01 Introduction
Michelle Thomas & Associates (“MTA”, “the Firm”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of personal data entrusted to it by clients, prospective clients, employees, business associates and other individuals. This Policy explains how we collect, use, store, disclose, transfer, retain and dispose of personal data in connection with our legal practice and operations, including our branches, website and authorized digital channels. We seek to comply with Jamaica’s Data Protection Act, 2020 and other applicable legal and professional obligations.
02 Definitions
Personal Data means information relating to an identified or identifiable living individual. Sensitive Personal Data means categories of information requiring enhanced protection under applicable law. Data Subject means the individual to whom personal data relates. Data Controller means the person determining the purposes and means of processing. Data Processor means a person processing data on behalf of a controller. Processing includes collecting, recording, storing, using, disclosing, altering and deleting personal data.
03 Responsibility
MTA acts as a data controller where it determines the purposes and means of processing personal data. The Principal Attorney and designated compliance personnel oversee this Policy. Attorneys, paralegals, employees, consultants, contractors and authorized agents must respect confidentiality and applicable data protection obligations. We have appointed a Data Protection Officer. Contact details are listed at the end of this Policy.
04 Personal Data Collected
We may collect identification and contact details (names, dates of birth, addresses, telephone numbers, emails, TRNs, passports and identification); financial information (bank details, income, assets, source of funds, payment records and tax information); legal and professional records (instructions, contracts, court documents, title documents, wills, estate papers, company records, employment records and witness information); and information relevant to litigation, family matters or regulatory compliance. Where necessary and lawful, we may process sensitive information, including medical or criminal-history information. We may collect digital and communications information, including website enquiries, appointment details and electronic correspondence. We aim to collect only information reasonably necessary for legitimate purposes.
05 How Information Is Collected
We receive personal data through consultations, client onboarding, electronic forms, telephone calls, emails, authorized messaging platforms, documents supplied by clients. We may also receive information from your representatives or authorized agents, court records, government authorities, financial institutions, professional advisers and other lawful sources. Information received from third parties will be handled in accordance with applicable law.
06 Purposes of Processing
We process personal data to provide legal advice and representation and prepare legal documents. We use it to handle conveyancing, probate, civil litigation, criminal, family and other legal matters. We also use personal data to administer client files and billing, verify identity and beneficial ownership, and meet anti-money laundering and other regulatory duties. We use it to pursue or defend legal rights, maintain office and system security, communicate case updates and appointment reminders, and send professional updates.
07 Lawful Basis
Processing will be supported by an appropriate lawful basis, as applicable, including consent, performance of a contract, compliance with legal obligations, establishment or defence of legal rights, legitimate interests where permitted, or another ground recognized by law. Consent is not the sole basis for all processing. Additional safeguards or explicit consent will be used where required.
08 Confidentiality and Privilege
MTA recognizes the confidentiality of the attorney-client relationship and applicable legal professional privilege. Client information is disclosed only where authorized, legally required or otherwise permitted under applicable professional and legal obligations. Nothing in this Policy waives legal professional privilege.
09 Disclosure and Sharing
Where necessary and legally permissible, personal data may be shared with courts, tribunals, government authorities, regulators, law enforcement agencies, tax authorities, registries, financial institutions, counsel, mediators, arbitrators, experts, surveyors, valuers, accountants, insurers, IT and software providers, document storage services, couriers and other parties involved in delivering legal services. Appropriate confidentiality and security safeguards will be applied, including contractual protections for processors where required.
10 Client Due Diligence and AML
MTA may collect identification, proof of address, beneficial ownership, source-of-funds and transaction information to meet applicable obligations under the Proceeds of Crime Act and anti-money laundering or counter-terrorism financing requirements. Failure to provide required information may prevent us from accepting or continuing instructions. Where legally required, reports may be made to competent authorities subject to applicable confidentiality and non-disclosure rules.
