Privacy Policy

How we protect your personal data under the Jamaica Data Protection Act, 2020

Last Updated: February 2026

At Balcostics Law, we are committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, and safeguard your information in compliance with the Jamaica Data Protection Act, 2020 (JDPA).

1. Data Controller and Contact Information

Balcostics Law is the "Data Controller" for the personal information processed through https://balcosticslaw.com/. Address: Unit 10, 7-9 Villa Road, Mandeville, Manchester, Jamaica Email: law@balcostics.com Data Protection Officer (DPO): In accordance with the JDPA, we have appointed a DPO to oversee our data privacy strategy.

2. Information We Collect

We collect personal data that is adequate, relevant, and limited to what is necessary for our legal services. This includes: Identity Data: Name, date of birth, Taxpayer Registration Number (TRN), and government-issued ID. Contact Data: Email address, telephone numbers, and physical address. Legal Matter Data: Information related to your case, including real estate titles, marriage certificates, wills, and employment records. Sensitive Personal Data: Where necessary for litigation or probate (e.g., health records for personal injury claims), we process this only with your explicit written consent.

3. Purpose and Legal Basis for Processing

We process your data under the following legal bases: Contractual Necessity: To perform the legal services you have retained us for. Legal Obligation: To comply with Jamaican laws (e.g., Anti-Money Laundering/Proceeds of Crime Act). Consent: For specific activities like sending newsletters or processing sensitive data.

4. Data Retention

We do not keep personal data longer than is necessary. Typically: Active Files: Retained for the duration of the legal matter. Closed Files: Retained for 7 years to comply with professional indemnity and regulatory requirements, after which they are securely destroyed or anonymized.

5. Your Rights as a Data Subject

Under the JDPA, you have specific rights regarding your data: Right to Access: You can request a copy of the personal data we hold about you (Form 2 as prescribed by the OIC). Right to Rectification: You may ask us to correct inaccurate or incomplete information. Right to Erasure: You may request the deletion of your data when it is no longer needed for legal or contractual obligations. Right to Object: You can object to your data being used for direct marketing. To exercise these rights, please contact our DPO. We will respond within 30 days.

6. Security Measures

We implement robust technical and organizational measures to protect your data against unauthorized access, including: Encrypted, off-site backups of our database and client documents, access controls on our systems, and secure physical storage for paper records.

7. Third-Party Disclosures

We may share your data with: Regulatory Bodies: Such as the National Land Agency (NLA) or the Supreme Court of Jamaica. Expert Witnesses: Only when essential to your case. International Transfers: If your data is transferred outside Jamaica, we ensure the recipient country provides an adequate level of protection as required by the JDPA.

8. Cookies, Tracking, and Third-Party Services

Our website uses cookies to improve user experience. You can manage your cookie preferences through your browser settings. Google reCAPTCHA v3: We use Google reCAPTCHA to protect our forms from spam and abuse. reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. Your use of reCAPTCHA is subject to Google's Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms). Google Maps: Our contact page includes an embedded Google Maps widget to display our office location. Google may collect data about your interaction with the map, including your IP address and browsing activity. This is governed by Google's Privacy Policy. Authentication Cookies: When you log in to the Client Portal, we store a signed session cookie (HttpOnly, Secure, SameSite=Strict) that expires after 24 hours. This cookie is essential for maintaining your authenticated session and cannot be used for tracking.

9. Changes to This Policy

We may update this policy to reflect changes in our practices or the law. Significant changes will be notified via our website.

Questions about your data or this policy?

Contact Our DPO