3.1  The CIB will collect your personal data by means that are:

1. fair;
   
   
2. legal; and
   
   
3. transparent.
   
   

3.2 If you visit the CIB web-site, your web-browser automatically discloses, and the CIB’s web-server automatically logs, the following information:

1. the date and time;
   
   
2. the IP address from which you issued the request;
   
   
3. the type of browser and operating system you are using;
   
   
4. the URL of any page that referred you to the page;
   
   
5. the URL you requested, and whether your request was successful.
   

This data may or may not be sufficient to identify you;

3.3 Any additional data that you provide, e.g. in a web-form, may also be logged. This data may or may not be sufficient to identify you

3.4 Any additional data that your web-browser automatically provides may also be logged. This will be the case, for example, if your browser has previously been requested to store data on your computer and submits them each time you request a web-page within a particular domain. This data may or may not be sufficient to identify you.

3.5 If you disclose personal data to the CIB in conjunction with an identifier, any data that becomes available to the CIB through any of the means described in the preceding paragraphs may be able to be associated with that identifier, and hence become your personal data.

3.6 Subject to the qualifications immediately below, the CIB will collect your personal data from you and not from other parties. This is qualified as follows:

1. where the CIB reasonably considers that the protection of its financial       interests requires that it gather your personal data from other sources, or from additional sources. For example, where the CIB has a lending exposure to you, and seeks information about your creditworthiness;
   
   
2. the CIB reasonably considers that its capability to deliver quality services to you will be materially enhanced by gathering your personal data from other sources. This applies in particular to consumer profile data.
   

3.7 Where the CIB collects your personal data from sources other than you, it will:

(i) do so only by legal means;

(ii) do so only with your consent; and

(iii) declare to you what sources it uses, and under what circumstances.

3.8 The CIB will declare the purpose of collection in a manner which is clear and meaningful, and to avoid vague, highly inclusive statements such as 'to support our operations'.

4.1 The CIB will store your personal data only in Jamaica and in a manner that ensures security against unauthorized access, alteration or deletion, at a level commensurate with its sensitivity. .

4.2 The CIB will transmit your personal data in a manner that ensures security against unauthorized access, alteration or deletion, at a level commensurate with its sensitivity.

4.3 The CIB will implement appropriate measures to ensure security of your personal data against inappropriate behaviour by its staff-members and contractors. These include:

1. training for staff in relation to privacy;
   
   
2. access control, to limit access to your personal data to those staff and contractors who have legitimate reasons to access it;
   
   
3. particularly in the case of sensitive data, audit trails of accesses, including the identities of staff and contractors accessing the data;
   
   
4. reminders to staff and contractors from time to time about the importance of data privacy, and the consequences of inappropriate behaviour;
   
   

5. Data Use

Use refers to the application of your personal data by the CIB, or any staff member or contractor of the CIB in the course of their work.
The CIB will use your personal data only for:

1. the purposes for which it was collected;
   
   
2. such other purposes as are subsequently agreed between the CIB and you;
   
   
3. such additional purposes as may be required by law. In these circumstances, the CIB will take any reasonable steps available to it to communicate to you that the use has occurred, unless it is precluded from doing so by law; and
   
   
4. such additional purposes as are authorized by law (in particular to protect the CIB’s interests- for example, if it believes on reasonable grounds that you have failed to fulfill your undertakings to the CIB or have committed a breach of the law).
   

6. Data Retention and Destruction

6.1 Subject to the qualifications immediately below, the CIB will:

1. retain your personal data only as long as is consistent with its purpose;
   
   
2. destroy your personal data when its purpose has expired, and to do so in such a manner that your personal data is not subsequently capable of  being recovered.

6.2          This statement is qualified as follows:

1. your personal data may be retained in the CIB’s  logs, backups and audit    trailswithin short-term retention cycles that are devised to protect the           company's operations. In such cases, your personal data will be destroyed           in accordance with those cycles;
   
   
2. your personal data may be retained beyond the expiry of its purpose if        that is required by law, such as a provision of a statute, or a court order such as a search warrant. In these circumstances, the CIB will:
   
   
3. take any reasonable steps available to it to communicate to you                                        that your personal data is being retained, unless it is precluded                                              from doing so by law;
   
   
4. only retain your personal data while that provision is current, and will then destroy your personal data;
   
   

7. Information about Data-Handling Practices

7.1 The CIB will make information available to you about the manner in which it handles your personal data;

(i) in general terms, in a readily accessible manner;

(ii) in more specific terms, on request.

7.2 Where your personal data is disclosed to a contractor, the CIB will make    information available to you on request about the manner in which its contractors handle your personal data.

7.4 You undertake:

1. not to seek such information for frivolous purposes, or unreasonably frequently; and
   
   
2. to accept that the disclosure of excessive detail may harm the security of your personal data and the CIB’s business processes.

8. Handling of Enquiries, General Concerns and Complaints

8.1 If you have enquiries, general concerns, or complaints about these Terms, or about the CIB’s behaviour in relation to these Terms, you undertake to communicate them in the first instance: :

a) to the CIB only;

b) in sufficient detail;

c) through a channel made available by the CIB for that purpose;

 

8.2 The CIB will:

1. provide one or more channels for communications to the CIB, which are convenient to users;
   
   
2. to promptly provide acknowledgementof the receipt of communications, including the provision of a copy of the communication, the date and time  it was registered, and the CIB’s reference-code for the communication;
   
   
3. to promptly provide a response to the communication, in an appropriate and meaningful manner.
   
   

The CIB will:

not materially change these Terms in a manner that reduces the       protections for your personal data;

take all possible steps to prevent any entity or body that acquires the  CIB or any of its relevant assets from materially changing the Terms     applicable to your personal data in a manner that reduces the protections  for your personal data;

where it is considering making changes to these Terms, or creating more specific Terms relating to specific services, to consult with appropriate representative and advocacy organizations;

where it makes changes to these Terms, to ensure that the differences  between successive versions are readily accessible;

 to maintain all prior versions of these Terms in such a manner that they a  re dated, and readily accessible;

10. Definitions

10.1 “Your personal data” means data that is capable of being associated with you, whether or not it includes an explicit identifier such as your name or customer  number. In particular, it encompasses all data that the CIB is capable of correlating with you, using such means as server-logs and cookie-contents.

‘Your personal data’ does not refer to data that can no longer be associated with you. This includes aggregated data that does not and cannot identify the individuals whose data are included in the aggregation.

10.2 “Consent” means your concurrence with an action to be taken by the CIB. Consent may be express or implicit, but in either case must be informed and freely-given. .