One Stop Vegan Privacy Policy

Who we are

One Stop Vegan is an online directory dedicated to business listings of vegan, natural living and plant-based goods and services. Our website address is: http://onestopvegan.org

Introduction

One Stop Vegan (“we”, “us”, “our”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you register, submit listings, post comments, or otherwise interact with our online directory. Our practices are designed to comply with the Jamaican Data Protection Act, 2020 (the “DPA”) and its associated regulations, including the Data Protection Regulations, 2024 and the Data Controller Registration Regulations, 2024. Please read this policy carefully to understand your rights and our obligations.

1. Who We Are and How to Contact Us

One Stop Vegan is the data controller responsible for your personal data processed via our website and related services. This means we determine the purposes and means of processing your personal information.

Legal Name: One Stop Vegan
Registered Address: Portmore, St Catherine, Jamaica
Contact Email: [email protected]

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us using the details above.

2. Scope of This Policy

This Privacy Policy applies to all users of the One Stop Vegan online directory, including registered users, listing submitters, commenters, and visitors. It covers all personal data collected through our website, mobile applications, and any related online or offline interactions. This policy does not apply to third-party websites or services that may be linked from our platform; we encourage you to review their privacy practices separately.

3. Key Definitions

To help you understand this policy, here are some important terms as defined by the Jamaican Data Protection Act:

Personal Data: Information relating to a living individual (or an individual deceased for less than thirty years) who can be identified from that information alone or in combination with other information in our possession. This includes names, contact details, online identifiers, and any opinions or intentions about an individual.
Sensitive Personal Data: Special categories of personal data, such as biometric or genetic data, racial or ethnic origin, political or religious beliefs, trade union membership, health information, sex life, or criminal records.
Processing: Any operation performed on personal data, including collection, recording, storage, use, disclosure, alteration, erasure, or destruction, whether by automated or manual means.
Data Subject: The individual to whom the personal data relates.
Data Controller: The person or entity (in this case, One Stop Vegan) that determines the purposes and means of processing personal data.
Data Processor: A person or entity that processes personal data on behalf of the data controller.

4. What Personal Data We Collect

We collect and process various categories of personal data depending on how you interact with One Stop Vegan. The types of data we collect include:

Identity and Contact Information: Name, username, email address, phone number, postal address.
Account Credentials: Passwords or authentication tokens (stored securely and never in plain text).
Listing Information: Details you submit about vegan businesses, products, or services, which may include your contact details if you are the listing owner.
User-Generated Content: Comments, reviews, ratings, photos, or other content you post.
Technical Data: IP address, device information, browser type, operating system, and usage data collected via cookies or similar technologies.
Marketing Preferences: Your choices regarding receiving newsletters, updates, or promotional messages.
Sensitive Data: We generally do not require sensitive personal data. If you voluntarily provide such data (for example, in a listing or comment), it will be processed with additional safeguards as required by law.
Children’s Data: We do not knowingly collect personal data from children under 16 without appropriate parental or guardian consent (see Section 15).

We may also collect information from third-party sources, such as social media platforms (if you choose to link your account), or from public sources where relevant.

5. How We Collect Your Data

We collect personal data in the following ways:

Directly from You: When you register for an account, submit a listing, post a comment, contact us, or otherwise interact with our services.
Automatically: Through cookies, analytics tools, and server logs when you use our website or mobile applications.
From Third Parties: If you use social login features, or if another user refers you or submits information about you (for example, as a business contact in a listing).

We strive to ensure that all data collection is transparent and that you are informed at the point of collection about what data is being gathered and for what purpose.

6. Lawful Basis for Processing Personal Data

Under the Jamaican Data Protection Act, we must have a lawful basis to process your personal data. We rely on one or more of the following grounds:

Consent: Where you have given clear, informed, and specific consent for us to process your data for a particular purpose (for example, receiving marketing communications or publishing your listing).
Contractual Necessity: To perform a contract with you, such as providing access to your account, processing your listing, or responding to your requests.
Legal Obligation: Where processing is necessary to comply with a legal requirement (for example, record-keeping or responding to lawful requests from authorities).
Legitimate Interests: Where processing is necessary for our legitimate business interests (such as improving our services, preventing fraud, or ensuring security), provided these interests are not overridden by your rights and interests.
Vital Interests: In rare cases, to protect your vital interests or those of another person.

For sensitive personal data, we will only process it with your explicit written consent or where another legal ground applies, as specified in the DPA.

