Who We Are

Fraser Fontaine & Kong Limited (FFK) provides insurance brokerage, risk management, employee benefits, and related services to clients. FFK values your trust in us and is committed to protecting your privacy and the confidentiality of your personal information.

About this Privacy Notice

This document explains who we are, what personal data we collect, why, how and where we use it, who we may share it with and for how long we keep it. It explains your rights over your personal data under The Jamaica Data Protection Act, 2020. In here, you can find the addresses for FFK and the contact details for our Data Protection Officer. This notice applies to all processing by FFK within Jamaica for all purposes other than employment by FFK. This privacy notice was last updated on 2ndAugust 2024. It is updated frequently. If you are an active customer of FFK and we hold an email address for you, we will email you to notify you of significant updates, but you should always check this website page to ensure you are referring to the current version.

Definition of Personal Data and Sensitive Personal Data

Personal data is any information about you that is held in a way that allows you to be identified. We treat all personal data with great care and with a commitment to confidentiality. Data protection and privacy laws categorise some personal data as “sensitive.” This places additional duties on us to protect it with a greater degree of care and show that we are processing it for the right reasons. Here at FFK we treat your health records, financial information and other highly personal data with the utmost sensitivity and confidentiality and, of course, in full compliance with the law.

Your Rights

Your personal data belongs to you. We use it to provide products and services to you, to obey the law and to improve our services. Whatever your relationship with us, you are entitled to the following rights over your data:

“Transparency”

You have the right to a detailed explanation of what data we have about you, how and where we use it, how long we keep it and with whom it is shared. That information is contained in the details of our data processing below.

“Access”

You have the right to a copy of the data we hold about you. We will not charge you for providing this information in electronic form; we may charge for providing it on paper to reflect the costs and environmental impact of doing so. We may ask you to prove your identity before we release your data to you. If you want the data for a specific reason, you can help us by letting us know. Please be aware that no-one can force you to get a copy of your data, a and no-one should ask you to share it with them.

“Correction”

You have the right to have your data corrected. If you believe we have incomplete, outdated or incorrect information about you, please let us know. We may ask you to provide your identity and to provide evidence supporting the changes you would like made.

“Erasure “

You have the right to have your data erased if we no longer need it. Note that in many cases we need to retain data about you in order to honour our obligations to you, because we are required to by law, or to protect your interests, as well as ours .

“Review of Automated Decision Making”

You have the right to a human review of decisions we have made about you by purely automated means. Please note that almost all of our decision-making is already reviewed by a person – we use automation to support our team members.

“Objection to processing on the basis of legitimate interest”

You have the right to object to processing of your data where we use it to help us improve our services and develop our business. Technically, this is known as processing on the basis of our legitimate interests and there is more information about this processing in the privacy notice. We are required to carefully consider and respond to your objection and show that we have taken care to protect you when doing such processing; you may also require that we do not process your data while we are considering your objection.

“Restriction of Processing”

You have the right, in certain other circumstances, to require us to stop processing your data. These circumstances are:

• Where we disagree about the accuracy of the information we hold about you and while we are verifying that information.
• Where we no longer require personal data that we hold about you and would normally erase it, but you wish us to retain it without otherwise processing it, for instance where you believe that you may need the information for your own purposes in a legal claim.
• You believe that the processing of your data may cause you substantial harm or distress and that our processing is not justified in accordance with the law.

“Direct Marketing”

You have the right to opt-out of direct marketing. Note that if you do not specify which marketing you no longer wish to receive, we will stop sending you all marketing information. You will need to tell us the email addresses, phone numbers and other relevant details, and you will understand that we will need to keep these details so that we can be sure not to add you back to marketing lists in error. You also, of course, have the right to opt back into marketing at any time.

“Data Portability”

In some circumstances, you have the right to ask us to transfer your data to another service provider directly. This can only be done where it is technically possible both for us and for the other service provider; we and they will let you know when this is not possible.

“Withdrawal of Consent”

Most of our processing of your data is performed for one of three reasons:

• in service of a contract between you and us, or in order to enter into such a contract;
• to comply with legal obligations placed on us by the government and our regulators; or
• to help us improve our services by better understanding our customers and their needs.

