JT Group Limited – Data Protection Notice
This is the data protection notice referred to in the various JT Terms and Conditions applicable to our products and services (the “Conditions“). Terms defined in the relevant Conditions shall have the same meaning in this notice unless otherwise defined in this notice.
This notice applies to any natural person (a “data subject” or “you“) entering into a Contract with JT (“we” or “us“) or in relation to whom JT receives personal information in relation to a Contract. We may update this notice at any time.
JT is a ‘data controller’. This means that we are responsible for deciding how we hold and use personal information about you. We are required under the Data Protection (Jersey) Law 2018 and the Data Protection (Bailiwick of Guernsey) Law 2017 (as applicable, the “Data Protection Laws“) to notify you of the information contained in this notice.
It is important that you read this notice, together with any other data protection notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
JT will process your personal information on the following legal bases:
- it is necessary for the performance of a contract to which you are a party (the “contractual necessity” basis);
- it is necessary for compliance with a legal obligation (other than a contract) to which JT is subject (the “legal obligation” basis);
- it is necessary for the purpose of legitimate interests (the “legitimate interests” basis) pursued by JT or a third party provided your interests and fundamental rights do not override those interests;
- if it is necessary to protect vital interests (life and limb) of the data subject or another person (the “vital interests” basis); or
- if it is necessary for any legal proceedings, obtaining legal advice or establishing, exercising or defending legal rights (the “legal proceedings” basis).
The purposes for which (and, in parentheses, the relevant legal bases on which) JT shall process your personal information in relation to the Contract are as follows:
- performing the Contract and providing the Service (legitimate interests and, where the data subject is a party to the Contract, contractual necessity);
- dealing with complaints or enquiries in relation to the use of the Service (legitimate interests);
- assisting the emergency services in an emergency (legitimate interests and, in some circumstances, vital interests);
- debt collection, credit referencing and preventing fraud, theft and other unlawful activity (legitimate interests); and
- compliance with applicable law or orders of a court or other body of competent jurisdiction (legal obligation).
Some of the above bases for processing will overlap and there may be several bases which justify the use of your personal information. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
If you fail to provide certain information when requested, we may not be able to perform our obligations under the Contract and we may be prevented from complying with our legal obligations. In such circumstances, JT may suspend the Service and/or terminate the Contract.
JT may disclose your personal information to members of the JT Group. JT may also disclose it to external third parties, to include: partners, suppliers, sub-contractors or agents engaged by JT for the purpose of performing the Contract and providing the Service; other parties engaged to perform services for, or on behalf of, JT; persons making a complaint or an enquiry in relation to the use of the Service; the emergency services (if you make an emergency call), including your approximate location; other communications service providers and network operators; credit reference and debt collection agencies; appropriate authorities for the purpose of preventing fraud, theft and other unlawful activity; and commercial partners for joint promotions with that third party. JT may also be required to share your personal information with a third party or body in circumstances where such disclosure is required to satisfy any applicable law or regulatory requirements. Disclosures to law enforcement agencies, regulatory organisations, government bodies or agencies, courts or other public authorities may occur if JT is authorised, or is required, by law to do so. If there is a change (or expected change) in who owns JT or any of JT’s assets, JT might also share personal information to the new (or prospective) owner. If JT does, that party will have to keep the shared information confidential.
JT may need to transfer your personal information to a jurisdiction that is outside of Jersey, Guernsey and the European Economic Area (“EEA”). The EEA consists of countries in the European Union, Switzerland, Iceland, Liechtenstein and Norway: they are considered to have equivalent laws when it comes to data protection and privacy. The laws of the Bailiwicks of Jersey and Guernsey have been deemed “adequate” for the purposes of EU data protection standards. This kind of data transfer may happen if, for example, a member of JT’s Group, a JT supplier or a service provider is based outside Jersey, Guernsey and the EEA, or if you use JT’s services and products while visiting countries outside these jurisdictions. If JT sends your information to a jurisdiction that is not in the EEA or the Channel Islands, JT will make sure that your information is properly protected. JT will also ensure that there is a legal agreement that covers the data transfer. In addition, if the country is not considered to have laws that are equivalent to EU data protection standards then we will ask the third party to enter into a legal agreement that reflects those standards.
JT will store your personal information for no more than 6 years after your Contract has ended.
Under the Data Protection Laws, you will have the right in certain circumstances to:
- request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information held about you and to check that it is being lawfully processed;
- request correction of your personal information. This enables you to have any incomplete or inaccurate information held about you corrected;
- request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You will also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
- object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;
- request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it; and
- request the transfer of your personal information to another party.
If you wish to review, verify, correct or request erasure of your personal information, object to the processing of your personal information, or request the transfer of your personal information to another party, you should contact JT in writing. JT has appointed a data protection officer who may be contacted at email@example.com. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if the request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
Under the Data Protection Laws, you will have the right to make a complaint at any time to either the Jersey or Guernsey Data Protection Authority, the Island’s respective supervisory authorities for data protection issues.
Your Right to Object
It is important that you understand that you have a right to object to us processing your personal information where we do so exclusively on the basis of legitimate interests. As set out above, this applies to where we are processing your data for the purposes of:
- performing a Contract to which you are not a party
- dealing with complaints or enquiries in relation to the use of the Service
- assisting the emergency services where there is no risk to life or limb
- debt collection, credit referencing and preventing fraud, theft and other unlawful activity