Kador2door

Privacy Policy and Data Protection Notice

Last Updated: 23 August 2026 | Issued pursuant to the Data Protection Act, 2020 (Jamaica)

Protecting the privacy and security of your personal data is of utmost importance to Kador2door. This Privacy Policy (the “Policy”) is issued by Kador2door Limited (“Kador2door”, “we”, “us”), a company incorporated under the laws of Jamaica with its registered office at Comfort District, Mandeville P.O, which is the data controller in respect of the personal data described in this Policy and is registered (or has applied for registration) as a data controller with the Office of the Information Commissioner (“OIC”) 

This Policy explains what personal data we collect from Users of the Kador2door marketplace and delivery platform (the “Platform”), the purposes and lawful bases on which we process it, with whom it is shared, how long it is retained, how it is secured, and your rights under the Data Protection Act, 2020 (the “DPA”). It reflects the eight data protection standards prescribed by the DPA and the constitutional right to protection of privacy of the person and respect for private life recognised under the Charter of Fundamental Rights and Freedoms and affirmed by the Full Court in Julian J. Robinson v The Attorney General of Jamaica [2019] JMFC Full 04.

• “Personal data” means information relating to a living individual, or an individual who has been deceased for fewer than thirty years, from which that individual can be identified, whether by itself or together with other information;

• “Data subject” means the individual to whom personal data relates, including Buyers, Sellers, Couriers and visitors to the Platform;

• “Processing”includes obtaining, recording, storing, using, disclosing, and erasing personal data;

• “DPA”means the Data Protection Act, 2020 of Jamaica; “OIC” means the Office of the Information Commissioner established under the DPA.

We limit the personal data we collect to that which is adequate, relevant and necessary for the purposes described in this Policy, in keeping with the Third Data Protection Standard (data minimisation).

When you create an account we collect your name, email address, telephone number and delivery address(es). For Sellers and Couriers we may additionally collect government-issued photographic identification, Taxpayer Registration Number (TRN) and banking or PayPal details necessary to remit payments. Validation of identity information may be carried out using external third-party sources. Where age verification measures are applied at registration, any identification data collected is limited to what is necessary to confirm eligibility.

Couriers additionally provide driver’s licence details, vehicle information (make, model, registration and insurance particulars) and, while on active deliveries, real-time GPS location, which is used to match, track and verify deliveries.

We collect records of your listings, bids, offers, purchases, sales, delivery confirmations, refunds and disputes (“transaction history”), together with ratings and reviews you give or receive.

Messages exchanged through the in-app chat, and correspondence with our support team, are recorded and retained for the purposes of ensuring the accuracy and completeness of our records, resolving complaints and disputes (including legal proceedings), preventing fraud and maintaining User safety. Communications are removed when no longer required for these purposes.

Payments are processed by PayPal, which receives, holds and processes transaction funds. Kador2door does not collect or store your payment card numbers and does not itself hold customer funds. We receive from PayPal only the transaction confirmations and limited account identifiers necessary to reconcile payments, account for our commissions, remit Seller balances and process refunds. PayPal’s handling of your payment data is governed by its own privacy policy.

We automatically collect device information (device type, operating system, unique device identifiers), IP address, log data, and information about how you use the Platform. Cookies and similar technologies are used to maintain your session, remember preferences, secure the Platform, measure usage and, for Users of the free service and only with the appropriate consent, to serve advertising.

With your device-level permission (which you may enable or disable at any time in your device settings), we collect location information from Buyers and Sellers to facilitate delivery estimates and local listings. Precise GPS tracking of Couriers occurs only while a delivery is active.

In accordance with the First Data Protection Standard, we process personal data fairly and lawfully, and only where at least one lawful processing condition is met. The purposes for which we process your data, and the corresponding bases, are:

• To provide the Platform and perform our contract with you: creating and administering accounts, publishing listings, facilitating bids, purchases and negotiations, matching and tracking deliveries, processing payments and remittances, and administering Elite Membership (basis: performance of a contract);

• To operate delivery services: sharing delivery names, addresses and contact details between the Buyer, Seller and the assigned Courier or Third-Party Carrier, and tracking active deliveries (basis: performance of a contract);

• Safety, security and fraud prevention: verifying identity and age, investigating fraud, scams, refund abuse and fee circumvention, securing accounts and the Platform (basis: legitimate interests and, where applicable, legal obligation);

• Dispute resolution: reviewing transaction records, chat messages and evidence submitted in refund and delivery disputes (basis: legitimate interests and performance of a contract);

• Legal and regulatory compliance: complying with court orders, lawful requests of the police and regulators, tax law and the Proceeds of Crime Act, 2007 (basis: legal obligation);

• Service communications: order confirmations, delivery updates, security alerts and material changes to our terms (basis: performance of a contract / legitimate interests);

• Direct marketing and personalised advertising: only with your consent, which you may withdraw at any time through your account settings or by contacting us, and subject to your right under the DPA to require us at any time to cease processing your data for direct marketing purposes;

• Revealing your contact details to Elite Members: only where you have chosen, through the contact sharing control in your account settings, to reveal your telephone number and email address to subscribed Elite Members. Your contact details are hidden by default; your choice is a form of consent which is freely given, specific and informed, and you may change your selection at any time without affecting your use of the Platform. Access to the Platform is never conditioned on this consent.

We do not use your personal data for any purpose incompatible with those described above (Second Standard: purpose limitation), and we do not sell your personal data.