7. Purposes for Which We Use Your Data

We use your personal data for the following purposes:

Account Management: To create, maintain, and secure your user account.
Directory Listings: To process and publish your submitted listings, including displaying your chosen contact information.
User Engagement: To enable you to post comments, reviews, and interact with other users.
Customer Support: To respond to your inquiries, requests, or complaints.
Service Improvement: To analyze usage patterns, troubleshoot issues, and enhance our website and services.
Marketing and Communications: To send you updates, newsletters, or promotional messages (with your consent or as permitted by law).
Legal Compliance: To comply with applicable laws, regulations, and lawful requests from authorities.
Security and Fraud Prevention: To protect our users, systems, and data from unauthorized access, misuse, or other security threats.

We will not use your personal data for purposes incompatible with those described above without informing you and, where required, obtaining your consent.

8. Cookies, Analytics, and Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience, analyze site usage, and support core functionality. Cookies are small text files stored on your device.

Types of Cookies We Use:
- Necessary Cookies: Essential for site operation (e.g., login, security).
- Analytics Cookies: Help us understand how users interact with our site (e.g., page views, navigation paths).
- Preference Cookies: Remember your settings and preferences.
- Marketing Cookies: Used only with your consent, to deliver relevant content or measure campaign effectiveness.

When you first visit our website, you will see a cookie banner allowing you to accept or manage your cookie preferences. You can change your choices at any time via your browser settings or our cookie management tool.

For more information, please see our [Cookie Policy] (link to separate document if available).

9. Direct Marketing and Communications

We may send you marketing communications (such as newsletters, updates, or promotional offers) by email, SMS, WhatsApp, or other channels, but only if:

You have given your explicit consent; or
You are an existing customer and have not opted out of such communications, as permitted by law.

Every marketing message will include a clear and easy way to opt out or unsubscribe. You may also update your preferences in your account settings or by contacting us at any time.

We will not send you unsolicited marketing communications or share your data with third parties for their own marketing purposes without your consent.

10. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients, strictly for the purposes described in this policy:

Service Providers: Trusted third-party vendors who provide services such as website hosting, data storage, analytics, email delivery, payment processing, or customer support. These providers are contractually required to process your data only on our instructions and to maintain appropriate security measures.
Other Users: If you submit a listing or post a comment, your chosen display name and any information you include in your public profile or content may be visible to other users.
Professional Advisers: Our legal, accounting, or other professional advisers, where necessary for compliance or dispute resolution.
Regulators and Law Enforcement: Where required by law, regulation, or court order, or to protect our rights, property, or safety, or that of our users or the public.
Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the new owner, subject to continued protection under this policy.

We do not sell your personal data to third parties. Any sharing with third-party processors is governed by written agreements that require them to implement adequate safeguards and comply with the DPA.

11. International Data Transfers

Some of our service providers or systems may be located outside Jamaica. When your personal data is transferred to or accessed from another country, we ensure that:

The destination country provides an adequate level of protection for your data, as determined by the Jamaican Information Commissioner; or
We implement appropriate safeguards, such as contractual clauses, to ensure your data remains protected; or
The transfer is otherwise permitted by law (for example, with your consent, or where necessary for the performance of a contract).

You will be informed if your data is transferred outside Jamaica, and you may request further information about the safeguards in place by contacting us.

12. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, including:

Maintaining your account and providing services;
Complying with legal, regulatory, or contractual obligations;
Resolving disputes and enforcing our agreements.

When your data is no longer needed, we will securely delete or anonymize it, unless retention is required by law (for example, for tax or accounting purposes). Specific retention periods may vary depending on the type of data and the context of processing. You may request more details about our retention practices by contacting us.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

Encryption: Sensitive data is encrypted in transit and at rest where appropriate.
Access Controls: Only authorized personnel have access to personal data, based on their role and need.
Authentication: Secure login procedures and, where feasible, multi-factor authentication.
Regular Security Audits: Periodic reviews and testing of our systems and processes.
Staff Training: Employees and contractors receive training on data protection and security best practices.
Vendor Due Diligence: We assess the security and compliance of third-party service providers.

Despite our efforts, no system can guarantee absolute security. If you suspect any unauthorized access or breach of your data, please contact us immediately.

14. Data Breach Notification

In the unlikely event of a data breach that affects your personal data, we will:

Notify the Jamaican Information Commissioner within 72 hours of becoming aware of the breach, as required by law;
Notify you promptly if the breach is likely to result in a high risk to your rights and freedoms, providing details of the breach, the measures taken or proposed to address it, and the contact information of our Data Protection Officer (if appointed);
Take immediate steps to contain and mitigate the breach, investigate its cause, and implement corrective actions.

We maintain an incident response plan and regularly review our procedures to ensure readiness in the event of a breach.

15. Children’s Privacy and Age Verification

Our services are not intended for children under 18 years of age. We do not knowingly collect personal data from minors without the consent of a parent or legal guardian. If you are under 18, you must have your parent or guardian’s permission to use our services, register an account, or submit any personal data.

