Data & Privacy | Phoros Pilots

Keep it confidential What you see inside the work stays inside the work.

Use approved tools Customer data stays inside the protected Phoros environment.

Ask or report early If anything feels uncertain or wrong, raise it immediately.

The short version

Why this page exists

This summer you will do two things Jamaican law takes seriously. One: you give us some of your own personal information, including banking details, so we can pay you. Two: you will work on real companies' systems and handle other people's personal information.

Jamaica's Data Protection Act, 2020 (in force since December 2023) sets the rules for collecting, using, storing, and sharing personal data, and it gives people real rights over their own. It is overseen by the Office of the Information Commissioner (OIC).

This page is a two-way promise: what the law expects of you when you handle other people's data, and what we promise about how we handle yours. Read it before orientation alongside the draft agreement you received by email, then bring any questions you or your parent or guardian want clarified.

The one idea: personal data is borrowed, never owned. You hold it in trust and protect it like it matters, because to the person it belongs to, it does.

What is expected of you

When you handle a client's or a company's data

These are legal duties, not house rules.

Some breaches are criminal. The standards below come straight from the law.

Use it only for the work, and only as allowed. Never out of curiosity. ss. 22, 25
Take only what you need. Do not copy, download, or screenshot more than the task needs. s. 26
Keep it confidential (the big one): never show, send, share, or discuss anyone's personal data outside the work. Disclosing personal data without authorization is a criminal offence. s. 61
Protect it the way we show you: use the passwords, the access controls, the encryption, the secure systems. The law names the people who have access. s. 30, s. 30(3)
Keep it accurate, and do not keep it forever. ss. 27, 28
Never move data out without permission. No personal email or device, and no sending it outside the protected environment. s. 31
If something goes wrong, tell us immediately. The law gives a 72-hour breach window, and there is no penalty for honestly reporting a mistake. s. 21(3)

One serious line, so you carry the real stakes.

A serious breach, meaning a knowing or reckless disclosure without permission, is a criminal offence: up to J$5 million or up to 5 years in the Parish Court, and up to 10 years in the Circuit Court. We state it plainly because you are now a professional. Follow the standards and you will never be near this line. s. 61(10)

How we protect your data

Your personal and banking information

You trust us with your details and your banking information. That makes us a data controller under the eight standards of the Act. Here is what we promise, with the law behind each.

We collect only what we need, for clear reasons: the program, and your stipend. ss. 22, 25, 26
We use it only for the program. We do not sell it, and we do not share it for marketing. s. 25, s. 10
We keep it secure: controlled storage, controlled access, and encryption where appropriate. s. 30
We keep it accurate, and we do not keep it longer than we need it. ss. 27, 28
If your data is ever breached, the law requires us to notify the regulator and you. We will. s. 21(3), (5)

And the law gives you rights over your own data:

The right to know about it and to see it, free of charge. s. 6
The right to give consent, and to withdraw it at any time. s. 9
The right to correct it. s. 13
The right to stop harmful use of it. s. 11
The right not to be judged by a machine alone. s. 12
The right to compensation if we break the rules and it harms you. s. 69