Privacy Policy

Effective date: 1 May 2026 · Version 1.0 · Aligns with the Data Protection Act 2020 (Jamaica)

Contents 1. Who we are 2. Personal data we collect 3. Why and how we use data 4. Lawful basis for processing 5. Who we share data with 6. International transfers 7. Retention 8. Your rights as a data subject 9. Cookies & tracking 10. Security 11. Data breaches 12. Children 13. Contact & complaints

1. Who we are

MGR Courier Service Limited ("MGR") is the data controller for personal data we collect about you. We are registered with the Office of the Information Commissioner of Jamaica.

Data Protection Officer (DPO): dpo@mgrcouriers.com · Kingston, Jamaica

2. Personal data we collect

Category	Examples
Identifiers	Name, TRN, passport / driver's licence number, date of birth
Contact	Address, phone, email
Account	Username, hashed password, 2FA secrets, login timestamps
Shipment	Cargo descriptions, invoices, bills of lading, photos, tracking
Financial	Payment confirmations (we never store full card numbers)
Device	IP address, browser version, approximate location
Sensitive	Where required for clearance: health information (medical-device imports), biometric ID copies for KYC, criminal record clearances for FLA/MNS permits

3. Why and how we use data

To provide our services — quotes, bookings, customs clearance, tracking, payments.
To verify identity and prevent fraud (KYC).
To meet legal obligations to Customs, TAJ, the Trade Board, and other regulators.
To communicate with you about your shipments and our services.
To improve our services through anonymous analytics.
To enforce our Terms of Use.

4. Lawful basis for processing

We rely on the following lawful bases under the Jamaica Data Protection Act 2020 (DPA):

Performance of a contract — to deliver the services you requested.
Legal obligation — to comply with customs, tax, AML / POCA, and sanctions law.
Legitimate interests — fraud prevention, network security, service improvement.
Consent — for marketing communications and non-essential cookies. You may withdraw consent at any time.

Regulators — Jamaica Customs Agency, TAJ, Trade Board, Bureau of Standards, Plant Quarantine, Veterinary Services, NEPA, FLA, MOHW, and other authorities listed in our Disclosure Policy.
Carriers — ocean lines, air lines, trucking companies and port operators who actually move your Cargo.
Service providers — payment processors, hosting and cloud providers, identity-verification vendors, signing-platform providers — bound by written data processing agreements.
Professional advisers — accountants, lawyers, insurers, auditors.
Law enforcement — where lawfully compelled by court order, search warrant, or similar.

We do not sell your personal data, ever.

6. International transfers

Some of our service providers are located outside Jamaica. Where we transfer personal data outside Jamaica we do so under one of the safeguards permitted by the DPA — the data subject's consent, performance of a contract, the recipient's substantially similar protection, or standard contractual clauses approved by the Information Commissioner.

7. Retention

Data	Retention period
Customs entries, brokerage files	7 years (Customs Act minimum)
Tax records, invoices	6 years (Revenue Administration Act)
Account & KYC records	7 years after closure (POCA)
Shipment tracking GPS data	90 days then aggregated
Marketing email subscription	Until withdrawn + 30 days
Server logs	13 months

8. Your rights as a data subject

Under the DPA you have the right to:

Access your personal data and obtain a copy.
Have inaccurate data corrected.
Request erasure where there is no overriding legal basis.
Restrict or object to certain processing, including direct marketing.
Receive a copy of your data in a structured, commonly-used format (data portability).
Withdraw consent at any time without affecting prior lawful processing.
Lodge a complaint with the Office of the Information Commissioner.

To exercise any of these rights, email dpo@mgrcouriers.com. We respond within 30 days.

9. Cookies & tracking

We use a small number of strictly-necessary cookies for authentication and security. Optional analytics cookies are used only with your consent. See our Cookie Policy for details.

10. Security

We protect personal data with TLS in transit, AES-256-GCM encryption at rest for sensitive document blobs, password hashing with PBKDF2 + salt, role-based access control, audit logging, and 2FA for staff accounts. No system is perfectly secure; we monitor and improve continually.

11. Data breaches

If we become aware of a personal data breach we will notify the Information Commissioner within 72 hours where there is a risk to data subjects, and notify affected individuals without undue delay. See our Data Breach Response Policy for the full procedure.

12. Children

Our services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Contact & complaints

Data Protection Officer
MGR Courier Service Limited
Kingston, Jamaica
Email: dpo@mgrcouriers.com

Office of the Information Commissioner (Jamaica) — oic.gov.jm

Legal Hub Terms of Use Cookie Policy