Partner Programme Privacy Policy

1. Who we are and scope

This Privacy Policy explains how Otuesday International Limited, 43 Eastwood Park Road, Kingston 10, Jamaica trading as Otuesday (“Otuesday”, “we”) collects, uses, discloses, secures and retains personal information in connection with applications for the Otuesday Partnership Programme, approved Partner accounts, authorised user logins, bookings and related communications.

The policy applies to individual applicants, business representatives, authorised users, partner contacts and, where information is processed through the platform, travellers. It does not replace any separate consumer-facing booking privacy notice or supplier privacy policy; those notices may also apply.

2. Data protection framework and responsibility

Otuesday intends to process personal data consistently with Jamaica’s Data Protection Act, 2020, including transparency, purpose limitation, data minimisation, accuracy, storage limitation, security, data subject rights and cross-border transfer requirements, and with other applicable laws in relevant jurisdictions.

Otuesday generally determines the purposes and means of processing applications, partner accounts, commission administration and platform security and is a data controller for those activities. An independent Partner may also be a separate controller of traveller information it collects for its own business. Where Otuesday acts on a Partner’s documented instructions, or where parties jointly determine purposes, the appropriate roles and obligations must be documented separately. A Partner must provide its own legally required notices and obtain valid permissions.

3. Categories of information we may collect

• Identity and eligibility: full name, date of birth or age confirmation where needed, identity documents where proportionate, country of residence, nationality where legally necessary and professional credentials.
• Business and application: agency/trading name, business registration number, registered address, beneficial ownership and authorised representative details, applicant category, tier preference, IATA status/number if applicable, business activities and branch details.
• Contact and login: email, mobile number with full international dialling code, office telephone, postal address, username, encrypted password credentials, authentication and account recovery information.
• Commercial and financial: selected tier, included/additional users, billing records, invoices, payment status, limited payment references, bank/payout details, commissions, refunds, chargebacks and transaction identifiers.
• Booking and traveller data: names, itineraries, passenger details, dates of travel, contact details, booking references, relevant special requests and identity/travel-document information only where required by a supplier or law.
• Communications and compliance: support requests, complaints, verification documents, fraud alerts, customer authorisations, training acknowledgements and records of accepted legal terms.
• Technical information: IP address, device/browser type, access logs, security events, cookie identifiers, account activity and approximate location derived from technical signals where applicable.

4. Sources of personal information

Information may come directly from applicants, Partners, authorised users and travellers; from approved business representatives; from travel suppliers, payment processors and booking intermediaries; from publicly available business registries or permitted verification providers; and automatically through the platform’s security, analytics and cookie systems.

We will not request more sensitive identity, health, biometric or financial information than is necessary for a clearly disclosed booking, verification or legal purpose. Payment card data should be processed by approved payment service providers rather than stored in ordinary Partner account records.

5. Why we use information and our legal basis

• Application and verification: assess eligibility, verify authority and identity, evaluate tier suitability and approve or decline applications (steps requested by the applicant, legitimate business needs and/or legal obligations as applicable).
• Account delivery: create accounts, manage user permissions, support logins, provide tools and communicate operational changes (contractual necessity and security interests).
• Bookings and customer support: transmit required traveller information to relevant suppliers, issue confirmations and manage amendments, cancellations and complaints (contract performance and legal obligations, where applicable).
• Billing and commission payments: calculate fees and eligible commission shares, process invoices and payouts, manage disputes and maintain financial records (contractual and legal obligations).
• Safety, fraud and compliance: detect abuse, investigate suspicious activity, protect systems, respond to lawful requests and maintain audit records (legal obligations and legitimate interests where permitted).
• Service improvement: monitor platform performance, resolve defects and use aggregated/de-identified analytics where practicable (legitimate interests or consent where required).
• Optional marketing: send promotional email, SMS or WhatsApp messages only on a lawful basis and with consent where required; users can withdraw or opt out without losing necessary service communications.

Where consent is used, it must be informed, specific, freely given and capable of withdrawal. Acceptance of mandatory programme documents must not be bundled with consent to unrelated marketing. If consent is withdrawn, processing already carried out lawfully remains valid, and some information may still need to be retained under contract or law.

6. Sharing and recipients

We may disclose the minimum necessary data to travel suppliers (including airlines, hotels, tour operators and reservation systems), hosting and IT providers, identity/verification services, payment and payout processors, authorised support contractors, professional advisers, insurers where relevant, auditors and competent regulators or law enforcement where legally required.

