1. Who We Are
Ferguson Law is a licensed law firm operating in Jamaica. We are the data controller responsible for the personal information you provide when using our website and client portal at fergusonlawja.com.
Contact us at contact@fergusonlawja.com with any privacy-related enquiries.
2. Information We Collect
We collect and process the following categories of personal information:
- Account information: Name, email address, and password when you register on the Portal.
- Identity and KYC information: Full legal name, date of birth, nationality, residential address, government-issued ID type and number, source of funds, and Politically Exposed Person (PEP) status, as required by law.
- Matter information: Documents, messages, and communications relating to your legal matter.
- Payment information: Payment amounts, method, reference numbers, and receipt records. We do not store card numbers or banking credentials.
- Usage information: Log data, browser type, and IP address collected automatically when you use the Portal.
3. How We Use Your Information
We use your personal information for the following purposes:
- To provide legal services under your retainer agreement
- To verify your identity and comply with anti-money laundering obligations under the Proceeds of Crime Act
- To communicate with you about your matter via the Portal and by email
- To process and record payments
- To maintain records as required by law and professional standards
- To operate and improve the Portal
4. Legal Basis for Processing
We process your personal information on the following legal bases:
- Contract: Processing necessary to deliver the legal services you have engaged us for.
- Legal obligation: Processing required under Jamaican law, including AML/CFT regulations, professional conduct rules, and record-keeping requirements.
- Consent: Where you have provided explicit consent, such as at account registration. You may withdraw consent at any time, though this will not affect processing already undertaken.
- Legitimate interests: Operating and securing the Portal and communicating with you about your matter.
5. Sharing Your Information
We do not sell your personal information. We may share it in the following limited circumstances:
- Service providers: We use Supabase (database and authentication) and Resend (transactional email). These providers process data on our behalf under data processing agreements.
- Legal requirements: Where required by law, court order, or regulatory authority.
- Professional obligations: Where disclosure is necessary to provide your legal services, such as to counterparties, financial institutions, or the National Land Agency in the course of a property transaction.
6. Data Retention
We retain your personal information for as long as necessary to provide legal services and to comply with our legal and professional obligations. In Jamaica, solicitors are generally required to retain client files for a minimum of seven (7) years after the conclusion of a matter. KYC records are retained for a minimum of five (5) years as required under AML legislation.
Where data is no longer required, it is securely deleted or anonymised.
7. Data Security
We take the security of your personal information seriously. The Portal uses encrypted connections (HTTPS), and your data is stored on secured servers provided by Supabase. Access to client data within the firm is restricted to authorised staff only.
No system is completely secure. If you believe your account has been compromised, contact us immediately at contact@fergusonlawja.com.
8. Your Rights
Subject to applicable law, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your information, where we are not legally required to retain it
- Withdraw consent where processing is based on consent
- Object to processing based on legitimate interests
To exercise any of these rights, contact us at contact@fergusonlawja.com. We will respond within 30 days.
9. Cookies and Tracking
The Portal uses essential session cookies to maintain your login state. We do not use advertising cookies or third-party tracking pixels. Usage data (IP address, browser type, page visits) is collected in server logs for security and operational purposes only.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to you by email or through the Portal. Continued use of the Portal after a change is posted constitutes acceptance of the updated policy.
11. International Visitors — Additional Rights by Jurisdiction
Ferguson Law serves clients in multiple countries. Depending on your country of residence, you may have additional rights under local law. In all cases you may exercise these rights by contacting us at contact@fergusonlawja.com.
- European Union & United Kingdom (EU GDPR / UK GDPR): You have the right to access, rectify, erase, restrict, and port your data, and to object to processing. You may lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or the DPC in Ireland).
- United States — California (CCPA / CPRA): California residents have the right to know what personal information we collect, to delete it, to opt out of any sale (we do not sell personal information), and to non-discrimination for exercising these rights. To submit a verified consumer request, email us with the subject "CCPA Request".
- South Africa (POPIA — Protection of Personal Information Act): You have the right to be notified of collection, access your information, correct or delete it, and to object to processing. You may also lodge a complaint with the Information Regulator (South Africa) at inforeg.org.za.
- United Arab Emirates (UAE Federal Decree-Law No. 45 of 2021): UAE residents have rights of access, correction, and deletion of personal data. We process data only for lawful purposes and do not transfer your data outside the UAE without adequate safeguards.
- India (Digital Personal Data Protection Act 2023): Indian residents have the right to access, correct, and erase personal data, to nominate a representative, and to grieve. We process data only with your consent or under a lawful purpose as defined by the Act.
- Qatar (PDPL — Law No. 13 of 2016): Qatar residents have rights of access, rectification, and objection. Personal data is processed lawfully and is not transferred internationally without adequate protections.
- Singapore (PDPA — Personal Data Protection Act 2012): Singapore residents have the right to access and correct personal data we hold. We collect only what is reasonably necessary for our purposes and retain it only for as long as legally required.
Regardless of your country of residence, we commit to: (a) collecting only what is necessary, (b) being transparent about how we use your data, (c) responding to all data requests within 30 days, and (d) never selling your personal information.