Stewart’s Auto Sales Privacy Notice

Updated 2026

Who We Are

Stewart’s Auto Sales (“SAS”) is a first-class, full-service dealership that provides automobiles, industrial equipment and automotive products in Jamaica. SAS values your trust in us and is committed to protecting your privacy and the confidentiality of your personal information.

About this Privacy Notice

This document explains who we are, what personal data we collect, why, how and where we use it, who we may share it with, and how long we keep it. It explains your rights over your personal data under The Jamaica Data Protection Act, 2020. In here, you can find the addresses for SAS and the contact details for our Data Protection Officer.

This notice applies to all processing by SAS within Jamaica for all purposes other than employment by SAS.

This privacy notice was last updated on 9^th of March 2025. It is updated frequently. If you are an active customer of SAS and we hold an email address for you, we will email you to notify you of significant updates, but you should always check this website page to ensure you are referring to the current version.

Definition of Personal Data and Sensitive Personal Data

Personal data is any information about you that is held in a way that allows you to be identified. We treat all personal data with great care and commitment to confidentiality.

Data protection and privacy laws categorise some personal data as “sensitive.” This places additional duties on us to protect it with a greater degree of care and shows that we are processing it for the right reasons. Here at SAS, we treat your financial information and other highly personal data with the utmost sensitivity and confidentiality and, of course, in full compliance with the law.

Your Rights

Your personal data belongs to you. We use it to provide products and services to you, to obey the law, and to improve our services. Whatever your relationship with us, you are entitled to the following rights over your data:

“Transparency”

You have the right to a detailed explanation of what data we have about you, how and where we use it, how long we keep it and with whom it is shared. That information is contained in the details of our data processing below.

“Access”

You have the right to a copy of the data we hold about you. We will not charge you for providing this information in electronic form; we may charge for providing it on paper in accordance with the JDPA. We may ask you to prove your identity before we release your data to you. If you want the data for a specific reason, you can help us by letting us know. Please be aware that no-one can force you to get a copy of your data, and no-one should ask you to share it with them.

“Correction”

You have the right to have your data corrected. If you believe we have incomplete, outdated or incorrect information about you, please let us know. We may ask you to provide your identity and to provide evidence supporting the changes you would like made. If you seek to exercise your right to correct your personal data and we are unable to confirm your revised information, we will retain a record of your version of the data alongside ours.

“Review of Automated Decision Making”

You have the right to a human review of decisions we have made about you by purely automated means. Please note that almost all of our decision-making is already reviewed by a person – we use automation to support our team members. You also have the right to prevent decisions being made about you based exclusively on the automated processing of your personal data.

“Prevention of Processing”

You have the right, in certain circumstances, to require us to stop processing your data. These circumstances are:

The personal data is incomplete, or irrelevant, having regard to the purpose of the processing
You believe that the processing of your data may cause you substantial harm or distress
Our processing is not justified in accordance with the law; or
We have retained your personal data for longer than the period of time required by law

“Direct Marketing”

You have the right to opt-out of direct marketing. Note that if you do not specify which marketing you no longer wish to receive, we will stop sending you all marketing information. You will need to tell us the email addresses, phone numbers and other relevant details, and you will understand that we will need to keep these details so that we can be sure not to add you back to marketing lists in error. You also, of course, have the right to opt back into marketing at any time.

“Data Portability”

In some circumstances, you have the right to ask us to transfer your data to another service provider directly. This can only be done where it is technically possible both for us and for the other service provider; we and they will let you know when this is not possible.

“Withdrawal of Consent”

Most of our processing of your data is performed for one of three reasons:

in service of a contract between you and us, or in order to enter into such a contract;
to comply with legal obligations placed on us by the government and our regulators; or
to help us improve our services by better understanding our customers and their needs.

However, in some cases we will ask you for your consent to process your data. Where we have done so, you have the right to withdraw your consent at any time and we will stop processing. We will explain the consequences of withdrawing consent at the time we ask for it and when you ask to withdraw it.

If you would like to know more about our processing of your data or would like to exercise any of your Rights, you can email us at dpo@stewartsautomotivegroup.com.

