Privacy Policy
I Heart Travel Jamaica
Effective date: October 8, 2026
- Who we are
I Heart Travel Jamaica respects your privacy and is committed to handling personal information responsibly.
This Privacy Policy explains how I Heart Travel Ltd, registered in Canada, and I Heart Travel Jamaica, registered in Jamaica, collect, use, disclose, retain and protect personal information in connection with our accommodation, reservations, guest support, property management and related services.
In this policy, “we”, “us” and “our” refer to these businesses, individually or together as appropriate.
Each business is responsible for the personal information it controls. Where the businesses jointly determine why and how personal information is used, they share responsibility for that processing and coordinate privacy requests. You may contact our privacy team without needing to determine which business handles your information.
Our privacy contact details are:
Privacy Lead: Vanessa Richards
Data Protection Contact: Melissa Stewart
Email:
reservations@iheartja.com
Telephone: +1 876 289 4797
Mailing address: 6 Brompton Road, Kingston 6, Jamaica
Please include “Privacy Request” in the subject line of privacy-related emails.
- What this policy covers
This policy applies to personal information collected through our website and authorised booking pages, reservations, enquiries, guest stays, property management enquiries, email, telephone, WhatsApp, social media, online forms and in-person interactions.
It applies to prospective guests, booking guests, accompanying travellers, property owners, business contacts and other individuals who interact with us.
Third-party booking platforms, payment providers, social networks, property communities and independent service providers may also process information under their own privacy policies. This policy explains our handling of information and does not replace those policies.
Separate notices may apply to employment, recruitment or particular services.
- Personal information we collect
The information we collect depends on your relationship with us and the services you request.
Contact and identity information
This may include your name, email address, telephone number, mailing address, country of residence and information reasonably needed to verify your identity.
Where necessary for a booking, fraud prevention or property access, we may request identification details or a copy of a government-issued identification document. We explain the purpose when requesting it and limit collection to what is reasonably necessary.
Reservation and stay information
This may include your chosen property, travel dates, guest numbers, accompanying guest names, arrival arrangements, booking history, preferences, special requests, check-in information and communications about your stay.
Payment and transaction information
This may include billing details, amounts paid, currency, payment status, transaction references, limited payment-card information provided by our payment processor, refunds, security deposits and chargeback records.
Please do not send full payment-card numbers or card security codes through ordinary email, WhatsApp or our chatbot. Use the payment method provided through the booking process.
Communications and feedback
We may collect messages, attachments, enquiry details, complaints, support requests, survey responses and reviews.
If we introduce call recording, we will provide notice and obtain consent where required before recording.
Property owner and business information
For property management enquiries and services, we may collect ownership and property details, business contact information, contract records and payment or tax information necessary for the relationship.
Technical information
Our website and service providers may collect IP addresses, browser and device information, approximate location inferred from an IP address, access times, pages viewed, referring websites, cookie identifiers and interactions with website features.
Technical information can constitute personal information when it identifies you or can reasonably be linked to you.
Sensitive information
You may choose to tell us about accessibility requirements, allergies, health-related needs or other sensitive circumstances relevant to your stay.
Please provide only what is necessary. We use this information for the relevant request or another lawful purpose and obtain explicit consent where required.
- Where information comes from
We collect information directly from you and, where relevant, from:
The person making a reservation on your behalf.
Booking platforms and travel partners through which you arrange a stay.
Payment processors and fraud prevention providers.
Property owners, authorised property personnel and service providers involved in your reservation.
Your interactions with our website, communications and social media.
Public sources where reasonably necessary for business verification or fraud prevention.
If you provide another person’s information, please ensure you are authorised to do so, explain why it is being provided and share this policy with them. Obtain their consent where required.
- Why we use personal information
We use personal information for the following purposes:
Responding to enquiries and helping you select services.
Creating, administering and fulfilling reservations.
Processing payments, refunds, security deposits and transaction disputes.
Verifying identity and arranging authorised property access.
Providing arrival instructions, guest support and requested services.
