1 | Who we are
Josiah's Digital Services ("we", "us") is a web design and development business based in Jamaica. We are responsible for the personal data described here. Contact: josiahsdigitalservices@gmail.com.
2 | What we collect and why
| Payments | Name or business name, email, invoice/project reference and amount. Used to process your payment and match it to your invoice. Card details are entered with PayPal only; we never see or store card numbers. |
| Enquiries and projects | What you send us by email: contact details, project information, content and files. Used to quote, deliver and support your project. |
| Access you give us | Hosting, domain or admin logins needed to build your site. Used only for the agreed work (see section 12 of our service agreement). |
| Website visits | We run no analytics, advertising or tracking cookies. Our host (Cloudflare) and font provider (Google Fonts) receive your IP address and browser details to deliver the page. PayPal sets its own cookies when the payment buttons load. |
We use this data to perform our contract with you, to take steps you ask for before a contract, and to meet our tax and accounting obligations.
3 | How payment data is handled
- This website has no database or server. The payment form sends your details directly to PayPal over an encrypted (HTTPS) connection. Nothing you type is saved by this website.
- To prevent accidental double payments, your browser remembers the reference, amount and PayPal transaction ID of payments made in the current tab. This stays on your device in session storage and is erased when you close the tab. It never includes your name, email or card details.
- PayPal processes payments under its own privacy statement and is certified to the PCI DSS card-security standard.
- We receive the transaction record (name, email, amount, reference, transaction ID) in our PayPal account.
- After a completed payment, our email service reads the payment back from PayPal and emails your invoice and receipt through Resend, our email delivery provider. Resend processes your name, email and payment details only to deliver that email. Our email service keeps no copy and no request logs.
4 | How long we keep it
| Invoice / receipt emails | Kept in our mailbox with the payment records. Resend keeps delivery records for a limited period under its own policy. |
| Payment and invoice records | [7] years after the end of the financial year of the transaction, as required for tax and accounting. |
| Signed contracts and project records | For the project plus [7] years after it ends, to meet legal obligations and handle any claims. |
| Enquiries that don't become projects | [12] months after our last contact. |
| Logins and access to your systems | Removed or returned at handover, or when a maintenance plan ends. |
| Duplicate-payment check in your browser | Until you close the browser tab. |
When a retention period ends we delete or anonymise the data. We review stored records at least once a year.
5 | How we protect it
- Accounts holding client data (email, PayPal, hosting, code repositories) use strong unique passwords and two-factor authentication.
- Access is limited to the people working on your project.
- Logins you share with us are kept in a password manager, not in plain email or documents.
- This website is served only over HTTPS and uses a Content Security Policy that limits which outside services can run on it.
6 | Sharing
We do not sell or rent personal data. We share it only with providers needed to run the business (PayPal, Resend for invoice emails, Cloudflare for our email service, our email provider, hosting providers you approve), with professional advisers such as accountants, or when the law requires it. Some providers store data outside Jamaica under their own security and legal terms.
7 | Your rights
Under the Data Protection Act, 2020 (Jamaica) and similar laws, you may ask to access your data, correct it, have it deleted where we no longer need it, object to or restrict its use, or receive a copy. Email us and we will respond within [30] days. Records we must keep by law (such as payment records) cannot be deleted early. You may also complain to the Office of the Information Commissioner.
8 | Data incidents
If a security incident affects your personal data, we will contain it, assess the risk, and notify you and the relevant authority without undue delay where required.
9 | Changes
We will post any changes on this page with a new effective date.
Template policy: confirm the placeholders in [brackets] and have the policy reviewed for your jurisdiction before relying on it.