Privacy notice

What we collect and why

We only collect what we need for the service you use. The list below follows the parts of this platform.

Enquiries, forms and appointment requests

When you contact us, fill in a form or ask for an appointment on the Business Desk or a mission website, we keep your name, email address, what you tell us and any answers the form asks for. We use them to reply and to deal with your request. To stop abuse, we also keep a salted, one-way hash of your IP address with the submission, never the address itself.

Community directory

If you suggest an organisation for a mission’s community directory, we keep the details you submit and your email address so the mission can check the entry before it is published.

Membership applications and accounts

When you apply for membership we keep your name, email address, organisation, role, telephone number, country, website, sector, the areas you are interested in, the mission that referred you (if any) and your message. Your password is stored only as a one-way hash. We record when you accepted this notice and, if you asked for them, when you agreed to receive updates. We use this to review your application, run your account and contact you about your membership.

Directory listings

If you are a member, you can publish a business or investor listing in the members-only directory. Other approved members can see the listing. Your contact details are not shown in the listing.

Deal Room interest

When you express interest in a project or ask for a meeting, we keep your message, preferred times and the project concerned, so the Desk can follow up with you and the project lead.

NDA and data room records

Before a data room opens, you accept a mutual non-disclosure agreement. We record the name and organisation you type, your email address, the time, the version of the agreement and a salted hash of your IP address. We also record which documents you view or download. Downloaded documents carry your name, organisation and email address as a watermark. We keep these records as evidence of the agreement and of who saw confidential material.

Service orders and invoices

When you order a service or pay for membership, we keep the request, the invoice (your name, organisation, the items and amounts) and the payment reference you give us. We keep financial records for as long as the law requires.

Security records

To protect accounts, we record sign-in attempts (the email address used and a salted, one-way hash of your IP address) for rate limiting, and an activity log of what signed-in users do. These records are used only for security and audit.

Our legal bases

[Legal bases to be confirmed by the Ministry, with reference to the applicable law, for example the Data Protection Act, 2019 of Barbados.] In draft, we rely on:

• performing the Ministry’s functions in promoting trade and investment and supporting Barbadians abroad [confirm];
• taking steps at your request before and during your membership, and providing the services you order;
• legal obligations, for example keeping financial records;
• your consent, for optional updates by email and for loading third-party videos and maps. You can withdraw consent at any time.

Who we share it with

We do not sell your information or use it for advertising. We share it only with:

• Ministry and mission staff who need it to deal with your request;
• service providers who process it on our behalf, under contract: Vercel (hosting), Neon (database), Cloudflare (file storage), [email delivery provider] (email), and TAPP Digital, which builds and maintains the platform;
• project leads and partners in the Deal Room, when you ask us to introduce you;
• public authorities where the law requires it.

International transfers

Some of our service providers store or process information outside Barbados, including in [countries or regions, to be confirmed]. [Describe the safeguards in place, for example contractual clauses, to be confirmed by the Ministry.]

How long we keep it

We keep information only for as long as we need it, in line with our retention schedule: [retention schedule to be published by the Ministry]. Some technical records are removed automatically: password reset links expire after one hour, and records of sign-in attempts are deleted after 30 days. Financial records are kept for as long as the law requires.

Your rights

You can ask us to:

• give you a copy of the information we hold about you (members can download it from their account);
• correct information that is wrong or incomplete;
• delete your information, where we do not need to keep it;
• stop or limit how we use it, or object to a use;
• give you your information in a format you can take elsewhere.

To use these rights, contact us using the details above. We may need to confirm your identity first. If you are not satisfied with our answer, you can complain to the Data Protection Commissioner of Barbados [contact details to be confirmed], or to the data protection authority where you live.

Cookies

We use only the cookies needed to keep you signed in. Videos and maps from other providers load only when you choose. See our cookie notice for the full list.

Changes to this notice

We will update this notice when our services or the law change, and show the date of the latest version at the top of this page.