Hummingbird Charities Inc.

Privacy Notice (Jamaica Data Protection Act 2020)

Effective date: December 2025

This Privacy Notice explains what personal data we collect about you, how and why we use it, and the rights you have in relation to your information. We are required to notify you of this information under the Jamaica Data Protection Act, 2020 (JDPA).

Please read this Notice carefully, along with any other privacy information we may provide to you when you interact with us.

1. Who We Are

Hummingbird Charities Inc. (“Hummingbird Charities”, “we”, “us”, “our”) is the data controller for personal data processed in connection with our website, programmes, events and fundraising activities.

Legal name: Guanaboa Vale Kitson Town PA, St Catherine
Charity registration number (DCFS): CAIN 100 2048C
Company number (COJ): 114861

If you have any questions about this Notice or how we handle your personal data, please contact:

Data Protection Contact / Officer
Hummingbird Charities Inc.
Guanaboa Vale Kitson Town P.A St Catherine
Tel: [867 7875343
Email: info@hummingbirdcharitiesjm.com

2. Scope of this Privacy Notice

This Notice applies to personal data we collect when:
• You browse or use our website
• You donate or support any of our programmes (including Sole2Sole, Hummingbird Feeds, Hummingbird Builds and Bossman Initiative)
• You sign up for our newsletter, updates or campaigns
• You volunteer, partner or collaborate with us
• You contact us via email, phone, WhatsApp, social media or web forms
• You interact with us at our events or outreach activities

It does not cover how other organisations use your data (for example, payment processors, social media platforms, or partners with their own privacy policies).

3. What Personal Data We Collect

“Personal data” means any information that can identify you directly or indirectly.

Depending on how you interact with us, we may collect:

  • a. Identity Data
  • • Name, title, gender
  • • Organization / role, relationship to the charity
  • b. Contact Data
  • • Address
  • • Email address
  • • Telephone / mobile number
  • c. Donation & Transaction Data
  • • Records of donations and pledges
  • • Payment-related information (processed via our payment provider; we do not store full card details)
  • • Gift designation (e.g. programme supported, parish, campaign)
  • d. Programme & Engagement Data
  • • Information you provide when requesting assistance (e.g. your institution’s details, programme you apply for)
  • • Volunteer applications and participation records
  • • Attendance at events or outreach activities
  • e. Special Category / Sensitive Data (limited and only where necessary)
  • • Information about vulnerability, living conditions or other details you voluntarily share so we can assess and deliver support under our programmes
  • • Basic health or accessibility information relevant to participation in our activities (where strictly necessary)

We will only process this type of data where permitted under the JDPA, such as with your written consent, to protect your vital interests, or where necessary for our charitable and social support functions.

  • f. Technical & Usage Data (website)
  • • IP address
  • • Browser type and version
  • • Device type and operating system
  • • Pages viewed, time and date of visits, clicks and navigation paths
  • • Cookie preferences and similar tracking information
  • g. Marketing & Communication Preferences
  • • Your preferences about receiving updates, newsletters and fundraising appeals
  • • Records of consent or opt-out

4. How We Collect Your Personal Data

We collect personal data in the following ways:

a. Directly from you
When you:
• Fill in a form on our website
• Make a donation
• Sign up as a volunteer or partner
• Contact us by email, phone, WhatsApp or social media
• Attend one of our events or outreach activities

b. From third parties
For example:
• Payment service providers or fundraising platforms (e.g. bank, online donation platforms)
• Partner organisations that refer you (with appropriate consent or other lawful basis)
• Publicly available sources, where appropriate for due diligence or partnership purposes

c. Automatically when you use our website
• Through cookies and similar technologies that help us understand how our website is used and improve your experience.

5. Lawful Bases for Processing Your Personal Data

Under the Jamaica Data Protection Act, we must have a lawful basis to process your personal data. The main bases we rely on are:

• Consent – where you have clearly agreed (for example, to receive marketing emails or to share sensitive information for programme support).

• Contract/steps to enter a contract – where processing is necessary to administer a donor, volunteer, consultancy or partnership agreement.

• Legal obligation – where we must process data to comply with laws and regulations (e.g. tax, charities law, anti-fraud, reporting obligations).

• Vital interests – in rare cases, where processing is necessary to protect someone’s life or safety.

• Public interest / charitable functions – to carry out our legitimate charitable activities that benefit communities and vulnerable persons.

• Legitimate interests – where processing is necessary for our legitimate interests (for example, managing our relationship with donors and partners, improving our programmes and website, safeguarding, or protecting our legal rights) and does not override your rights and freedoms.

Where we rely on consent, you may withdraw it at any time by contacting us using the details in Section 18.

6. How We Use Your Personal Data

We may use your personal data to:
• Administer donations and fundraising activities – processing your donation, issuing receipts, and updating our donor records
• Manage our programmes and services – identifying and verifying beneficiaries and partner institutions; planning and delivering interventions (e.g. Sole2Sole shoe distribution, Hummingbird Feeds meal support, housing or mobile health outreach)
• Communicate with you – responding to enquiries and requests; providing updates about projects you support
• Manage volunteers, staff and partners – processing applications, screening, scheduling, and coordination
• Send marketing and campaign communications – with your consent, we may send newsletters, impact stories, campaign updates and fundraising appeals
• Improve our website and operations – monitoring usage patterns, fixing technical issues, and enhancing user experience
• Carry out monitoring, evaluation, reporting and research – analysing anonymised or aggregated data to understand impact and improve our programmes
• Protect our organisation and comply with the law – fraud prevention, safeguarding and risk management; responding to legal requests, audits, regulators, and authorities where required

We will not use your personal data for purposes that are incompatible with those stated above.

