you have not agreed to receive. If you are a member of our Mailing List, you will be contacted with announcements and news. You have the option of “Unsubscribing” from our Mailing List at any time, thereby disabling any further such e-mail communication from being sent to you. If you wish to have specific communications with a member of the JCAA staff, you will be required to provide specific information that will be routed to the appropriate contact within JCAA.

D. DISCLOSURE

The JCAA limits the disclosure of your personal data to others. However, the JCAA may need to share your personal data in certain instances and where this is necessary, the JCAA will comply with the applicable privacy laws. The JCAA may need to share information mainly in the following circumstances:-

1. Where disclosure is required for our legitimate interests or with your consent, your information may be shared with the Government of Jamaica, JCAA subsidiaries and affiliates, relevant public agencies and authorities and other third parties including Aviation Security (AVSEC), debt collectors, banking institutions, investigators, lawyers and others who are involved in the claims, investigation and licencing process.
2. Personal information may be shared with third parties engaged to provide services to the JCAA such as administering the JCAA’s websites, applications, and services available to you, subject to appropriate protections.
3. Personal information may also be shared with service providers which have been retained by the JCAA to perform services on the JCAA’s behalf, either in relation to services performed for you or information which the JCAA uses for its own purposes.
4. Personal information may be disclosed if the JCAA is required to do so by law, legal process, statute, rule or regulation, or in connection with an investigation of suspected or actual illegal activity, or if the JCAA believes disclosure is necessary or appropriate to prevent physical harm or financial loss.
5. Disclosure may also be required in the course of audits of the JCAA.

Where necessary or required, we share information with:

• data subjects listed above
• family, associates and representatives of the person whose personal data we are processing
• professional advisers and consultants
• services providers
• credit reference agencies
• debt collection and tracing agencies
• police forces
• private investigators
• current, past or prospective employers and examining bodies
• financial organisations
• central government
• other companies within our group
• suppliers
• persons making an enquiry or complaint
• organisation subject to a complaint or assessment
• prosecuting authorities, courts
• other ombudsman and regulatory authorities
• security organisations including vetting organisations

The JCAA does not rent, sell or otherwise disclose personal data to unaffiliated third parties for their own marketing use.

E. HOW DOES THE JCAA STORE YOUR DATA?

The security of your personal information is important to the JCAA and as such, the JCAA uses a variety of measures to keep your personal data confidential and secure, including restricting access to your personal data on a need-to-know basis and following appropriate security standards to protect your data. The JCAA has put in place reasonable physical, technical and administrative security standards to protect your information from loss, misuse, unauthorised alteration and destruction.

The JCAA will use technical and organisational measures to safeguard your personal data. For example:

• Only authorised JCAA employees, and authorised employees of our Third-Party Service Providers processing data on our behalf, have access to your personal data.
• All JCAA employees who have access to your personal data are required to adhere to established protocols and all Contractors who have access to your personal data are requested by the JCAA to adhere to established standards of confidentiality and non-disclosure.
• Additionally, such Third-Party Service Providers acting as data processors for the JCAA that have access to your personal data, are required to ensure that they have the requisite level of security in place, and that your personal data is processed only as instructed by the JCAA.
• The JCAA employs internal access controls to ensure that the only people who see your information are those who need to do so to perform their official duties.
• We use technical controls to secure the information we collect online including but not limited to Transport Layer Security (TLS), Encryption, Firewalls, Password protections.
• We secure the areas where we hold hard copies of information we collect online and perform regular backups of the information we collect online to insure against loss.
• We periodically test our security procedures to ensure personnel and technical compliance and employ external access safeguards to identify and prevent unauthorised tries of outsiders to hack into, or cause harm to, the information in our systems.

The JCAA will take every reasonable step to ensure that your personal data is only processed for the minimum period necessary in connection with: (i) the purposes set out in this Privacy Notice; (ii) any additional purposes notified to you at or before the time of collection of the relevant personal data or commencement of the relevant processing; or (iii) as required or permitted by applicable law; and thereafter, for the duration of any applicable limitation period.

Whilst the JCAA will use all reasonable efforts to safeguard your personal data, you acknowledge that the use of the internet is not entirely secure and that for this reason, the JCAA cannot guarantee the security or integrity of any personal data which is transferred from or to you via the internet. If at any time there has been a breach to our systems which compromises your personal data, the JCAA aims to notify you within 72 hours of first becoming aware of the breach.