Communicating about bookings, changes, safety issues and service interruptions.
Coordinating cleaning, maintenance, property management and guest assistance.
Handling complaints, incidents, damage claims and insurance matters.
Preventing fraud, unauthorised access and misuse of our services.
Maintaining business, accounting and tax records.
Operating, securing and improving our website and services.
Sending marketing communications where permitted.
Complying with legal obligations and establishing, exercising or defending legal claims.
We do not treat acceptance of this policy as permission to use information for every possible purpose.
- Legal grounds and consent
We collect and use personal information with consent where required by applicable law.
Where the applicable law permits, processing may also be necessary to perform a contract, take steps you request before entering a contract, comply with legal obligations, protect vital interests or pursue legitimate business interests.
Where we rely on legitimate interests, these may include proportionate fraud prevention, information security, service improvement and claims management. We consider the impact on your privacy and do not rely on this ground where your rights override those interests.
For information subject to European or United Kingdom data protection law, booking administration generally relies on contractual necessity, statutory records on legal obligations, and proportionate security and business administration on legitimate interests. Optional marketing and non-essential tracking rely on consent where required.
Sensitive information requires an additional legal condition where applicable, such as explicit consent.
You may withdraw consent by contacting us. Withdrawal does not invalidate processing that was lawful before withdrawal. If information is necessary to provide a requested service, withdrawing consent or declining to provide it may affect our ability to provide that service. We will explain relevant consequences.
Declining optional marketing does not prevent you from making a reservation.
- Who receives information
We disclose personal information only where reasonably necessary for the purposes described in this policy or otherwise permitted by law.
Our businesses and authorised team
Relevant personnel may access information needed for their responsibilities, including reservations, guest support, operations, property care, finance and privacy administration.
Property owners and property personnel
We may share necessary reservation, occupancy, access, maintenance or incident information with the relevant owner, manager, security personnel or community administration.
Access requirements differ between properties. We aim to explain identification requirements before arrival and limit disclosures to what is needed.
Technology and payment providers
We use providers such as Hostaway for booking and property management functions, Stripe for payment services, and WhatsApp for communications.
Other providers may supply website hosting, email, data storage, security, accounting and customer support functions.
These organisations may act as processors on our behalf, independent controllers for their own lawful purposes, or both, depending on the service.
Legacy booking systems
Information associated with earlier bookings may remain in previous systems, including Guesty where applicable, while necessary records are migrated, reconciled or retained for lawful purposes. Migration does not justify indefinite retention or unrelated use.
Requested service providers
Where you request transfers, drivers, yacht experiences, catering or other services, we may share the information reasonably necessary to arrange them. Independent providers are responsible for their own processing.
Professional advisers and authorities
We may disclose information to insurers, legal advisers, accountants, auditors, regulators, courts and law enforcement where necessary and lawful.
Business transactions
Information may be disclosed in connection with a proposed or completed restructuring, sale or transfer of business operations, subject to appropriate confidentiality and legal safeguards.
- International processing
Our operations and service providers may involve processing outside your country of residence, including in Jamaica, Canada, the United States and European countries.
The countries involved depend on the service, provider and its authorised subcontractors. Your residence does not necessarily determine where your information is stored.
Information processed abroad may be subject to lawful access by courts, regulators or other authorities in those countries.
We assess international transfers and apply the safeguards required by the law governing the information. These may include adequacy arrangements, appropriate contractual protections and other lawful transfer mechanisms.
Where European or United Kingdom transfer rules apply, we use a permitted transfer mechanism and additional safeguards where required. Where Jamaican transfer rules apply, we assess the applicable protection requirements or permitted statutory exceptions.
Contact us for information about the transfer arrangements relevant to your information and available copies or descriptions of safeguards, subject to legitimate confidentiality restrictions.
- Cookies and similar technologies
Our website and booking pages use cookies and similar technologies to support website functionality and, where enabled, preferences, analytics and marketing.
Essential technologies support functions such as security, booking sessions and payment processing.