11 Electronic Communications
We may use email, telephone, video meetings, electronic document platforms and authorized messaging applications. Electronic communications carry risks including interception and unauthorized access. We use reasonable safeguards and may require secure file-sharing or additional verification for sensitive matters. Clients should protect devices and promptly report suspected compromise.
12 Security
We implement reasonable technical, administrative and organizational safeguards, which may include password protection, role-based access, secure file storage, backups, confidentiality requirements, cybersecurity protections, staff training and secure disposal. Safeguards are reviewed as appropriate. No system is completely risk-free, but MTA remains responsible for meeting applicable statutory and professional duties.
13 Personal Data Breaches
We will investigate, contain, document and address actual or suspected personal data breaches. Where required by applicable law, we will notify the appropriate authority and affected individuals within the prescribed periods and take appropriate corrective measures.
14 International Transfers
Personal data may need to be transferred outside Jamaica for cross-border matters, overseas counsel, financial transactions, foreign authorities or cloud-based systems. Such transfers will be carried out in accordance with applicable Jamaican data protection law, using appropriate safeguards and consent where legally required. International transfer does not eliminate the Firm’s applicable obligations.
15 Retention and Disposal
We retain personal data for as long as reasonably necessary for the relevant matter and applicable legal, professional, regulatory and contractual requirements. As a general administrative policy, closed client files may be retained for up to ten (10) years after completion or termination, subject to different periods where justified or required. Original instruments, estate and trust records, and documents subject to litigation holds may require special arrangements. After the applicable period, information may be securely destroyed, deleted or anonymized.
16 Data Subject Rights
Subject to applicable law and exemptions, individuals may request access to their personal data, correction of inaccuracies, deletion where legally available, objection to certain processing, withdrawal of consent where consent is relied upon, and exercise rights concerning applicable automated decision-making. Some requests may be restricted by legal privilege, statutory retention requirements, confidentiality or litigation obligations.
17 Rights Requests
Requests for access, correction, deletion or other statutory rights may be submitted in writing to MTA. We may seek reasonable verification of identity and authority and will respond within applicable statutory timeframes. Where a request is refused or limited, we will explain the position where lawful.
18 Third-party Information
Clients may supply information about employees, relatives, beneficiaries, witnesses, directors or other individuals. Clients should ensure that such information is obtained and disclosed lawfully and provide relevant notices where appropriate. MTA remains responsible for its own obligations when processing third-party personal data.
19 Children’s Information
Where matters concern minors, including guardianship, family proceedings or estate administration, children’s personal data will be handled with appropriate care and safeguards. Authorization from a parent, guardian or legally authorized person will be obtained where required.
20 Client Responsibilities
Clients should supply accurate information, notify us of material changes, protect confidential correspondence and electronic credentials, avoid insecure transmission of sensitive records and report suspected unauthorized access promptly. These expectations do not displace MTA’s legal responsibilities.
21 Website and Cookies
Our website or online platforms may collect technical information and use cookies or similar technologies for functionality, security and performance. Where required, we will provide information and choices regarding non-essential tracking. MTA does not sell client personal data for commercial marketing.
22 Third-party Websites
Links in our website or communications may lead to independent websites. Their privacy practices are governed by their own notices, and users should review those notices before submitting information.
23 Policy Changes
We may update this Policy to reflect changes in law, technology, regulatory requirements or Firm operations. The current version will be available through our official channels. Where appropriate or legally required, material changes will be communicated to affected individuals.
24 Complaints
Privacy concerns may be directed to the Firm using the contact information below. We will consider complaints fairly and in a timely manner. Individuals may also have a right to complain to the Office of the Information Commissioner of Jamaica under applicable law.
25 Contact Information
MICHELLE THOMAS & ASSOCIATES — Attorneys-at-Law
- Principal Attorney
- Michelle Thomas
- Data Protection Contact
- Michelle Thomas Nelson
- Principal Office Address
- Shop 26E, Boulevard Supercentre, 45 Elma Crescent, Kingston 20, Jamaica
- Telephone
- 876-451-1111
- Website
- michellethomaslaw.com