It is also important that you play a role in keeping your personal data safe and secure. When signing up for an online account, please be sure to choose an account password that would be difficult for others to guess and never reveal your password to anyone else. You are responsible for keeping this password confidential and for any use of your account. If you use a shared or public computer, never choose to have your login ID/email address or password remembered and make sure to log out of your account every time you leave the computer. You should also make use of any privacy settings or controls we provide you on our websites/applications.

F. WHAT ARE YOUR RIGHTS?

Whenever the JCAA asks you to provide any personal data, you will be told why we need it and how it will be used. Your personal data will only be processed for the purposes set out in this Notice, or any other further purpose notified to you before the processing begins. If you choose not to provide personal data when we ask you, this may limit the services we can offer you. If you share personal data with us, you have the right to do any of the following by logging into your account or contacting us as provided herein:-

1. Access Personal Data - You may ask us to confirm whether or not we have and are using your personal information. You may also request copies of your personal data.
2. Withdraw Consent - Where the JCAA has requested your consent to use personal information, you have the right to withdraw that consent.
3. Request Corrections - You may request that the JCAA corrects any information you believe to be inaccurate or complete information which you believe is incomplete.
4. Request Erasure - You have the right to request that the JCAA erases your personal data under certain circumstances. The JCAA may not always be able to comply with this request where for example, the JCAA needs to keep using your personal information in order to comply with its legal obligations or where we need to use it to establish, exercise or defend legal claims.
5. Restrict Processing - You have the right to request that the JCAA restricts the processing of your personal data. For example, if you believe the information to be inaccurate or if the information is no longer required for the purposes for which it was collected or if you have exercised the right to object and verification of overriding grounds is pending.
6. Transfer data - You may also have the right to request that the JCAA transfers your personal data to you or another organisation.
7. Decline Automated Decision Making - You have the right to not be subject to decisions, based solely on automated decision making.

Please be aware that in certain circumstances, the JCAA will not be able to delete your personal data without also deleting your online account. We may be required to retain some of your personal data after you have requested deletion, to satisfy our legal or contractual obligations. We may also be permitted by applicable laws to retain some of your personal data to satisfy our business needs.

Where available, our websites/applications have a dedicated feature through which you can review and edit the personal data that you have provided. Please note that we require our registered consumers to verify their identity (eg login ID/email address, password) before they can access or make changes to their account information. This helps prevent unauthorised access to your account.

G. WHAT ARE COOKIES

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. When you visit the JCAA’s website, the JCAA may collect information from you automatically through cookies or similar technology. For example, we may monitor how many times you visit, which pages you go to, traffic data, location data and the originating domain name of a user’s internet service provider.

H. HOW THE JCAA USES COOKIES

The information obtained from the use of Cookies helps us to develop our website and services and may provide such aggregate and statistical information to third parties. These statistics DO NOT include information that can be used to identify any individual.

From time to time, we may provide your information to our customer service/regulatory agencies for research and analysis purposes so that we can monitor and improve the services we offer.

The information we obtain from our use of cookies will not usually contain your personal data. Although we may obtain information about your computer or other electronic device such as your IP address, your browser and/or other internet log information, this will not usually identify you personally. In certain circumstances, we may collect personal information about you but only where you voluntarily provide it (e.g. by completing an online form). In most cases, we will need your consent in order to use Cookies on this website. The exception is where the cookie is essential in order for us to provide you with a service you have requested.

I. HOW TO MANAGE COOKIES

You can set your browser to not accept cookies. Please note that in few cases, some features of our websites may not function if you disable cookies. We use cookies to ensure that we give you the best experience on our website. If you continue to use our sites, you are deemed to have accepted the cookies.

J. CHANGES TO THE JCAA’S PRIVACY POLICY

The JCAA may change its Privacy Policy from time to time and any changes will be posted on this Privacy Notice page so that you are always aware of the information that we collect, how we use it, and the circumstances under which we disclose it.

This Notice was last updated December 2020.

K. HOW TO CONTACT THE JCAA

If you wish to review further and more detailed information on data rights you may review the Data Protection Act, 2020, which is set to be gazetted.

If you have any questions about this Notice, the data we hold on you or if you would like to exercise any of your data protection rights as outlined in this Notice, please do not hesitate to contact us at:

Email to: info@jcaa.gov.jm
Call us on: 876-960-3948
Address: 4 Winchester Road, Kingston 10, Jamaica, W.I.

L. CONSENT

To provide you with the services you require, the JCAA may collect, use, store and share your personal data in keeping with the terms of this Notice. Before doing so we will request your consent where required. If you give your consent and wish to withdraw it at any time and or wish to exercise any of your data protection rights, then you may contact us as provided above.