Preference technologies remember choices you make.
Analytics technologies help measure website use and performance.
Marketing technologies, if enabled, may measure campaigns or support advertising.
Where consent is required, non-essential technologies should operate only after you make the relevant choice. You may review or change your choices through the cookie preferences control on our Hostaway-powered website or booking pages.
Browser settings may also allow you to block or delete cookies. Blocking essential cookies may affect booking functionality.
The cookie notice and preference panel should identify the technologies actually in use, their providers, purposes and durations. These may change when website features or integrations change.
- Marketing and advertising choices
We send promotional communications only where we have the consent or other permission required by applicable law.
You may unsubscribe through the link in a marketing email or contact us using the details in this policy. For marketing messages sent through other channels, you may ask us to stop through that channel.
We process opt-out requests promptly and within applicable legal deadlines.
We may continue sending necessary booking, payment, safety and service communications after you opt out of marketing.
If advertising technologies are used, disclosures may qualify as a “sale”, “sharing” or targeted advertising under particular privacy laws even when no money changes hands. Where those laws apply, we provide the required notice and choices and honour legally required opt-out preference signals.
- Artificial intelligence and chatbots
We use AI-assisted tools, including features available through Hostaway and chatbot services, to support enquiries, communication and service administration.
These tools may process the messages you submit and relevant booking information needed for the task. Depending on the feature, information may be processed by the platform and its authorised AI service providers.
Please do not enter payment-card security codes, identification documents, unnecessary health information or other highly sensitive information into a chatbot.
AI-generated responses may contain errors. Contact our team to confirm important booking, payment, cancellation or special-request information.
You may ask to speak with a team member.
Where applicable law gives you rights relating to decisions made solely by automated means that have legal or similarly significant effects, we will provide the required information and safeguards, including human review where required.
- Property security and monitoring
Some properties or surrounding communities may have security cameras, access-control systems or security personnel.
Applicable property information and notices should explain relevant monitoring, including its location and purpose. Monitoring must respect private spaces and applicable law.
Where we control security information, we use it for appropriate security, access, incident investigation and legal purposes.
Where a property owner or community organisation independently controls a system, its own privacy arrangements may apply. Contact us if you need help identifying the responsible organisation.
- How long we retain information
We retain personal information for the period reasonably necessary for its purpose, subject to legal requirements and justified exceptions.
Our standard retention periods are:
Booking contracts, essential transaction records, invoices and accounting records: six years after the end of the relevant financial year, unless a different legal period applies.
Routine guest messages and support records: up to two years after checkout or resolution of the enquiry. Material relating to a dispute or accounting obligation may be retained with the relevant record.
Enquiries that do not result in a booking or business relationship: up to twelve months after the last substantive contact.
Copies of identification documents collected solely for check-in or verification: normally deleted within thirty days after checkout or completion of verification, whichever is later, unless a specific legal or documented dispute-related reason requires longer retention. A limited verification record may be retained separately where necessary.
Sensitive information supplied for a particular stay: normally deleted within thirty days after checkout once the request has been completed, unless a lawful reason requires longer retention.
Routine security footage under our control: normally retained for no more than thirty days, unless needed to investigate an incident or meet a legal obligation.
Technical security logs under our control: normally retained for up to ninety days unless an incident or identified security requirement justifies longer retention.
Marketing contact information: retained while we have a valid basis to contact you, with periodic review. Limited suppression information may be retained to ensure that we respect an unsubscribe request.
Privacy requests and complaint records: up to three years after closure, unless a different legal requirement or ongoing dispute justifies longer retention.
A legal hold, unresolved claim, regulatory requirement or documented investigation may require us to preserve relevant information beyond these periods. We restrict that information to the continuing purpose.
Deleted information may remain temporarily in protected backups until the normal backup cycle overwrites it. It is not used for ordinary business purposes during that period.
Independent controllers, including payment processors and booking platforms, may apply their own lawful retention periods.