We disclose personal data only as described below and, where we engage service providers, we bind them contractually to process your data only on our instructions, to keep it confidential and to apply appropriate security measures:

• Other Users: limited transaction details (such as your username, delivery name, address and contact number) are shared between Buyer, Seller and Courier strictly as necessary to complete a transaction and delivery;

• Couriers and Third-Party Carriers: delivery details are shared with the assigned Courier or with a Third-Party Carrier you select (for example, FedEx), which processes your data under its own privacy policy;

• PayPal: to process payments, remittances and refunds;

• Service providers: cloud hosting, analytics, customer support, identity verification and security providers acting on our behalf;

• Professional advisers: auditors, attorneys-at-law and insurers, under duties of confidence;

• Law enforcement and regulators: the police, courts, tax authorities, the OIC and other public bodies where disclosure is required or permitted by law;

• Business transfers: if we sell or transfer all or part of our business or assets, your data may be disclosed to the purchaser under a non-disclosure agreement, and the adoption of equivalent or more robust data protection safeguards will be a precondition of any such transfer;

• Elite Members: your telephone number and email address are revealed to subscribed Elite Members only if you have enabled the contact sharing control as described above.

Certain recipients, in particular PayPal, Third-Party Carriers and cloud service providers, store or process data in states or territories outside of Jamaica, including the United States. In accordance with the Eighth Data Protection Standard, we transfer personal data outside Jamaica only where the destination ensures an adequate level of protection for your rights, or where a statutory exception applies, principally, where the transfer is necessary for the performance of your contract with us (for example, processing your payment or completing an international delivery) or where you have consented to the transfer. We use contractual safeguards with our overseas service providers to protect your data.

In keeping with the Seventh Data Protection Standard, we implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include encryption of data in transit, access controls restricting personal data to authorised personnel on a need-to-know basis, staff confidentiality obligations and training, and contractual security obligations imposed on our service providers.

You are responsible for the security of your username and password. If you become aware of any unauthorised access to your account, you must change your password and notify us immediately so that we can take the necessary steps to secure your data.

Breach notification. In the event of a breach of any of the data protection standards affecting your personal data, we will notify the OIC within seventy-two (72) hours of becoming aware of the breach and will inform affected data subjects in accordance with the DPA.

In keeping with the Fifth Data Protection Standard, we keep personal data only for as long as is necessary for the purposes for which it was collected, subject to retention periods required by law. Our retention periods, as confirmed, are:

• Account and transaction records, seven (7) years, consistent with statutory limitation and tax record-keeping requirements (and, for account profile data, for the life of your account plus that period after closure to the extent necessary for legal claims, tax and audit purposes);

• Chat messages, two (2) years from the relevant transaction, or longer where required for an active dispute, investigation or legal proceeding;

• Location and delivery tracking data, twelve (12) months, or longer where required for an active dispute or claim;

• Device logs and analytics data, one (1) year, thereafter aggregated or anonymised.

When personal data is no longer required, it is securely deleted, destroyed or irreversibly anonymised.

Under Part II of the DPA you have, subject to the conditions and exceptions in the Act, the right to:

• Access: obtain confirmation that we process your personal data and a copy of that data (a reasonable fee may apply, and proof of identity is required to protect your privacy);

• Rectification: require us to correct or complete inaccurate or incomplete data; you are also asked to advise us if information you have provided changes or becomes out of date;

• Erasure and blocking: require the rectification, blocking, erasure or destruction of data processed in contravention of the DPA, subject to our legal retention obligations;

• Object: require us to cease, or not begin, processing likely to cause substantial unwarranted damage or distress;

• Stop direct marketing: require us at any time to cease processing your data for direct marketing purposes, which we will honour without charge;

• Automated decision-making: not to be subject to decisions producing legal or similarly significant effects based solely on automated processing, and to require reconsideration of any such decision;

• Withdraw consent: where processing is based on consent (for example, marketing, personalised advertising, or the revealing of your contact details to Elite Members), withdraw that consent at any time through your account settings or by contacting us, without affecting the lawfulness of prior processing;

• Complain: lodge a complaint with the Office of the Information Commissioner (www.oic.gov.jm) and seek compensation through the courts for damage suffered by reason of a contravention of the DPA.

To exercise any of these rights, contact our Data Protection Officer using the details below. We will respond within the timeframes prescribed by the DPA.

You may withhold or withdraw consent to processing which is based on consent, save and except where processing is required by law or is necessary for the performance of your contract with us. Withdrawal of consent to essential processing (for example, sharing your delivery address with a Courier for an order you have placed) may prevent us from providing the relevant service, and we will explain the consequences to you at the time. We will never make your access to the Platform conditional on consenting to processing which is not reasonably necessary to provide the Platform.

The Platform is intended for persons aged eighteen (18) years and over. We do not knowingly collect personal data from minors, and we will delete any such data promptly upon becoming aware of it. Age verification measures may be applied at registration as described above.

We may update this Policy from time to time. Material changes will be notified through the Platform or by email at least fourteen (14) days before they take effect. The “Last Updated” date records the current version.

Questions, requests or complaints regarding this Policy or your personal data may be directed to our Data Protection Officer at dpo@kador2door.com or by post to Comfort District, Williamsfield P.O., support queries: support@kador2door.com. You may also contact the Office of the Information Commissioner, Jamaica.

This Policy shall be governed by and construed in accordance with the laws of Jamaica, and any disputes arising in connection with it shall be subject to the exclusive jurisdiction of the courts of Jamaica.