Data Protection Policy & Privacy Notice

This policy states how Alliance Network X Limited protects personal data in the Advisory Hub and meets its duties as a data controller under the Jamaica Data Protection Act, 2020. It binds every member of staff and every contractor who processes personal data on ANX’s behalf.

We process personal data in accordance with the eight data protection standards in Part IV of the Act. In practice this means we:

• process personal data fairly and lawfully, and only where a condition in s.23 (and, for sensitive personal data, s.24) is met;
• collect personal data only for specified and lawful purposes and do not use it in ways incompatible with those purposes;
• collect only what is adequate, relevant and limited to what is necessary;
• keep personal data accurate and up to date;
• keep personal data no longer than necessary and dispose of it in accordance with our retention schedule and the Disposal Regulations;
• process personal data in accordance with data subjects’ rights;
• protect personal data with appropriate technical and organisational measures; and
• transfer personal data outside Jamaica only on a basis permitted by s.31.

We identify a lawful basis before we process personal data, and we record it in our record of processing activities. Our bases are, by activity:

• Contract necessity (s.23(1)(b)) for the core service: creating and securing accounts, delivering learning content, running the business-planning tools, advisory review, the verified-progress record, and paid subscriptions.
• Legitimate interests (s.23(1)(f)), supported by a written legitimate-interest assessment, for security logging, internal signup notifications, and platform administration.
• Consent (s.23(1)(a)) for optional features such as the reflection journal and the waitlist, and for any future marketing, which is consent-only under s.10.
• Written consent (s.24(1)(a)), or another s.24 condition, for any sensitive personal data introduced by a future identity or business verification workflow, which is not processed until those conditions are met.

Consent is not the basis for the core service, so withdrawing a consent does not end your access to a service you have contracted for.

The Advisory Hub stores and processes personal data outside Jamaica: in Canada (the database and file store) and the United States (application hosting and email). Each transfer is made in reliance on the contract-necessity ground and, where a data subject has been informed and agrees, consent, and is disclosed in the notice below. We name the destination States in our registration particulars with the Office of the Information Commissioner.

The CEO is accountable for data protection. The data protection officer monitors compliance independently and reports to senior management. The platform lead owns technical measures and access control; the content and experience lead owns notices, communications and data-subject intake.

We report personal-data breaches to the Office of the Information Commissioner and to affected data subjects within 72 hours. We answer data-subject requests within the statutory time limits the Act sets. Every member of staff who handles personal data completes data protection training and acknowledges this policy.

This policy is reviewed at least annually, and whenever the architecture, the vendors or the law changes materially.

Alliance Network X Limited operates the Advisory Hub. We are the data controller for your information and we are registered as a data controller with the Office of the Information Commissioner. You can contact our data protection officer at the address in the “Contact us” section.

When you join and use the Advisory Hub we collect: your account details (name, email and a secured password); your business profile (business name, stage, sector, parish and a short description); your learning progress; the business-planning work you create in our tools; the milestones and documents you add; and, if you subscribe, your subscription details.

We collect this to give you access to the Hub, to deliver the learning and planning tools, to let an ANX advisor review your progress and produce a verified progress record, and to operate any paid subscription.

We process most of your information because it is necessary to provide the service you have signed up for. We rely on our legitimate interests to keep the platform secure and to administer it, and on your consent for optional features such as the reflection journal. We do not send marketing without your consent.

The Advisory Hub does not collect identity documents, your Taxpayer Registration Number or bank details, and it gives investors no access to your information. If you subscribe, your card details are handled by our payment provider and are never held by us. If we introduce identity or business verification in future, we will tell you in advance, explain what we collect and why, and ask for your consent where the law requires it.

We use trusted service providers to run the Hub. Your information is stored in Canada (our database and file store, provided by Supabase) and processed in the United States (application hosting by Vercel, email delivery by Resend, and subscription payments by PayPal). These are transfers outside Jamaica. We make them because they are necessary to provide the service, we require our providers to protect your information, and we disclose them here so that your agreement is informed.

Your information is sent over an encrypted connection, and your files are held in private storage that is not publicly reachable. Where page-level analytics are enabled, we use Plausible, a cookie-free tool that does not track you individually across other sites.

Only you and ANX advisory staff reviewing your progress can see your Hub information. Your private reflection journal is visible to you alone. We do not sell your information and we do not share it except with the service providers who run the Hub on our instructions.

We keep your account information for as long as your account is open and for a defined period after it closes, and we keep other categories for the periods set out in our retention schedule. When a period ends we dispose of the information securely. The schedule is available on request.

You may ask us to confirm what personal data we hold about you and to give you a copy; to correct anything inaccurate; to stop processing that causes you substantial and unwarranted damage or distress; and, where the law allows, to erase your information. You may withdraw a consent you have given at any time.

To exercise a right, contact us using the details below. We respond within the time limits the Act sets, normally thirty days for an access request. If you are not satisfied, you may complain to us and then to the Office of the Information Commissioner.

We may update this policy from time to time. When we do, we revise the version and date shown at the top of this page. Where a change materially affects how we handle your information, we will also tell you directly — through a notice in the Advisory Hub or a message to the email address on your account. We encourage you to look over this page from time to time, so that you stay informed about how we handle your information and the choices open to you.

Write to the ANX data protection officer at admin@alliancenetworkx.com. If you have a complaint you may also contact the Office of the Information Commissioner.