- Security and incidents
We use reasonable administrative, technical and physical safeguards appropriate to the information and the risks involved.
Our approach includes restricting access, maintaining account security, managing service-provider relationships and handling information according to staff responsibilities.
No website, communication method or storage system can guarantee absolute security. This does not reduce our legal responsibilities.
If a personal information breach occurs, we assess the incident, take appropriate containment and remedial action, and notify regulators and affected individuals where required by applicable law.
Please contact us promptly if you suspect unauthorised access to information associated with your booking.
- Your privacy rights
Depending on the law applicable to your information, you may have rights to:
Receive information about our processing.
Request access to your personal information.
Correct inaccurate or incomplete information.
Request deletion in qualifying circumstances.
Withdraw consent where processing relies on consent.
Object to certain processing, including direct marketing.
Request restrictions on processing.
Receive or transfer certain information in a portable format.
Exercise applicable rights concerning automated decisions.
Opt out of qualifying sales, sharing or targeted advertising, and limit certain uses of sensitive information where applicable.
Complain to a privacy regulator.
These rights are subject to applicable conditions and lawful exceptions. We do not unlawfully discriminate against anyone for exercising a privacy right.
Contact reservations@iheartja.com, telephone +1 876 289 4797, or write to the address above to submit a request.
We may request proportionate information to verify your identity or an authorised representative’s authority. Please do not send identification documents unless requested through an appropriate method.
We normally handle requests without charge. Any lawful exception will be explained before a charge is imposed.
We respond within the deadline required by the applicable law. This is generally thirty days for access requests under Canadian federal privacy law, one month under European and United Kingdom rules, and forty-five days for certain California requests where that law applies. Jamaican requests are handled within the applicable Jamaican deadline.
Where a lawful extension is necessary, we explain it within the required period. If we cannot fulfil a request, we explain the reason and available complaint or review options, unless prohibited by law.
- Location-specific rights and complaints
Jamaica
Where Jamaica’s Data Protection Act applies, you may exercise the rights provided by that Act and complain to the Office of the Information Commissioner.
Canada
Where Canadian privacy legislation applies, you may contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy regulator.
European Economic Area and United Kingdom
Where European or United Kingdom data protection law applies to our processing, you may complain to your competent supervisory authority, including the United Kingdom Information Commissioner’s Office where applicable.
United States
Where a state privacy law applies to our business and your information, we will provide the rights, notices, request methods and appeal procedures required by that law.
Not every privacy law applies solely because a guest lives in a particular country or state. Applicable rights depend on the law’s scope and the circumstances of processing.
You may contact a regulator directly without first making a complaint to us.
- Children’s information
Our booking services are intended for adults.
We may receive limited information about children from a parent, guardian or authorised booking adult where necessary to arrange family accommodation, occupancy, safety or requested services.
We do not require children to provide information directly for an adult’s booking and do not knowingly use children’s information for behavioural advertising.
If you believe a child has supplied information directly without appropriate authorisation, contact us so we can assess and address it.
- Reviews, photographs and public content
Information you post publicly on review platforms or social media may be visible to others under that platform’s settings.
Where we wish to use identifiable guest photographs or private feedback in our marketing, we obtain permission where required.
We do not treat information supplied privately for a reservation as permission to publish it.
Please avoid including identification documents, payment details, private contact information or other people’s sensitive information in public reviews.
- Changes to this policy
We may update this policy to reflect changes in our services, legal requirements or information practices.
The updated version will display its effective date. Where a change materially affects how we use personal information, we provide additional notice and obtain fresh consent where required.
An update does not automatically authorise an incompatible new use of information already collected.
- Contact us
For questions, privacy requests or complaints, contact:
I Heart Travel Jamaica
For I Heart Travel Ltd and I Heart Travel Jamaica
Privacy Lead: Vanessa Richards
Data Protection Contact: Melissa Stewart
Email:
reservations@iheartja.com
Telephone: +1 876 289 4797
Address: 6 Brompton Road, Kingston 6, Jamaica
