Privacy Notice

Last updated TODO-LEGAL (date of publication)

DRAFT, needs lawyer review. This text was prepared from what the platform does in code and has not been reviewed by a lawyer. Items marked TODO-LEGAL are still to be completed. Do not rely on it until it has been reviewed and published.

This notice has two parts. Part A covers the JW Excel Academy (the training platform for participants, clients and facilitators). Part B covers the JWBS Control Center, the internal bookkeeping system used by our staff.

Part A. JW Excel Academy

Who is responsible

TODO-LEGAL: full legal name of the company that decides how personal data is used (the "controller"), registered address, company registration number, and the name and contact details of any data protection officer. Until completed, contact JW Business Solution at contact@jwbsja.com.

What we collect

• Account and enrolment details. Name, work email, job title, department, employer or client organisation, cohort and role. These come from your employer or from you when you are invited.
• Sign-in and device data. Your email and one-time sign-in codes, the time of each sign-in, your IP address, browser and device type. We keep a record of sessions and activity inside the platform (pages used, assignments opened, check-ins) to run the course and show progress.
• Your coursework. Excel workbooks you upload, scores and facilitator feedback, quiz and poll answers, questions you ask, discussion posts, hand raises, points and badges, certificates, and your attendance.
• Assessments and evaluations. Pre-course and post-course assessment answers and results, and course feedback or evaluation forms. The public evaluation link can be answered without signing in.
• Live sessions. When you join a live video session your audio, your video if you turn it on, anything you share on screen and in-session chat are processed. Sessions may be recorded to the cloud and recordings may be made available to participants (see Recording below).
• Messages and requests. What you send through the contact form (name, email, message) and any data removal request, including any file attached to it.
• Analytics (only if you accept). Pages visited, clicks and screen recordings of your use of the academy, with typed text masked. See Analytics below.
• Cookies and similar storage. Sign-in session cookies that keep you signed in, a short-lived session tracking cookie, and a record of your analytics choice. We do not use advertising cookies.

Why we use it

• To provide the training you or your employer enrolled in: account access, assignments, grading, certificates, attendance and progress reports to facilitators and, where your employer sponsors the course, to your employer. TODO-LEGAL: confirm exactly what is reported to the sponsoring employer and the legal basis (contract, consent or legitimate interest).
• To send service emails: sign-in codes, invitations, new assignments, grades, certificates, invoices and replies to your messages.
• To keep the platform secure and investigate sign-in problems. Sign-in failures and successes are emailed to our team with your email address, IP address and device details.
• To improve the course and the platform, using analytics only if you consent.

Who receives it (our service providers)

These companies process data for us to run the platform. TODO-LEGAL: confirm a data processing agreement is in place with each and record the country where each stores data.

• Supabase. Database, sign-in, and file storage for accounts, coursework and uploaded workbooks. TODO-LEGAL: hosting region.
• Vercel. Hosts the website and application, and sees request data such as IP address and logs.
• Resend. Sends our emails, so it handles recipient addresses and email content.
• Daily (Daily.co). Runs live video sessions and cloud recordings of those sessions.
• PostHog. Product analytics and session replay, loaded only if you accept analytics. Data is sent to PostHog's US cloud by default. TODO-LEGAL: confirm the PostHog region in use.
• Google (Gemini). Used only inside the staff Control Center (Part B), not for academy participant coursework. TODO-LEGAL: confirm that no participant data is sent to any AI service.

We do not sell personal data. TODO-LEGAL: describe any other recipients, such as professional advisers, and any transfers outside Jamaica.

Recording of live sessions

Live sessions are held in video rooms that can be recorded to the cloud by a facilitator. If a session is being recorded, the recording can include your voice, your video if it is on, and shared screens. If you do not want to appear in a recording, keep your camera off, stay muted, and tell your facilitator before the session. TODO-LEGAL: a notice shown when someone joins a room (not yet built in the platform), who can view recordings, and how long they are kept.

Analytics

We ask before loading PostHog. If you decline, no analytics script runs and nothing is sent to PostHog. If you accept, we record page visits, clicks and a replay of your screen on academy pages, with everything you type masked. Analytics never runs on the sign-in page or in the staff Control Center. You can change your choice at any time using "Analytics settings" in the page footer.

How long we keep it

TODO-LEGAL: retention periods for each category (accounts, coursework and submissions, activity and sign-in logs, assessment results, live-session recordings, contact messages, email logs, analytics) and what happens at the end of the course.

Your rights

You can ask to see the personal data we hold about you, to correct it, or to have it removed, and you can object to or withdraw consent for some uses. Signed-in participants can send a data removal request from inside the platform, or you can email us. TODO-LEGAL: confirm the rights and response times that apply under the Jamaica Data Protection Act, 2020 and describe how to complain to the Information Commissioner.

Children

The academy is for working adults. TODO-LEGAL: confirm the minimum age.

Security

Sign-in uses an emailed one-time code. Data is held in access-controlled databases and every request is checked against the signed-in user and their role. No system is perfectly secure. TODO-LEGAL: describe the process for notifying you and the regulator if there is a data breach.

Contact and changes

TODO-LEGAL: privacy contact email and postal address. For now: contact@jwbsja.com. We will post any change to this notice on this page and update the date at the top.

Part B. JWBS Control Center (internal)

JWBS Control Center is the internal system JW Business Solution uses to run bookkeeping and finance work for its clients. It is used only by JW Business Solution staff. It is not offered to the public and clients do not sign in to it.

What the system holds

• QuickBooks Online data. When a staff member connects a client's QuickBooks Online company through Intuit's official OAuth 2.0 sign-in, the system can read that company's accounting data (chart of accounts, transactions, customers, vendors, reports) and, where staff start an import or a posting, write records back to it. It accesses only companies that have been connected with the client's authorization.
• Connection credentials. The OAuth tokens that allow the connection are stored in a private database table that only the system's own server code can read. They are never sent to a browser or shared with anyone else.
• Onboarding information. Details clients give staff to set up their books, such as business registration and tax details, bank account information, supplier and customer lists and supporting documents. Staff enter these into the system.
• Activity records. A record of changes made through the system, so they can be reviewed and reversed.

How it is used

Data is used only to provide the bookkeeping and finance services the client has engaged JW Business Solution to perform: to display and reconcile the books, prepare reports and returns, and keep the client's records in order. It is not sold, shared with advertisers, or used to train advertising or marketing systems.

Who can see it

Only signed-in JW Business Solution staff authorised for the system. Our hosting providers (Supabase for the database and file storage, Vercel for the application) process the data on our behalf to run the service. When staff use the AI review feature, the relevant books data is sent to Google (Gemini) to produce the review. TODO-LEGAL: confirm Google's data terms for this use (including whether inputs are used for model training) and whether clients have agreed to it.

Keeping and deleting data

Data is kept while the client's engagement continues and for as long as we are required to keep financial records. A client can ask us to disconnect their QuickBooks company, and to delete the data we hold about them, by emailing the address below. Disconnecting removes the stored connection credentials. A client can also revoke access at any time from inside QuickBooks Online under Apps.

Security

Access requires a staff sign-in with an emailed one-time code. Connection credentials and client records sit in access-controlled databases, and every request from the application is checked against the signed-in staff member.

Contact

Questions or requests: contact@jwbsja.com