1. About this notice
This Privacy Policy explains how Tek a Hike Limited ("we", "us") collects, uses, shares, and protects personal data when you use our Platform at tekahike.com, partners.tekahike.com, and related services.
We comply with the Jamaica Data Protection Act, 2020 ("JDPA"). Tek a Hike Limited is the Data Controller for all personal data processed through the Platform — including hiker accounts, partner accounts, event registrations, and waivers. We determine the purposes and means of that processing (the registration schema, the waiver content, the security safeguards, the retention periods, and the data-subject rights workflow). Partners that deliver experiences receive a limited recipient view of participants who book their events, governed by our Data Sharing & Processing Annex; they are not joint or independent controllers for that data unless they re-collect it outside the Platform.
We are working with Jamaican counsel on registration with the Office of the Information Commissioner under JDPA s.19 and will publish our registration number here as soon as it is issued.
2. What we collect
- Account data — name, email, phone, password hash, role, verification status, profile photo.
- Booking data — events you book, dates, parties, special requirements, waiver acceptance.
- Payment data — billing name, last 4 digits and brand of card, transaction IDs. Full card numbers are handled by our PCI-DSS compliant payment partners (Stripe, Scotiabank), not by us.
- Communications — messages you exchange with us or with partners, support tickets.
- Device and usage data — IP address, browser, device type, pages visited, referrers, approximate location, crash logs.
- Location data — only when you grant permission, for example to find nearby trails.
- Cookies and similar technologies — see our Cookie Policy.
3. Why we use your data and our lawful basis (JDPA)
| Purpose | Lawful basis under JDPA |
|---|---|
| Create and manage your account | Performance of contract |
| Process bookings, payments, and refunds | Performance of contract |
| Send transactional emails (confirmations, receipts, weather, safety) | Performance of contract / Legitimate interests |
| Detect fraud, abuse, and protect users | Legitimate interests / Legal obligation |
| Verify partner businesses and guides | Legal obligation / Legitimate interests |
| Improve the Platform and develop new features | Legitimate interests |
| Send marketing newsletters | Consent (you can withdraw at any time) |
| Comply with tax, AML, and other legal obligations | Legal obligation |
4. Who we share data with
- Partners (operators) you book with, so they can deliver the experience.
- Service providers acting on our written instructions, including hosting, email delivery, SMS (Twilio), and customer support. We do not engage any third-party analytics, advertising, or profiling provider, and we do not share hiker, partner, or participant personal data with any analytics network or data broker — see our Cookie Policy for details.
- Payment processors (Stripe, Scotiabank) for payment authorisation and settlement.
- Authorities and legal advisers where we are legally required to disclose, or to protect our rights.
- Successors in a merger, acquisition, or restructuring — under equivalent confidentiality terms.
We do not sell your personal data.
5. International transfers
Some of our service providers process data outside Jamaica (for example, the United States or the European Union). Where this happens, we put in place appropriate safeguards as required by the JDPA, such as approved standard contractual clauses or processors operating under equivalent data-protection regimes.
6. How long we keep your data
| Data category | Retention |
|---|---|
| Active account data | While your account is open |
| Booking and waiver records | 7 years after the booking date (legal/insurance) |
| Payment records | 7 years (tax and AML) |
| Marketing preferences | Until you unsubscribe + 30 days |
| Server logs | 90 days |
When a retention period expires, we delete or anonymise the data.
7. Your rights under the JDPA
You have the right to:
- Access — get a copy of the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erase your data (subject to legal retention obligations) — usually within 30 days.
- Restrict or object to certain processing.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent for any consent-based processing at any time.
- Lodge a complaint with the Office of the Information Commissioner of Jamaica.
To exercise any of these rights, sign in and visit My data in your account, or email hello@tekahike.com. We respond within 30 days.
8. Security
We use industry-standard safeguards including TLS 1.2+ encryption in transit, encryption at rest for sensitive fields, role-based access control, audit logging, secure software development practices, and regular vulnerability scanning. No system is 100% secure, but we work hard to keep yours as safe as possible.
9. Data breaches
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Information Commissioner and affected users within 72 hours of becoming aware, in line with the JDPA.
10. Children
The Platform is not intended for children under 13. Bookings for minors must be made by a parent or legal guardian, who is responsible for any data they provide.
11. Changes to this policy
We may update this policy. The current version is always available at /legal/privacy. Material changes will be highlighted at sign-in or by email at least 14 days before they take effect.
12. Contact our Data Protection Officer
Tek a Hike Limited — Data Protection Office Kingston, Jamaica Email: hello@tekahike.com