However, in some cases we will ask you for your consent to processing. Where we have done so, you have the right to withdraw your consent at any time and we will stop processing. We will explain the consequences of withdrawing consent at the time we ask for it and when you ask to withdraw it. If you would like to know more about our processing of your data or would like to exercise any of Your Rights, you can email us at dpo@securys.com.jm. You can also write to us at Data Protection Officer 28 Pawsey Place Kingston 5 Tel: +1 (876)926-1140

Data protection law

The data protection law in Jamaica is the Data Protection Act of 2020. This act defines sensitive personal data as information on a person’s:

• Genetic or biometric data;
• Filiation, racial or ethnic origin;
• Political opinions, philosophical beliefs;
• Religious beliefs or other beliefs of a similar nature;
• Membership in any trade union;
• Physical, mental health or condition;
• Sex life;
• The alleged commission of any offence by the data subject or any proceedings for any offence alleged to have been committed by the data subject.

Jamaica does not include financial records in the definition of sensitive data but we at FFK will continue to treat your financial information in the strictest confidence and share it internally and externally only as needed to meet our contractual and service obligations to you and to comply with the law. Under the Data Protection Act, you have the following additional rights:

• You have the right to prevent decisions being made about you by solely automated means. However, some kinds of decision can be exempted from this right by ministerial order.
• The protection of your personal data continues for 30 years following your death. This means that your estate can continue to exercise your rights and we will continue to protect your data during that time.
• If you seek to exercise your right to correction of your personal data and we are unable to confirm your revised information, you may require us to retain a record of your version of the data alongside ours.

If you are not satisfied with FFK’s response to any enquiry or complaint you make to us, you have the right to lodge a formal complaint with the Office of the Information Commissioner of Jamaica, whose contact details are as follows: Office of the Information Commissioner The Masonic Building (2nd Floor) 45-47 Barbados Avenue Kingston 5 Jamaica Tel: +1 (876) 920-4390 Email: info@oic.gov.jm

Laws requiring the processing of personal data

The list below is constantly under review and will be updated as the law changes and as we identify processing which we are legally obliged to conduct. If you would like more information about our processing on the basis of legal obligation, please contact dpo@securys.com.jm with your query.

Category	Legislation	Regulator
Insurance regulation	Insurance Act 2001	Financial Services Commission
Banking regulation	Banking Services Act 2014	Bank of Jamaica
Health and Safety	Occupational Safety and Health Act 2017	Ministry of Labour and Social Security
Anti Money Laundering (“AML”)	Proceeds of Crime Act 2019	Bank of Jamaica
Anti Money Laundering (“AML”)	Companies (Amendment) Act 2023	Registrar of Companies
Data protection	Data Protection Act of 2020	Office of the Information Commissioner
Pensions	Pensions (Superannuation Funds and Retirement Schemes) Act	Financial Services Commission
Employment law	The Employment (Equal Pay for Men and Women) Act of 1975 The Trade Union Act of 1919 The Labour Relations and Industrial Disputes Act (LRIDA) of 1975 The Labour Relations Code The Employment (Termination and Redundancy Payment) Act of 1974 The Holiday with Pay Act of 1974 The Minimum Wage Act of 1938 The Maternity Leave Act of 1979	Ministry of Labour and Social Security

Details of our Data Processing

Types and sources of information that we may collect

The information that we collect and process varies depending on the context. Each section below lists the categories of information that we may collect for the purposes listed. To understand which categories we collect and process about you, please refer to the details of processing for the specific products, services or circumstances that apply to you. The categories are as follows:

Category

Category	Examples of data collected
Biometric information	Digital representations of your fingerprints, used to identify you.
Browser data	Details provided by your computer or phone when using an app or internet browser including IP address and technical information about your device.
Call recordings	Audio and video recordings of inbound and outbound telephone and video conference calls
CCTV	Video recordings collected by cameras installed at our premises which may capture public areas surrounding our buildings as well as interior space.
Contact and demographic information	Your name, address, contact information such as telephone number, email address, social media details; your date of birth, marital status and gender. This also includes details of your family, dependents relations and beneficiaries. We will also collect your signature or other authorisation in various contexts.
Cookies	Small files placed on your computer or phone by us or third parties which are used to store information as part of delivering our website, app or services and to identify you during and between sessions.
Criminal records	Any record of a criminal offence of which you have been suspected, accused, tried or convicted.
Employment information	Your employment status, the name and details of your employer, your job title, remuneration and length of service, employer references, any unique identifying number or code provided by your employer.
Filiation information	Details of your familial relationships to other people.
Financial information	Your financial status, including credit score and references, assets and liabilities, income and outgoings; credit card and bank details for making and receiving payments; transactional information including claims, specific payments and receipts as well as ongoing payment obligations and receipt entitlements.
Government-issued identification	Identity card or driver’s licence details, passport details, tax or other unique identifying reference numbers.
Health information	Your health records, details of health conditions, test results and family medical history; we may also collect genetic data in this context.
Insurance information	Current and past policies held, claims and potential claims history including dates, nature of claim, amount, fault and details of any investigation undertaken.
Trades Union membership	Whether you are a member of a trade union, the name of that organisation and your position within it, if applicable.
Vehicle information	Vehicle make and model, value, ownership, method of purchase and amounts owing, insurance status, registration mark or number, VIN, authorised drivers.

