This notice explains how PaxPilot processes personal data in the course of providing its service, with particular attention to Jamaica’s Data Protection Act (the JDPA), given PaxPilot’s Jamaica launch market, alongside the wider Caribbean region.
For guest conversation data handled on behalf of a customer, that customer is generally the data controller and PaxPilot acts as a data processor, handling that data only as instructed by the customer and as needed to provide the service.
For information submitted directly to PaxPilot, such as a demo request or an AI Readiness Audit submission, PaxPilot acts as the data controller.
Processing is generally carried out to perform a contract with the business (or, for the business’s own guests, at that business’s direction), for PaxPilot’s legitimate interests in operating and improving the service, or with consent where required. The specific legal basis for each category of processing will be finalized with legal counsel.
PaxPilot may process data using service providers located outside Jamaica, including cloud infrastructure and communications platforms. Appropriate safeguards for any such transfer will be confirmed with legal counsel and reflected here.
Individuals in Jamaica have rights under the Data Protection Act, which may include the right to be informed about how personal data is processed, to access personal data held about them, to request correction of inaccurate data, and to lodge a concern with the Office of the Information Commissioner. Full rights language will be confirmed with legal counsel.
Data is encrypted in transit and at rest, access is limited and logged, and every conversation and booking is recorded in an auditable trail.
PaxPilot relies on third-party providers for hosting, messaging (including Meta’s WhatsApp and Instagram platforms), voice and telephony, and payment processing. A current list of sub-processors will be maintained and made available on request.
Data is retained only as long as needed for the purposes described in this notice, or as agreed with the relevant customer. Specific retention periods will be finalized with legal counsel.
Questions about this notice, or a request to exercise a data protection right, can be sent to [email protected]. Individuals in Jamaica also have the right to contact the Office of the Information Commissioner directly.