Privacy Policy
Last updated: 21 October 2026
This policy explains how SkillVantage Enterprise collects, uses, protects, and shares personal data through the Island Retail Point of Service (POS) System, in line with the Data Protection Act, 2020 of Jamaica and the data protection standards it sets out. Card payments are handled by licensed payment providers. Island Retail does not store full card numbers or security codes.
1. Who we are and our role
Island Retail is a point of service, inventory, timekeeping, and accounting system provided by SkillVantage Enterprise ("SkillVantage", "we", "us") to businesses operating in Jamaica, such as cafes, restaurants, markets, and haberdasheries ("the Business").
- When a Business uses Island Retail to record its sales, customers, staff, and accounts, the Business is the data controller for that information and SkillVantage acts as its data processor, processing personal data only on the Business's documented instructions.
- For account holders and visitors to this website, SkillVantage is the data controller for the account, sign-in, and support information we collect directly.
If you are a customer or employee of a Business that uses Island Retail, please contact that Business first about your personal data. We will support the Business in responding to you.
2. Personal data we collect
| Who | Data |
|---|---|
| Account holders (owners, managers, staff) | Name, email address, phone number, job title, role and permissions, store and register assignments, sign-in history, device and IP information. |
| Employees (timekeeping and payroll) | Clock-in, break, and clock-out records; register sessions; timesheet corrections and approvals; pay rates; and, where the Business uses payroll features, Taxpayer Registration Number (TRN), National Insurance Scheme (NIS) number, bank account details for salary payment, and statutory deduction information. |
| Customers of the Business | Order and receipt details; name, phone number, or email if provided for receipts, orders, deliveries, or loyalty; limited card payment details (see section 3). Business customers who request a tax invoice may provide a business name, address, and TRN. |
| Suppliers | Contact names, phone numbers, email addresses, and purchasing records. |
| Website visitors | Basic technical information such as browser type, pages viewed, and the date and time of access. |
We do not intentionally collect sensitive personal data, such as health information, through Island Retail. Businesses must not record it unless the law allows it and it is necessary.
3. Card and payment information
Card payments made at a Business using Island Retail are authorised and settled by the Business's acquiring bank or licensed payment provider (for example, a Jamaican bank's merchant services). Payment service providers in Jamaica are subject to oversight by the Bank of Jamaica under the Payment Clearing and Settlement Act.
What Island Retail never stores: full card numbers (PAN), card security codes (CVV/CVC), PINs, or magnetic-stripe or chip data.
What Island Retail may store for receipts, refunds, reconciliation, and dispute handling:
- card brand (for example, Visa, Mastercard, or a local debit network) and the last four digits of the card;
- transaction amount, currency (JMD or USD), date, time, and register;
- authorisation code, terminal or transaction reference, and approval or decline status;
- refund, reversal, and chargeback references linked to the original sale.
Where card data passes through payment terminals or provider systems, it is handled under the Payment Card Industry Data Security Standard (PCI DSS) and the provider's own terms and privacy notice. Island Retail is designed to keep card data out of its own systems wherever possible. Cash and other payment records are kept as part of the Business's sales records.
4. How we use personal data
- To provide the service: processing sales, sending orders to the kitchen, issuing receipts and tax invoices, managing stock, and running reports.
- To manage accounts, roles, and permissions, and to verify sign-ins, including two-step verification for managers.
- To record attendance and prepare timesheets and payroll information for the Business.
- To reconcile card and cash takings against bank settlements.
- To help the Business meet its obligations, including General Consumption Tax (GCT) records and statutory payroll filings.
- To keep the service secure, prevent fraud, investigate misuse, and maintain audit records of corrections, refunds, and approvals.
- To provide support, send service notices, and improve Island Retail.
- To generate explanations through the Ask Island Retail assistant. These are based on the Business's own records and respect each user's permissions.
We do not sell personal data. We do not use a Business's customer or employee data for our own marketing.
5. Lawful basis for processing
Under the Data Protection Act, 2020, personal data is processed only where there is a lawful basis. For Island Retail, this is usually:
- performance of a contract, such as completing a sale, providing the service to the Business, or employment arrangements;
- compliance with a legal obligation, such as tax, GCT, payroll, and record-keeping requirements;
- legitimate interests, such as securing the service, preventing fraud, and keeping accurate business records, where those interests are not overridden by the individual's rights; and
- consent, where required, for example for optional marketing messages sent by a Business. Consent can be withdrawn at any time.
