Effective Date: March 20, 2026

Compliant with the Data Protection Act (Jamaica) 2020

At ARRA Couriers, your privacy is not an afterthought — it is a core part of how we operate. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our courier and logistics services, visit our website at arracouriers.com, or communicate with us by any means.

This Policy is issued in compliance with the Data Protection Act (Jamaica) 2020 (“DPA”) and is intended to be clear, honest, and written in plain language so you understand exactly what we do with your data.

By using our Services or our Website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we handle personal data, please do not use our Services.

Quick Reference — Data Controller Details

Organisation: ARRA Couriers

Website: arracouriers.com

Telephone: +1876-221-9211

Email: info@arracouriers.com

Jurisdiction: Jamaica

Regulatory Framework: Data Protection Act (Jamaica) 2020

Supervisory Authority: Office of the Information Commissioner, Jamaica

1. Who We Are

ARRA Couriers is a courier and logistics service provider operating within Jamaica. We are the Data Controller in respect of the personal data processed under this Policy, meaning we determine the purposes and means by which your personal information is used.

Our Data Protection contact can be reached at info@arracouriers.com or by calling +1876-221-9211 during business hours.

2. Scope of This Policy

This Privacy Policy applies to:

• All customers who place delivery orders with us (online, by phone, or in person).
• Recipients of packages delivered by ARRA Couriers.
• Visitors to arracouriers.com or any associated digital platform.
• Individuals who contact us for support, information, or enquiries.
• Business clients and corporate account holders.
• Job applicants and prospective employees.

This Policy does not apply to third-party websites or services that may be linked from our Website. We encourage you to review the privacy policies of any external sites you visit.

3. Information We Collect

We collect personal data only to the extent necessary to provide our Services and to comply with our legal obligations. The categories of information we may collect include:

3.1 Information You Provide to Us

• Full name and business name (where applicable)
• Delivery and billing addresses
• Email address and telephone number
• Package contents description and declared value
• Payment information (processed through secure, compliant third-party payment providers — we do not store full card numbers)
• Special delivery instructions or notes
• Communications with our customer service team (calls, emails, chat messages)

3.2 Information We Collect Automatically

When you visit arracouriers.com, our systems may automatically collect:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent on pages, and navigation paths
• Referring website or search terms used to find us
• Device identifiers and session data
• Cookie data (see Section 9 for our full Cookie Policy)

3.3 Information We Collect from Third Parties

We may receive personal data about you from:

• The sender of a package, where you are the Recipient
• Payment processors and fraud-prevention services
• Business partners or referral sources
• Publicly available directories or regulatory databases

4. How We Use Your Information

We use personal data for the following purposes, each tied to a lawful basis under the DPA:

4.1 To Provide and Manage Our Services (Contract)

• Processing and fulfilling delivery orders
• Communicating with you and the Recipient about Shipment status
• Generating invoices, receipts, and proof of delivery
• Managing your account and booking history
• Investigating and resolving delivery issues or disputes

4.2 To Comply with Legal Obligations (Legal Obligation)

• Maintaining financial and transaction records as required by Jamaican tax law
• Responding to lawful requests from courts, government agencies, or law enforcement
• Reporting data breaches to the Office of the Information Commissioner as required under the DPA
• Complying with Customs, Trade, and other regulatory requirements

4.3 For Legitimate Business Interests (Legitimate Interests)

• Fraud detection, prevention, and security monitoring
• Improving and developing our Services based on usage patterns
• Training and quality assurance for our staff
• Maintaining the security and integrity of our systems and Website
• Pursuing or defending legal claims where necessary

4.4 With Your Consent

• Sending you promotional emails, service updates, or marketing communications
• Using non-essential cookies and tracking technologies on the Website

You may withdraw your consent at any time by contacting us at info@arracouriers.com or clicking the unsubscribe link in any marketing communication. Withdrawal of consent does not affect any processing already carried out.

5. Legal Basis for Processing Under the DPA

The Data Protection Act (Jamaica) 2020 requires that every instance of personal data processing must have a lawful basis. The following table summarises the legal bases on which ARRA Couriers relies:

Performance of a Contract: Processing is necessary to fulfil the delivery or service you have requested.

Legal Obligation: Processing is required to comply with applicable Jamaican laws and regulations.

Legitimate Interests: Processing is necessary for fraud prevention, security, and business operations, provided these interests are not overridden by your rights.

Consent: You have given clear, informed, and freely given consent for a specific processing activity such as direct marketing.