7. Direct Marketing and Your Choices

We may use your contact details to send you:
• Newsletters and impact updates
• Invitations to events
• Appeals and fundraising campaigns

We will only send electronic marketing (email, SMS, WhatsApp broadcasts) where permitted under the JDPA, and you may opt out at any time by:
• Using the “unsubscribe” link in emails, or
• Contacting us using the details in Section 18.

8. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:
• Make the site function properly
• Remember your preferences
• Analyse how visitors use the site, so we can improve content and performance

Where required, we will display a cookie banner asking for your consent for non-essential cookies. You can manage your cookie preferences through your browser settings and our cookie tools.

9. Sharing Your Personal Data

We do not sell your personal data.

We may share your personal data with:
• Service providers (data processors) who support our work, such as website hosting and IT service providers, email and newsletter platforms, payment and donation platforms, and cloud storage and document management services
• Programme partners and implementing organisations – where necessary to coordinate assistance, referrals, or joint interventions, and subject to appropriate safeguards
• Professional advisers – lawyers, accountants, auditors and insurers, where necessary for legal or governance purposes
• Regulators, law enforcement, tax and other authorities – where required by law, regulation, court order, or to protect our legal rights or those of others

10. International Transfers

Some of our service providers or partners may be located outside Jamaica, for example where we use global cloud services, email platforms or donation platforms.

When we transfer personal data outside Jamaica, we will take steps to ensure that the recipient provides an adequate level of protection consistent with the JDPA’s standards for cross-border transfers.

11. Data Retention – How Long We Keep Your Data

We will keep your personal data only for as long as necessary for the purposes for which it was collected, including for:
• Meeting legal, accounting and reporting requirements
• Responding to complaints or legal claims
• Demonstrating compliance with the JDPA

Different categories of data may be kept for different periods, for example:
• Donation and finance records – retained for the period required under tax and charity laws
• Programme records – retained for a period necessary to monitor impact, meet reporting obligations to donors, and protect our legal rights
• Marketing consent records – retained while you remain subscribed and for a short period afterwards to demonstrate compliance

When data is no longer needed, we will securely delete, anonymise or otherwise dispose of it in line with our data retention and disposal practices.

12. Security of Your Personal Data

We take appropriate technical and organisational measures to protect your personal data against:
• Unauthorised access or disclosure
• Accidental loss, alteration or destruction

These measures include, where appropriate:
• Access controls and authentication
• Encryption and secure connections (such as HTTPS)
• Secure storage and backups
• Staff and volunteer awareness measures on data protection and confidentiality

However, no system or transmission of data over the internet can be completely secure, and we cannot guarantee absolute security.

13. Your Rights Under the Jamaica Data Protection Act

Under the Jamaica Data Protection Act, you have specific rights in relation to your personal data. These include:

1. Right to be informed – to know whether we process your personal data and how we use it.
2. Right of access – to request a copy of the personal data we hold about you, and information about how it is processed.
3. Right to rectification – to ask us to correct inaccurate or incomplete personal data.
4. Right to erasure (in certain circumstances) – to request that we delete your personal data where, for example, it is no longer necessary for the purposes for which it was collected, you withdraw consent, or we have processed it unlawfully.
5. Right to restrict processing – to request that we limit the way we use your data in certain situations (e.g. where accuracy is contested).
6. Right to data portability – to request that certain personal data you provided be transferred to you or another data controller in a structured, commonly used and machine-readable format, where technically feasible.
7. Right to object / prevent processing – to object to certain types of processing, including direct marketing and, in some cases, processing based on our legitimate interests.
8. Right not to be subject to automated decision-making – to request that important decisions about you are not made solely by automated means.

We will respond to access, rectification and most other requests within 30 days, and to certain “prevent processing” / restriction requests within 21 days, in line with the Act.

How to exercise your rights
You can exercise your rights by contacting us in writing or by email using the details in Section 18. We may need to ask you for information to confirm your identity and help us locate your data.

14. Children’s Data

Some of our programmes and activities focus on children and young people. Where we collect personal data relating to a child, we will:
• Obtain consent from a parent or legal guardian where required by law
• Take extra care to protect children’s privacy and best interests
• Limit the data collected to what is necessary for the relevant programme or activity

15. Links to Other Websites

Our website may contain links to third-party websites, social media platforms or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any external sites you visit.

16. Changes to This Privacy Notice

We may update this Notice from time to time, for example to reflect:
• Changes in our activities or programmes
• Updates in the Jamaica Data Protection Act or guidance from the Office of the Information Commissioner (OIC)

When we make significant changes, we will update the “Effective date” at the top of this Notice and, where appropriate, notify you through our website or by email.

17. How to Contact Us

If you have any questions, concerns or requests about this Privacy Notice or how we process your personal data, please contact:

Data Protection Contact / Officer
Hummingbird Charities Inc.
Guanaboa Vale Kitson Town P.A St Catherine
Tel: [867 7875343
Email: info@hummingbirdcharitiesjm.com

18. How to Contact the Office of the Information Commissioner

You also have the right to lodge a complaint with the Office of the Information Commissioner (OIC) if you believe we have not handled your personal data in accordance with the law.  You can find contact details and further information on the OIC’s website.