An approved Partner may access only the traveller and account information necessary for its authorised role. We do not authorise Partners to sell traveller data, scrape platform records or share information for unrelated marketing. Service providers must be subject to suitable confidentiality, security and data-processing obligations.

If business ownership or service arrangements change, information may be transferred as legally permitted with appropriate safeguards and notice.

7. International processing and transfers

Travel booking inherently involves international data flows: traveller information may be sent to airlines, hotels, reservation systems or providers in the destination, transit or supplier country, and some cloud systems may operate outside Jamaica.

Before transferring personal data internationally, Otuesday must assess applicable Jamaica Data Protection Act transfer restrictions and rely on a legally permitted transfer basis and appropriate safeguards. Where required, the transfer destination, recipient categories and relevant risks or safeguards should be explained to the affected person. Partner agreements must address onward transfers and supplier/processor controls.

8. Security and access management

We use proportionate administrative, technical and physical safeguards, which may include encrypted connections, password hashing, role-based access, logging, backups, supplier due diligence, staff training, access reviews and incident-response procedures. No internet service is entirely risk-free.

Each Partner must assign named logins, avoid shared credentials, remove access promptly when personnel leave, secure devices and notify Otuesday immediately of suspected account compromise or unauthorised disclosure at Tech@Otuesday.com.

Otuesday will investigate reportable incidents and notify the Information Commissioner and affected individuals as required by applicable law. Jamaica’s regulator identifies a 72-hour reporting obligation for specified personal-data breaches/contraventions; incident escalation must therefore occur without delay.

9. Retention and deletion

Personal information is retained only as long as necessary for services, accounting, regulatory compliance, fraud prevention and legitimate dispute handling. Otuesday applies the retention schedule below, subject to longer retention where required by law, an ongoing investigation, litigation hold or outstanding booking or refund.

Record category	Retention period
Unsuccessful/incomplete applications	12 months after final decision or withdrawal, unless a lawful hold applies
Partner contract, financial and commission records	Partner agreements: partnership term plus 6 years; financial and commission records: 7 years after relevant transaction
Booking and traveller transaction records	6 years after completed travel or transaction, unless legal/supplier duties require longer
Routine support communications	24 months after closure unless linked to a dispute or continuing obligation
Routine security and access logs	12 months unless needed for a security incident, audit or legal hold
Marketing preferences	Until withdrawal/opt-out; limited suppression and consent evidence retained as necessary

At the end of the applicable retention period, records are securely deleted or anonymised unless a continuing lawful retention obligation applies.

10. Your privacy rights

Subject to applicable law and exceptions, individuals may request information about our processing, access to their personal data, correction of inaccuracies, restriction or objection to certain processing, withdrawal of consent, erasure where applicable, data portability where applicable and human review of qualifying automated decisions.

Requests should be sent to Legal@Otuesday.com with sufficient information to verify identity without collecting unnecessary new data. We will acknowledge and respond within the period required by the applicable law, explain any lawful refusal and provide complaint/escalation information. Individuals may also contact Jamaica’s Office of the Information Commissioner at oic.gov.jm.

11. Cookies, analytics and communication preferences

The platform may use strictly necessary cookies for sessions, security and account operation, plus optional analytics or advertising cookies where implemented. A separate cookie notice or preference interface should list actual cookies, providers, purposes and lifetimes; optional cookies should be controlled by valid consent where required.

Service emails and booking alerts may be necessary to fulfil requests. Promotional messages are separate and should include a clear opt-out mechanism. WhatsApp and SMS use must respect applicable messaging laws, carrier requirements and provider policies. International phone numbers must be stored with the correct country code to support accurate routing.

12. Children, automated decisions and external links

The Programme is intended for applicants aged 18 or older. Travellers may include minors whose details are necessary for legitimate bookings; the responsible adult or authorised agent must provide the required authority and notices. Partners must not create independent minor Partner accounts.

Automated checks may flag duplicate accounts, suspicious activity or missing documents. Where an automated decision has significant effects and applicable law provides a review right, a human review channel will be available. External suppliers and linked websites maintain their own privacy practices; their policies should be reviewed.

13. Changes, complaints and contact

Material changes to this policy will be posted with an updated effective date and communicated where required. Changes will not retrospectively justify an unrelated new use of personal data without an appropriate lawful basis.

Otuesday will formally assess and comply with any statutory requirement to designate or register a data protection officer. Individuals may also complain to Jamaica’s Office of the Information Commissioner.