6. How We Share Your Information

ARRA Couriers does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share your information only in the following circumstances:

6.1 Delivery Partners & Subcontractors

To fulfil your delivery, we may share relevant shipment and contact details with contracted delivery drivers, dispatch partners, or logistics subcontractors. These parties are permitted to use the information only to complete the delivery and are bound by confidentiality obligations.

6.2 Payment Processors

We share necessary billing information with our payment processing providers to facilitate secure transactions. These providers operate under strict industry-standard security frameworks, including PCI-DSS compliance.

6.3 Technology & Cloud Service Providers

We may use third-party software providers for website hosting, customer management, email services, and analytics. Any such provider is engaged under a Data Processing Agreement that restricts their use of your data to the services they provide to us.

6.4 Legal & Regulatory Disclosure

We may disclose personal data to law enforcement, courts, or government authorities when required to do so by law or in response to a lawful request, including for the purposes of crime prevention, tax compliance, or national security. We will not disclose more information than is strictly required.

6.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, personal data held by ARRA Couriers may be transferred to the acquiring entity. You will be notified of any such transfer and your rights under this Policy will be preserved.

6.6 With Your Consent

We may share your personal data with any other party where you have given your explicit prior consent for us to do so.

7. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes described in this Policy, unless a longer period is required or permitted by law. Our general retention principles are:

• Customer account and transaction records: Retained for a minimum of seven (7) years from the date of the last transaction, in compliance with Jamaican tax and financial record-keeping requirements.
• Delivery-related communications: Retained for up to two (2) years for dispute resolution and quality assurance purposes.
• Website usage and analytics data: Retained for up to twelve (12) months, after which it is anonymised or deleted.
• Marketing consent records: Retained for as long as the consent remains active plus three (3) years thereafter.
• CCTV or security footage (if applicable at collection points): Retained for up to thirty (30) days unless required for an active investigation.
• Job applicant data (unsuccessful applicants): Retained for up to six (6) months from the close of the application process.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer identify you.

8. Your Rights Under the DPA

The Data Protection Act (Jamaica) 2020 grants you the following rights in respect of your personal data. We are committed to honouring these rights promptly and without unnecessary obstacles.

8.1 Right of Access

You have the right to request a copy of the personal data we hold about you, along with information about how we use it. This is known as a Subject Access Request (SAR). We will respond within thirty (30) days of receiving a valid request.

8.2 Right to Rectification

If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. We will action valid rectification requests promptly.

8.3 Right to Erasure

Also known as the “right to be forgotten,” you may request that we delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing. This right is not absolute and may be limited by our legal obligations to retain certain records.

8.4 Right to Restrict Processing

You may ask us to suspend the processing of your data in certain circumstances, such as while the accuracy of the data is being contested or while an objection is being considered.

8.5 Right to Data Portability

Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

8.6 Right to Object

You have the right to object to processing of your personal data where it is based on our legitimate interests. You also have an unconditional right to object to your data being used for direct marketing purposes. Upon receiving an objection to direct marketing, we will stop processing your data for that purpose immediately.

8.7 Rights Related to Automated Decision-Making

Where any decision affecting you is made solely on the basis of automated processing (including profiling), you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

8.8 How to Exercise Your Rights

To exercise any of the rights above, please submit a written request to:

Email: info@arracouriers.com

Telephone: +1876-221-9211

We may ask you to verify your identity before processing your request. We will respond within thirty (30) days of a confirmed valid request. If we are unable to fulfil your request, we will explain why.

8.9 Right to Complain

If you are dissatisfied with how we have handled your personal data or a rights request, you have the right to lodge a complaint with the Office of the Information Commissioner of Jamaica. We would, however, appreciate the opportunity to address your concerns directly before you escalate to the regulator.

9. Cookies & Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They help websites remember your preferences, understand how you navigate the site, and deliver a more personalised experience.

9.2 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the Website to function. These cannot be disabled. Examples include session management and security tokens.
• Functional Cookies: Remember your preferences such as language settings or previously entered information to improve your experience.
• Analytical / Performance Cookies: Collect anonymised information about how visitors use our Website (e.g., pages visited, time on site). We use this data to improve our Website. These cookies require your consent.
• Marketing Cookies: Used to track visits across websites and deliver relevant advertising. These are only deployed with your explicit consent.

9.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse all or some cookies, delete existing cookies, and set preferences for certain websites. Please note that disabling certain cookies may affect the functionality of our Website.

A full Cookie Preference panel is available on our Website. Your preferences will be recorded and applied on each visit.