The examples given above are not exhaustive list; please contact us if you would like a complete list of the data we may hold about you.

Processing under Legal Obligation

In many instances, we collect and process personal data because we are obliged by law. The laws that require this processing will vary by context. To simplify the detailed information below, we have listed the key relevant laws. The legal landscape is continually evolving and some processing will be required by more than one piece of legislation; the lists in this notice are not intended to be exhaustive.

Data Sharing

We will not share your information for the purposes of marketing without your prior consent. Like most modern companies, FFK uses a number of technology and service partners to enable our services and products. Because of the breadth and complexity of our services, it is not possible to provide a list of these partners in this notice; if you would like a list of the partners with whom your personal data is shared, please contact us. As a regulated financial services entity, we are required to share your personal data with our regulators and other government. If you would like a list of the government and regulatory parties with whom your data has been shared on this basis, please contact us. We may also share your data with other parties such as your employer, or with other financial services entities. Where this is envisaged, it is noted in the relevant section for the product or service. If you would like a list of the other parties with whom your data has been shared on this basis, please contact us.

Transfers of data to other countries

We transfer your personal data to other countries as required to enable the use of technology and service partners. We conduct careful due diligence on all data sharing partners and ensure that appropriate protections are in place to keep your personal data secure. These transfers are protected by binding agreements that include standard contractual clauses setting out the obligations of the sending and receiving parties and the safeguards, including specific technological measures, that must be applied. If you would like more information on our transfers and safeguards (including a list of the partners and countries) as they apply to you, please contact us.

Specifics of Processing

General Website Visitors

Purposes of processing

When you visit our website, we process your data for the following purposes, and under the following lawful bases:

• To deliver the website, manage and analyse traffic and protect us against digital risks.
  • Legitimate interest
• To place cookies on your device
  • Consent
• When you ask to find out more about us and our products
  • Consent
• When you contact us or book an appointment
  • Consent

The categories of personal data we collect and process

We currently collect the following categories of data when you use our website:

• Browser data
• Cookies
• Contact and demographic information if you ask for more information, contact us or book an appointment

Retention of data

We do not retain browser data and cookies from the website. The cookies will be deleted once you end your session by closing your browser. Personal data relating to requests for information and appointments will be retained for 90 Days following the date of collection or your last interaction with us, whichever is later.

Sharing your personal data with third parties

We share your data with our technology and service partners

CCTV

Purpose of processing

We operate recorded CCTV systems at our physical location. If you visit us, or come within the field of view of our cameras, we process your data for the following purposes, and under the following lawful bases:

• Prevention and detection of crime
  • Legitimate interest
• Health and safety
  • Legal obligation and legitimate interest

The categories of personal data we collect and process

We currently collect the following categories of data:

• CCTV footage

Retention of data

We will keep recordings which may include your personal data for a period of 6 months, unless an incident is suspected, in which case the recording may be required for further investigation.

Sharing your personal data with third parties

We share your data with the following third parties only if required to do so by law:

• Our technology and service partners
• Law enforcement, if required
• Our regulators, if required

Individual Insurance

Purpose of processing

In order to offer you, consider you for and provide you with insurance, we process your data for the following purposes, and under the following lawful bases:

• To facilitate an efficient and effective insurance process and customer service
  • Performance of a contract
• To ensure current and future clients’ insurance coverage is matched to their requirements
  • Legitimate interest (for marketing and product development), legal obligation and performance of a contract.
• To prepare and manage suitable insurance policies
  • Performance of a contract
• To identify and communicate with beneficiaries
  • Performance of a contract
• To manage claims against members’ policies
  • Performance of a contract,
• To make and receive payments
  • Performance of a contract
• To manage claims against clients’ policies
  • Performance of a contract
• To detect, prevent and investigate fraud
  • Legal obligation and our legitimate interest
• To assess and improve business performance
  • Legitimate interest
• To meet our “know-your-customer” (KYC) and anti-money-laundering (AML) obligations
  • Legal obligation
• To report to regulators
  • Legal obligation
• To provide online services
  • Performance of a contract, legitimate interest and consent for cookies
• For the purposes of direct marketing
  • Legitimate interest (selection and profiling) and consent (contact)

The categories of personal data we collect and process

• Contact and demographic information
• Government-issued identification
• Employment information
• Filiation information
• Financial information
• Health information
• Insurance information
• Criminal records

Retention of data

We will keep at least some of your personal data for a period of 7 years following the expiry of your policy or the closure of any claim, whichever is later. If for any reason we collect your data, but no policy is put in place for you, we will retain at least some of your data for 7 years from the date on which a final decision not to proceed was taken. We retain this data to comply with our regulatory obligations and to provide for legal claims; any data that is not needed for these purposes will be deleted immediately on termination of your policy or at the moment that a final decision not to proceed is taken.

Sharing your personal data with third parties

We share your data with the following third parties:

• Our technology and service partners
• Other insurers and reinsurers either directly or via an industry association
• Our regulators
• Health professionals and providers

Group Insurance via Your Employer

Purpose of processing

We, along with your employer, are joint data controllers for insurance benefits and administration. We process your data, which may be obtained from your employer as well as directly from you, for the following purposes and under the following lawful bases:

• To facilitate an efficient and effective insurance process and customer service
  • Performance of a contract
• To ensure current and future clients’ insurance coverage is matched to their requirements
  • Legitimate interest (for marketing and product development), legal obligation and performance of a contract.
• To prepare and manage suitable insurance policies
  • Performance of a contract
• To identify and communicate with beneficiaries
  • Performance of a contract
• To manage claims against members’ policies
  • Performance of a contract, and in rare cases the protection of vital interests of the data subject
• To identify and communicate with beneficiaries
  • Performance of a contract
• To make and receive payments
  • Performance of a contract
• To manage claims against members’ policies
  • Performance of a contract
• To detect, prevent and investigate fraud
  • Legal obligation and our legitimate interest
• To assess and improve business performance
  • Legitimate interest
• To meet our “know-your-customer” (KYC) and anti-money-laundering (AML) obligations
  • Legal obligation
• To report to regulators
  • Legal obligation
• To provide online services
  • Performance of a contract, legitimate interest and consent for cookies

The categories of personal data we collect and process

• Contact and demographic information  Government-issued identification
• Employment information
• Filiation information
• Financial information
• Health information
• Insurance information
• Call recordings

Retention of data

We will keep at least some of your personal data for a period of 7 years following the expiry of your policy or the closure of any claim, whichever is later. If for any reason we collect your data, but no policy has been put in place for you, we will retain at least some of your data for 7 years from the date on which a final decision not to proceed was taken. We retain this data to comply with our regulatory obligations and to provide for legal claims; any data that is not needed for these purposes will be deleted immediately on termination of your policy or at the moment that a final decision not to proceed is taken.

Sharing your personal data with third parties

We share your data with the following third parties:

• Our technology and service partners
• Your employer
• Other insurers either directly or via an industry association
• Our regulators
• Health professionals and providers

Job Applicants

Purposes of processing

If you apply for employment with FFK, we process your data for the following purposes, and under the following lawful bases:

• In order to assess suitability for a role with FFK
  • Performance of a contract
Due diligence, including Background checks
• Legal obligation
• To detect, prevent and investigate fraud
  • Legal obligation and our legitimate interest
• To report to regulators
  • Legal obligation
To provide online services
• Performance of a contract, legitimate interest and consent for cookies

The categories of personal data we collect and process

• Contact and demographic information
• Government-issued identification
• Employment information
• Financial information
• Health information
• Browser data (if online application)
• Cookies (if online application)

Retention of data

We will keep your personal data if you are a successful applicant in line with the Employee Privacy Notice retention period. If you are an unsuccessful applicant, we will retain some of your personal data for up to 7 years from the date of your last application.

Sharing your personal data with third parties

We share your data with the following third parties:

• Our technology and service partners
• Other financial institutions including stock exchanges, brokers and registrars either directly or via an association
• Our regulators