You can also write to us at:

Data Protection Officer
49 ½ South Camp Road

Kingston 4

Jamaica
Tel: 876-928-5041

Data protection law

The data protection law in Jamaica is the Data Protection Act of 2020. This Act defines sensitive personal data as information on a person’s:

Genetic or biometric data;
Filiation, racial or ethnic origin;
Political opinions, philosophical beliefs;
Religious beliefs or other beliefs of a similar nature;
Membership in any trade union;
Physical, mental health or condition;
Sex life;
The alleged commission of any offence by the data subject or any proceedings for any offence alleged to have been committed by the data subject.

Jamaica does not include financial records in the definition of sensitive data but we at SAS will continue to treat your financial information in the strictest confidence and share it internally and externally only as needed to meet our contractual and service obligations to you and to comply with the law.

If you are not satisfied with SAS’s response to any enquiry or complaint you make to us, you have the right to lodge a formal complaint with the Office of the Information Commissioner of Jamaica, whose contact details are as follows:

Office of the Information Commissioner

The Masonic Building (2nd Floor)

45-47 Barbados Avenue

Kingston 5

Tel: +1 (876) 920-4390 or Email: info@oic.gov.jm

Laws requiring the processing of personal data

The list below is constantly under review and will be updated as the law changes and as we identify processing which we are legally obliged to conduct. If you would like more information about our processing on the basis of legal obligation, please contact dpo@stewartsautomotivegroup.com with your query.

Category	Legislation	Regulator
Data protection	Data Protection Act of 2020	Office of the Information Commissioner
Special Economic Zone		Jamaica Special Economic Zone Authority

Details of our Data Processing

Types and sources of information that we may collect

The information that we collect and process varies depending on the context. Each section below lists the categories of information that we may collect for the purposes listed. To understand which categories we collect and process about you, please refer to the details of processing for the specific products, services or circumstances that apply to you. The categories are as follows:

Categories and Examples of data collected

Category	Examples of data collected
Browser data	Details provided by your computer or phone when using an app or internet browser including IP address and technical information about your device.
Call recordings	Audio and video recordings of inbound and outbound telephone and video conference calls.
CCTV	Video recordings collected by cameras installed at our premises which may capture public areas surrounding our buildings as well as interior space.
Contact and demographic information	Your name, address, contact information such as telephone number, email address, social media details; your date of birth, marital status and gender. We will also collect your signature or other authorisation in various contexts.
Cookies	Small files placed on your computer or phone by us or third parties which are used to store information as part of delivering our website, app or services and to identify you during and between sessions.
Employment information	Your employment status and the name of your employer as part of a concession agreement.
Financial information	Your financial status, including credit score and references, assets and liabilities, income and outgoings; credit card and bank details for making and receiving payments; transactional information including claims, specific payments and receipts as well as ongoing payment obligations and receipt entitlements.
Government-issued identification	Identity card or driver’s licence details, passport details, tax or other unique identifying reference numbers.
Vehicle information	Vehicle make and model, value, ownership, method of purchase and amounts owing, insurance status, registration mark or number, VIN.
Criminal records	Any record of a criminal offence of which you have been suspected, accused, tried or convicted.

The examples given above are not exhaustive list; please contact us if you would like a complete list of the data, we may hold about you.

Processing under Legal Obligation

In many instances, we collect and process personal data because we are obliged by law. The laws that require this processing will vary by context. To simplify the detailed information below, we have listed the key relevant laws. The legal landscape is continually evolving and some processing will be required by more than one piece of legislation; the lists in this notice are not intended to be exhaustive.

Data Sharing

With your consent we may share your contact details and relevant vehicle and service information with manufacturers or suppliers. These manufacturers or suppliers may use this information for product and service planning, client satisfaction measurement, marketing and market research. We will not share your information for the purposes of marketing without your prior consent.

Like most modern companies, SAS uses a number of technology, and service partners, manufacturers and suppliers to enable our services and products. Because of the breadth and complexity of our services, it is not possible to provide a list of these partners in this notice; if you would like a list of the partners with whom your personal data is shared, please contact us.

We may be required to share your personal data with government entities. If you would like a list of the government entities with whom your data has been shared on this basis, please contact us.

We may also share your data with other parties such as financial institutions upon your request and with your consent. If you would like a list of the other parties with whom your data has been shared on this basis, please contact us.

Transfers of data to other countries

We transfer your personal data to other countries as required to enable the monitoring of vehicle performance, service delivery and administering warranty related services. We conduct careful due diligence on all data sharing partners and ensure that appropriate protections are in place to keep your personal data secure. These transfers are protected by binding agreements that include standard contractual clauses setting out the obligations of the sending and receiving parties and the safeguards, including specific technological measures, that must be applied. If you would like more information on our transfers and safeguards (including a list of the partners and countries) as they apply to you, please contact us.