9.4 Third-Party Analytics

We may use third-party analytics tools (such as Google Analytics) to help us understand Website usage. These tools operate under their own privacy policies and may set their own cookies. Where such tools process personal data, we ensure appropriate Data Processing Agreements are in place.

10. Data Security

The security of your personal data is a responsibility we take seriously. ARRA Couriers implements a range of technical and organisational security measures proportionate to the risk of the data we process, including:

10.1 Technical Measures

• SSL/TLS encryption for all data transmitted via arracouriers.com
• Encrypted storage for sensitive customer and financial records
• Firewalls, intrusion detection systems, and access logging
• Secure, access-controlled systems with role-based permissions
• Regular vulnerability assessments and software patching
• Multi-factor authentication for staff accessing customer data

10.2 Organisational Measures

• Staff training on data protection obligations and handling procedures
• Internal data protection policies and acceptable use guidelines
• Confidentiality obligations in staff and contractor agreements
• Periodic internal audits of data handling practices
• Vendor due diligence for all third-party data processors

10.3 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ARRA Couriers will:

• Notify the Office of the Information Commissioner of Jamaica without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach.
• Notify affected individuals promptly where the breach is likely to result in a high risk to their rights and freedoms.
• Document all breaches in our internal breach register, including details of the breach, its effects, and remedial actions taken.

While we take all reasonable precautions, no system is completely immune to security threats. We encourage you to use strong, unique passwords and to contact us immediately at info@arracouriers.com if you suspect any unauthorised use of your account or personal data.

11. International Data Transfers

ARRA Couriers is a Jamaica-based business and your personal data is primarily processed and stored within Jamaica. In limited circumstances, data may be processed by third-party service providers whose infrastructure is located outside Jamaica (for example, cloud hosting or software-as-a-service providers).

Where personal data is transferred outside Jamaica, we ensure that appropriate safeguards are in place, which may include:

• Transfers to countries with an adequate level of data protection as recognised by the relevant Jamaican authority.
• Data Processing Agreements incorporating standard contractual protections.
• Other legally approved transfer mechanisms as may be prescribed under the DPA.

We do not transfer your personal data to any country or organisation that cannot provide an adequate level of protection consistent with Jamaican law.

12. Children’s Privacy

Our Services are intended for use by adults aged 18 and over. We do not knowingly collect or process personal data from individuals under the age of 18 without the verified consent of a parent or legal guardian.

If you are a parent or guardian and you believe your child has provided us with personal data without your consent, please contact us immediately at info@arracouriers.com. We will investigate and, where confirmed, promptly delete the relevant data.

13. Marketing Communications

We will only send you promotional or marketing communications if you have given us your explicit prior consent, or where we have an existing customer relationship and you have not opted out of receiving such communications.

Every marketing communication we send will include a clear and easy mechanism to opt out. You may also opt out at any time by:

• Clicking the “Unsubscribe” link in any marketing email.
• Emailing us at info@arracouriers.com with “Unsubscribe” in the subject line.
• Calling us at +1876-221-9211 and requesting removal from our mailing list.

Please allow up to five (5) business days for your opt-out preference to be fully applied across our systems. Please note that opting out of marketing communications does not affect transactional or service-related communications, which we must send to fulfil your delivery requests.

14. Third-Party Links

Our Website may contain links to third-party websites, social media platforms, or partner services. Once you leave arracouriers.com, this Privacy Policy no longer applies. We have no control over and accept no responsibility for the privacy practices or content of those external sites. We strongly encourage you to review the privacy policies of any third-party sites you visit.

15. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or legal obligations. When we make material changes, we will:

• Update the Effective Date at the top of this Policy.
• Post a prominent notice on our Website.
• Where appropriate and where we hold your contact details, notify you directly by email.

We encourage you to review this Policy periodically to stay informed about how we protect your information. Continued use of our Services after the publication of an updated Policy constitutes your acceptance of the changes.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, the way we handle your personal data, or your rights under the DPA, please do not hesitate to reach out:

ARRA Couriers — Data Protection Enquiries

Website: arracouriers.com

Email: info@arracouriers.com

Telephone: +1876-221-9211

If you are not satisfied with our response, you may lodge a complaint with:

Office of the Information Commissioner of Jamaica

As the supervisory authority responsible for the enforcement of the Data Protection Act (Jamaica) 2020.

This Privacy Policy was last updated on June 1, 2025.

© 2025 ARRA Couriers. All rights reserved.