If we become aware that we have collected personal data from a minor without appropriate consent, we will take steps to delete such data promptly. Parents or guardians may contact us to review, correct, or request deletion of their child’s data.

16. Your Rights as a Data Subject

Under the Jamaican Data Protection Act, you have the following rights regarding your personal data:

Right to Be Informed: You have the right to be informed about how your data is collected, used, and shared.
Right of Access: You may request a copy of the personal data we hold about you, along with information about how it is processed.
Right to Rectification: You may request correction of inaccurate or incomplete personal data.
Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data in certain circumstances, such as when it is no longer necessary for the purposes collected, or if you withdraw consent.
Right to Restrict Processing: You may request that we restrict the processing of your data in certain situations (for example, while a correction request is being considered).
Right to Data Portability: You may request that your personal data be provided to you or another data controller in a structured, commonly used, and machine-readable format.
Right to Object: You may object to processing of your data for certain purposes, such as direct marketing.
Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affect you.

To exercise any of these rights, please contact us using the details in Section 1. We may need to verify your identity before processing your request. We will respond within 30 days, or as otherwise required by law. If we are unable to comply with your request, we will explain the reasons and inform you of your right to complain to the Information Commissioner.

17. How to Exercise Your Rights

You may submit a request to exercise your rights by:

Emailing our privacy contact or Data Protection Officer (see Section 1);
Using any online forms or tools provided on our website;
Writing to our registered address.

Please provide sufficient information to identify yourself and the nature of your request. We may ask for additional details or documentation to verify your identity and ensure the security of your data.

There is generally no fee for exercising your rights, unless your request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee or refuse to act on the request, as permitted by law.

18. Automated Decision-Making and Profiling

We do not use your personal data to make decisions based solely on automated processing that have legal or similarly significant effects on you. If we introduce such processes in the future (for example, automated moderation of listings or comments), we will inform you and provide you with the right to request human intervention, express your point of view, and contest the decision.

19. Data Subject Requests, Complaints, and Appeals

If you have concerns about how your personal data is processed, or if you wish to make a complaint, you may:

Contact us directly using the details in Section 1;
Submit a complaint to the Jamaican Information Commissioner at [email protected] or by visiting the Office of the Information Commissioner’s website (https://oic.gov.jm/).

We are committed to addressing your concerns promptly and transparently. If you are dissatisfied with our response, you may escalate your complaint to the Information Commissioner, who has the authority to investigate and enforce compliance with the DPA.

20. Data Controller Registration and Accountability

As required by the Jamaican Data Protection Act, One Stop Vegan is registered as a data controller with the Office of the Information Commissioner. Our registration includes details of the types of personal data we process, the purposes of processing, categories of data subjects, and any transfers outside Jamaica.

We maintain records of our data processing activities, conduct regular reviews, and submit annual Data Protection Impact Assessments (DPIAs) as required by law. Our staff receive training on data protection obligations and best practices.

21. Data Protection Impact Assessments (DPIAs)

We conduct regular Data Protection Impact Assessments to evaluate the risks associated with our data processing activities and to ensure that appropriate safeguards are in place. DPIAs are submitted annually to the Information Commissioner and are reviewed whenever we introduce new processing activities or technologies that may impact your privacy.

22. Use of Third-Party Processors and Vendor Contracts

When we engage third-party service providers to process personal data on our behalf, we:

Select vendors who provide sufficient guarantees regarding technical and organizational security measures;
Enter into written contracts that require processors to act only on our instructions, maintain confidentiality, and implement adequate safeguards;
Monitor and review vendor compliance with our data protection requirements.

We maintain a register of our third-party processors and review these relationships regularly to ensure ongoing compliance.

23. Privacy by Design and Default

We are committed to integrating privacy and data protection principles into the design and operation of our website, features, and services. This includes:

Limiting data collection to what is necessary for specified purposes;
Implementing strong security measures from the outset;
Providing clear and accessible privacy information at the point of data collection;
Regularly reviewing and updating our practices to reflect changes in technology, law, or user expectations.

24. Staff Training and Awareness

All staff and contractors who handle personal data receive training on data protection principles, security practices, and their responsibilities under the Jamaican Data Protection Act. We promote a culture of privacy and accountability throughout our organization.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will notify you by:

Posting an updated policy on our website with a new effective date;
Providing notice via email or account notification (where appropriate).

We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes your acceptance of the revised policy.

26. Additional Information and Resources

For more information about your data protection rights and obligations, you may consult the following resources:

Office of the Information Commissioner, Jamaica: https://oic.gov.jm/
Jamaican Data Protection Act, 2020: [Link to official text]
Data Protection Standards: https://oic.gov.jm/page/data-protection-standards

If you require further assistance or have questions about this policy, please contact our privacy team at [insert contact email].

27. Effective Date

This Privacy Policy is effective as of [insert date]. The most recent version will always be available on our website.

