Privacy notice

This notice explains how Ovrilo Systems ("we", "us") handles personal information, in line with the Data Protection Act, 2020 (Jamaica).

There are two situations, and our role differs in each:

1. When you deal with us directly, as someone signing up, a customer's account owner, or someone contacting support, we decide how your information is used. We are the data controller.
2. When your employer uses Ovrilo, your employer decides what information about you goes in and why. Your employer is the data controller and we process it on their behalf. Our data-processing statement covers that. For questions about your employment records, contact your employer first.

What we collect when you deal with us

• Quote requests: your name, work email, phone number, company, country, number of employees and anything you tell us in the form or on a call, so our sales team can prepare a quote.
• Account details: your name, work email, company name, the workspace address you choose, and your password (stored only as a one-way hash).
• Billing details: billing contact, invoices and payment references. We don't take card details.
• Support records: notes from calls, and a record of any step-in to your workspace (who, when, why).
• Security and usage logs: IP address, browser, sign-in times, and which pages and features are used, to keep the service secure, spot misuse and show who changed what.
• Bot check: when you ask for a quote or for your workspace links, Cloudflare Turnstile checks you're not an automated script.

You don't have to give us anything, but we need a name, a work email and a company name to create a workspace, and a billing contact to invoice you; without them we can't provide the service.

• Help Centre feedback: whether a guide was helpful, any comment you leave, and searches that found nothing (not linked to your name).

Why we use it, and our lawful basis

Purpose	Lawful basis
Creating and running your workspace	Performing our contract with your company
Billing and keeping financial records	Contract, and legal obligation
Support and step-ins	Contract, and your permission at the time
Security, preventing abuse, fixing problems	Our legitimate interests in a safe, working service
Service emails (security alerts, invoices, changes to terms)	Contract and legitimate interests

We don't sell personal information, we don't use it for advertising, and we don't send marketing emails. The emails we send are about your account: sign-in and security, invoices, the notifications you choose, and changes to these terms.

Who we share it with

Only with service providers that help us run Ovrilo, under contracts that require them to protect it:

• Hosting: [VPS hosting provider]
• Off-site backups: Cloudflare R2, which encrypts everything it stores
• Email delivery: [email delivery provider]
• Bot check on public forms: Cloudflare Turnstile
• Map tiles (only on the Locations settings page, for admins): OpenStreetMap, which sees the viewer's IP address
• Browser push notifications (only if you turn them on): your browser's push service (Apple, Google or Mozilla), which receives the encrypted message, not its contents

We may also disclose information where the law requires it. Our current list of providers is in the data-processing statement.

Where it's stored

Our servers and backups may be outside Jamaica. Where information leaves Jamaica, we only use providers in places with adequate protection or under contractual safeguards, as the Act requires.

How long we keep it

• Account and workspace data: while the workspace is active, then 90 days after it's closed, when the database, files, backups and encryption keys are deleted.
• Security logs with IP addresses: as long as the workspace exists, as part of the activity record.
• Invoices and payment records: 7 years, for tax and accounting.
• Notifications: 12 months.
• Activity and audit logs (who did what, and support step-ins): as long as the workspace exists, because they're part of the record of how hours and pay were decided.
• Signups that never became a workspace: deleted after 7 days.

Your rights

Under the Data Protection Act you can:

• ask for a copy of the personal information we hold about you, and how we use it;
• ask us to correct anything inaccurate;
• object to processing, including direct marketing, and ask us to stop;
• ask that decisions about you aren't made solely by automated means;
• withdraw consent where we rely on it.

To use these rights, email dpo@ovrilosystems.com. We'll reply within 30 days, or within 21 days if you object to processing. If you're unhappy with our answer, you can complain to the Information Commissioner (Office of the Information Commissioner, Jamaica).

Security

Each workspace has its own database and its own encryption keys. Contact details, identifiers, dates of birth and pay rates are encrypted with the workspace's key; uploaded files are kept on a private disk and can only be opened through Ovrilo by people allowed to see them; connections are encrypted in transit; staff access is limited, protected with two-factor authentication or passkeys, and logged.

Found a security problem in Ovrilo? Email security@ovrilosystems.com, and please give us a chance to fix it before telling anyone else.

If personal information is lost, misused or reached by someone who shouldn't have it, or if we find we've broken one of the Act's data protection standards, we'll report it to the Information Commissioner within 72 hours of becoming aware of it, and tell each person affected (and, for workspace data, the customer) as the Act requires.

Cookies

We only use the cookies Ovrilo needs to work: one that keeps you signed in, one that protects forms from forgery, which workspaces you've signed in to on this device (for the sign-in page), and your display preferences. No analytics or advertising cookies.

Our data protection officer

[name of the data protection officer], dpo@ovrilosystems.com

Changes

We'll post changes here and update the date at the top. If a change matters, we'll tell account owners by email.