Privacy Policy

1. Who we are

BP Couriers ("BP Couriers", "we", "us", "our") is a courier and last-mile logistics service operating in Jamaica. For the purposes of the Data Protection Act, 2020 we are the data controller of the personal data you provide when you use our services.

You can reach our data protection contact at global.jsuprememarketing@gmail.com.

2. What we collect

2.1 Account information

• Name, email address, phone number, profile photo (where provided)
• Authentication tokens issued by our identity provider (Clerk)
• Business name and trading address (for business accounts)

2.2 Delivery data

• Pickup and drop-off addresses, recipient names and phone numbers
• Parcel description, weight, dimensions, fragility flags, photos
• Scheduled pickup time, service tier, internal notes
• Geolocation data captured during driver pickup / drop-off events
• Proof-of-delivery photo and signature

2.3 Payment data

We do not store full card numbers. Payments are processed by Stripe (a PCI-DSS Level 1 certified payment processor). We retain a payment reference, last 4 digits, currency, amount, and Stripe charge identifier so we can reconcile refunds and respond to disputes.

2.4 Device and usage data

• IP address, browser type, operating system, device identifiers
• Pages visited, features used, error logs (Sentry)
• Cookies and similar technologies — see our Cookie Policy

3. Why we use it (lawful basis)

We process personal data on the lawful bases set out in §16 of the DPA:

• Contract — to provide the delivery service you booked (matching driver, navigation, status updates, billing)
• Legal obligation — tax records, business registration compliance, sanctions screening
• Legitimate interest — fraud prevention, service improvement, security monitoring, dispute resolution
• Consent — non-essential cookies, marketing emails (you can withdraw consent at any time)

4. Who we share it with

We share the minimum data required with the following categories of recipient:

• The assigned driver — name, phone number, pickup & drop-off address, parcel description and any delivery notes
• Recipients — your name and tracking link via SMS / email notifications, where applicable
• Service providers (sub-processors) — Clerk (identity), Supabase (database / storage), Stripe (payments), Resend (transactional email), Twilio (SMS), Mapbox (geocoding), Vercel (hosting), Sentry (error monitoring), Upstash (queue). Each is bound by a Data Processing Agreement.
• B2B partners — where you book through a partner's system, we share data necessary to fulfil and reconcile the delivery
• Law enforcement — only when compelled by a valid Jamaican court order or law-enforcement request

We do not sell your personal data, and we do not use it for any advertising-profiling purpose.

5. International transfers

Some of our processors store data outside Jamaica (United States, European Union). When that happens, we rely on contractual safeguards (the EU Standard Contractual Clauses or equivalent) and require the processor to match the protection standards of the DPA.

6. How long we keep it

• Active account data — for as long as you have an account with us
• Delivery records — 7 years from delivery (tax / dispute window)
• Payment receipts — 7 years (Jamaican Income Tax Act)
• Marketing data — until you withdraw consent
• Server logs / Sentry events — 90 days, then aggregated or deleted

7. Your rights under the DPA

You have the right to:

• Be informed about how we use your data (this policy)
• Access the data we hold on you
• Correct inaccurate or incomplete data
• Erase your data (where we have no overriding legal basis)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw any consent you previously gave
• Complain to the Information Commissioner of Jamaica if you believe we've mishandled your data

To exercise any of these rights, email global.jsuprememarketing@gmail.com. We'll respond within 30 days. You can also delete your account directly from your dashboard.

8. Security

We use TLS in transit, encryption at rest for the database, role-based access controls, two-factor authentication on staff accounts, audit logging of every admin action, and regular dependency security scanning. Despite these measures, no internet service can be 100% secure — if you believe an unauthorised party has accessed your account, contact us immediately.

9. Children

BP Couriers is not intended for children under 16. We do not knowingly collect personal data from anyone under that age. If you believe we have, please contact us so we can remove it.

10. Changes to this policy

We may update this policy from time to time. When we make a material change we'll update the "Last updated" date at the top of this page and notify you by email or in-app banner. Continued use of the service after changes means you accept the updated policy.

11. Your responsibilities

You are responsible for the accuracy of the information you provide, for all activity under your account, and for keeping your login credentials secure. You agree to use the service only for lawful purposes, not to ship prohibited, dangerous, infringing, or illegal items, and not to misuse, disrupt, reverse-engineer, or attempt to gain unauthorised access to the app.

12. Service provided on an as-is basis

The app and service are provided on an as-is and as-available basis, without warranties of any kind, whether express or implied, including any implied warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement. We do not warrant that the service will be uninterrupted, timely, secure, or error-free, or that any quote, estimated delivery window, tracking status, or other output will be accurate or achieved.

13. Limitation of liability

To the maximum extent permitted by law, BP Couriers and its owners, officers, employees, drivers, and partners shall not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, goodwill, or business, however caused, arising out of or relating to your use of or inability to use the service. To the maximum extent permitted by law, our total aggregate liability for all claims relating to the service shall not exceed the greater of the amount you paid us for the relevant delivery in the three (3) months before the event giving rise to the claim, or ten thousand Jamaican dollars (J$10,000). Nothing in this policy limits liability that cannot lawfully be limited.

14. Indemnity

You agree to indemnify, defend, and hold harmless BP Couriers and its representatives from and against any claims, demands, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or related to your use of the service, the items you ship, the information you submit, or your breach of this policy or of applicable law.

15. Our rights

We may add, change, suspend, or discontinue any part of the service at any time, and may refuse, suspend, or terminate any account or delivery at our discretion and without liability, including where we reasonably suspect fraud, misuse, non-payment, prohibited items, or a breach of this policy. We may use aggregated and de-identified information to operate, secure, analyse, and improve our services.

16. Governing law

This policy, and any dispute arising out of or relating to it or the service, are governed by the laws of Jamaica, and you submit to the exclusive jurisdiction of the courts of Jamaica.