28. Summary Table: Your Data Rights and How We Support Them

Right	What It Means	How to Exercise It	Typical Response Time
Right to Be Informed	Know how and why your data is processed	Read this policy or contact us	Immediate
Right of Access	Obtain a copy of your personal data	Email, online form, or in writing	30 days
Right to Rectification	Correct inaccurate or incomplete data	Email, online form, or in writing	30 days
Right to Erasure	Request deletion of your data in certain circumstances	Email, online form, or in writing	30 days
Right to Restrict Processing	Limit how your data is used in specific situations	Email, online form, or in writing	21 days
Right to Data Portability	Receive your data in a portable format	Email, online form, or in writing	30 days
Right to Object	Object to processing for certain purposes (e.g., marketing)	Email, online form, or in writing	21 days
Right Not to Be Subject to Automated Decision-Making	Not be subject to decisions based solely on automated processing	Email, online form, or in writing	30 days

We are committed to upholding your rights and will provide clear explanations if we are unable to fulfill a request due to legal or operational reasons.

29. Sample Consent Language

When we request your consent for specific processing activities (such as marketing communications or publishing your listing), we will use clear and plain language. For example:

“By submitting this form, you consent to One Stop Vegan processing your personal data for the purpose of publishing your listing in our online directory. You may withdraw your consent at any time by contacting us at [privacy contact email].”

For sensitive personal data, we will request your explicit written consent and explain any additional safeguards.

30. Cookie Banner Text Example

When you visit our website, you will see a cookie banner similar to:

“We use cookies to enhance your experience, analyze site usage, and support core functionality. By clicking ‘Accept’, you consent to our use of cookies. You can manage your preferences at any time. [Learn more]”

You can adjust your cookie settings or withdraw consent via your browser or our cookie management tool.

31. Data Subject Request and Complaint Procedures

To make a data subject request (access, correction, deletion, etc.):

Contact us via the dedicated privacy email or online form.
Provide sufficient information to verify your identity and specify your request.
We will acknowledge receipt and respond within the statutory timeframe (usually 30 days).
If your request is complex or requires additional information, we will inform you of any extension or requirements.
If you are dissatisfied with our response, you may escalate your complaint to the Information Commissioner.

We maintain logs of all requests and outcomes to ensure accountability and continuous improvement.

32. Data Breach Response Plan

In the event of a data breach, our response plan includes:

Immediate containment and investigation of the incident;
Assessment of the scope and impact, including affected data and individuals;
Notification to the Information Commissioner within 72 hours;
Notification to affected individuals where required, including guidance on protective steps;
Documentation of the incident, response actions, and lessons learned;
Review and enhancement of security measures to prevent recurrence.

We regularly test and update our incident response procedures to ensure readiness.

33. Cross-Border Transfers: Safeguards and Controls

When personal data is transferred outside Jamaica, we:

Assess the adequacy of protection in the destination country;
Implement contractual safeguards (such as data processing agreements and standard contractual clauses);
Limit transfers to what is necessary for service delivery;
Inform you of such transfers in this policy and, where required, obtain your consent;
Monitor vendor compliance and review transfer arrangements regularly.

You may request details of our cross-border transfer safeguards by contacting us.

34. Special Considerations for User-Generated Content

Please note that any information you choose to include in public listings, comments, or reviews may be visible to other users and the general public. We encourage you to avoid sharing sensitive personal data in public areas of our platform. You are responsible for the content you submit, and we reserve the right to moderate or remove content that violates our terms or legal requirements.

35. Changes in Ownership or Business Structure

If One Stop Vegan undergoes a merger, acquisition, or other change in ownership, your personal data may be transferred to the new entity. In such cases, we will ensure that your data continues to be protected in accordance with this policy and applicable law, and we will notify you of any material changes.

36. Links to Third-Party Websites

Our website may contain links to third-party sites or services. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party services you use.

37. Your Responsibilities

To help us protect your data, please:

Use strong, unique passwords for your account and do not share them with others;
Notify us promptly if you suspect unauthorized access or misuse of your account;
Keep your contact information up to date;
Review this policy and your privacy settings regularly.

38. Further Assistance

If you have questions, need assistance, or wish to provide feedback on this policy, please contact our privacy team at [insert contact email]. We value your trust and are committed to protecting your privacy.

Effective Date: June 1, 2026

Last Updated: 30 May 2026

One Stop Vegan is dedicated to upholding the highest standards of privacy and data protection. Your trust is important to us, and we are committed to transparency, accountability, and continuous improvement in safeguarding your personal information.

This Privacy Policy is provided in accordance with the Jamaican Data Protection Act, 2020 and related regulations. For more information about your rights or to make a complaint, you may contact the Office of the Information Commissioner at [email protected] or visit https://oic.gov.jm/.