Specifics of Processing

General Website Visitors

Purposes of processing

When you visit our website, we process your data for the following purposes, and under the following lawful bases:

To deliver the website, manage and analyse traffic and protect us against digital risks.
- Legitimate interest
To place cookies on your device
- Consent
When you ask to find out more about us and our products
- Consent
When you contact us or book an appointment
- Consent

The categories of personal data we collect and process

We currently collect the following categories of data when you use our website:

Browser data
Cookies
Contact and demographic information if you ask for more information, contact us or book an appointment

Retention of data

We do not retain browser data and cookies from the website. The cookies will be deleted once you end your session by closing your browser. Personal data relating to requests for information and appointments will be retained for 90 Days following the date of collection or your last interaction with us, whichever is later.

Sharing your personal data with third parties

We share your data with our technology and service partners.

CCTV

Purpose of processing

We operate recorded CCTV systems at our physical locations. If you visit us, or come within the field of view of our cameras, we process your data for the following purposes, and under the following lawful bases:

Prevention and detection of crime
- Legitimate interest
Health and safety
- Legal obligation and legitimate interest

The categories of personal data we collect and process

We currently collect the following categories of data:

CCTV footage

Retention of data

We will keep recordings which may include your personal data for a period of 90 days, unless an incident is suspected, in which case the recording may be required for further investigation for a period of up to 180 days. However, we may be required to retain these recordings for a longer period provided that there is a legal obligation to do so.

Sharing your personal data with third parties

We share your data with the following third parties only if required to do so by law:

Our technology and service partners
Law enforcement, if required
Government entities, if required

Motor Vehicle Sales

Purpose of processing

In order to facilitate the purchase of a motor vehicle, we process your data for the following purposes, and under the following lawful bases:

To facilitate the performance of a contract we have entered into with you.
- Performance of a contract
To make and receive payments
- Performance of a contract
To detect, prevent and investigate fraud
- Legal obligation and our legitimate interest
To assess and improve business performance
- Legitimate interest
To comply with legal obligations
- Legal obligation
To provide online services
- Performance of a contract, legitimate interest and consent for cookies
For the purposes of direct marketing
- Legitimate interest (selection and profiling) and consent (contact)
To provide vehicle sales, services and test drives.
- Performance of a contract
To carry out customer satisfaction surveys and service quality monitoring
- Consent
To plan our distribution and after-sales strategies
- Legitimate interest
To provide warranty services
- Performance of a contract

The categories of personal data we collect and process

Contact and demographic information
Government-issued identification
Employment information
Filiation Information
Financial information
Interests and preferences
Marketing and communication preferences

Retention of data

We will keep at least some of your personal data for a period of 7 years following the expiration of our relationship or the end of the warranty period whichever is later. If for any reason we collect your data, but no policy is put in place for you, we will retain at least some of your data for 7 years from the date on which a final decision not to proceed was taken. We retain this data to comply with our regulatory obligations and to provide for legal claims; any data that is not needed for these purposes will be deleted immediately on termination of your policy or at the moment that a final decision not to proceed is taken.

Sharing your personal data with third parties

We share your data with the following third parties:

Our technology and service partners
Our suppliers, contractors and partnering manufacturers
Our regulators
Other entities and affiliates within our Group

Job Applicants

Purposes of processing

If you apply for employment with SAS, we process your data for the following purposes, and under the following lawful bases:

In order to assess suitability for a role with SAS
- Performance of a contract
Due diligence, including Criminal Background checks
- Steps to enter into a contract and consent
To detect, prevent and investigate fraud
- Legal obligation and our legitimate interest
To report to regulators
- Legal obligation
To provide online services
- Performance of a contract, legitimate interest and consent for cookies

Retention of data

We will keep your personal data if you are a successful applicant in line with the Employee Privacy Notice retention period. If you are an unsuccessful applicant, we will retain some of your personal data for up to 6 months from the date of your last application. We will only retain your personal data for more than 6 months if you give us consent to do so in circumstances such as for example, where you permit us to keep your information for consideration for other available vacancies that may arise periodically.

Sharing your personal data with third parties

We share your data with the following third parties:

Our technology and service partners
Our regulators
Other entities and affiliates within our Group