6. Who we share data with
- The Business and its authorised users, according to their role.
- Payment providers and acquiring banks, to authorise, settle, refund, and reconcile card payments.
- Service providers who host, secure, back up, or support Island Retail, under written agreements requiring confidentiality and appropriate security.
- Government and statutory bodies, when the Business files returns or the law requires it, including Tax Administration Jamaica (TAJ) for income tax, PAYE, and GCT, and the bodies that receive statutory payroll contributions, such as the National Insurance Scheme, the National Housing Trust, and HEART/NSTA Trust.
- Professional advisers, such as the Business's accountants and auditors, as instructed by the Business.
- Law enforcement, courts, or regulators, where we are legally required to disclose information, including under the Cybercrimes Act, 2015.
- A successor business, if all or part of SkillVantage or a Business is sold or restructured, subject to the same protections.
7. Storage and transfers outside Jamaica
Island Retail is a cloud service. Some data may be stored or processed on secure servers located outside Jamaica, and some support may be provided from outside Jamaica. Where personal data is transferred outside Jamaica, we take steps required by the Data Protection Act, 2020 to ensure an adequate level of protection, such as contractual safeguards with our providers, encryption, and access controls.
The current hosting locations will be listed here: [hosting provider and region to be confirmed].
8. How long we keep data
- Sales, GCT, payroll, and accounting records are kept for the periods required under Jamaican tax, payroll, and employment law, and as instructed by the Business.
- Timekeeping records are kept for as long as needed for payroll, employment, and legal purposes.
- Card transaction references are kept as long as needed for reconciliation, refunds, and disputes, and as required by payment provider rules.
- Account information is kept while the account is active and for a reasonable period afterwards for security and legal purposes.
When data is no longer needed, it is securely deleted or anonymised. When a Business ends its subscription, it may export its data before deletion, as set out in the Terms & Conditions.
9. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, individual user accounts, role-based permissions, two-step verification for managers, audit logs of sensitive actions, device revocation, encrypted backups, and tested recovery procedures. Access by SkillVantage staff is limited to what is needed to provide and support the service.
No system is completely secure. Account holders are responsible for keeping their sign-in details confidential and for telling the Business or SkillVantage promptly if they suspect misuse.
10. Your rights
Under the Data Protection Act, 2020, you have the right to:
- be told whether your personal data is being processed and receive a copy of it;
- have inaccurate or incomplete data corrected;
- ask for processing to stop or be limited where it causes, or is likely to cause, unwarranted damage or distress;
- object to direct marketing at any time;
- ask for data to be erased where there is no longer a lawful reason to keep it;
- not be subject to a decision based solely on automated processing that significantly affects you, and to ask for such a decision to be reconsidered; and
- complain to the Information Commissioner.
Customers and employees of a Business should send requests to that Business, as the data controller. Account holders may contact us directly (section 15). We may need to verify your identity before acting on a request and will respond within the time required by the Act.
11. Data breaches
If a security breach affects personal data, we will notify the affected Business without undue delay. The Business and, where applicable, SkillVantage will notify the Office of the Information Commissioner and affected individuals within the timeframes required by the Data Protection Act, 2020.
12. Children
Island Retail is a business system and is not directed at children. Where a Business employs young persons, it is responsible for complying with applicable Jamaican employment and child protection laws when recording their information.
13. Cookies and local storage
Island Retail uses essential browser storage to keep you signed in, remember your selected store, and keep the system working, including when offline. We do not use advertising cookies. Disabling essential storage may stop the system from working correctly.
14. Changes to this policy
We may update this policy to reflect changes in the law, the service, or our practices. We will post the updated policy here with a new "Last updated" date and, for significant changes, notify account holders.
15. Contact and complaints
SkillVantage Enterprise · Privacy enquiries: [privacy contact email] · [mailing address]
Data Protection Officer: [name and contact, if appointed]
If you are not satisfied with our response, you may complain to the Office of the Information Commissioner of Jamaica.