Privacy Policy

1. Who We Are

1.1 CariHub is operated by CariHub Business Link, a company registered and operating in the Republic of Trinidad and Tobago. We are the data controller for personal data that we collect about you directly as a user of our Platform (such as your account information and payment data).

1.2 With respect to personal data belonging to your customers (clients, patients, guests, or other end consumers) that you collect and process through the Platform, you are the data controller and we act as your data processor. Our obligations as your data processor are set out in our Data Processing Agreement (DPA), available at carihub.com/dpa.

1.3 For the purposes of this Policy, "personal data" means any information relating to an identified or identifiable natural person. This includes information that can be directly or indirectly linked to a specific individual.

1.4 Our Data Protection Officer can be reached at privacy@carihub.com.

1.5 Dual-Role Accounts. The Platform supports three account types: (a) a Business Account (used to operate a business on the Platform — managing bookings, clients, staff, payments, and the like); (b) a Client Account (used to browse, book, and pay for services offered by businesses on the Platform); and (c) a Dual-Role Account, which is a single user account that has both a Business Account and a Client Account enabled at the same time. If you elect to enable both account types on a single user record (either at registration by selecting "Also sign me up as a client", or after registration from Settings → Profile → Account Types), the personal data we collect and process in connection with each role is linked to your single underlying user account. This means, for example, that the email address, password, multi-factor authentication settings, and login session you use are shared across both roles, and the activity you perform in each role is associated with the same user identifier for audit, billing, and support purposes. You can switch between the Business and Client views at any time from the header toggle; the underlying account remains a single account. You can disable one of the two account types at any time from Settings → Profile → Account Types, which removes your ability to act in that role but does not delete the underlying user account.

2. Data We Collect

We collect several categories of personal data to provide, maintain, and improve the Platform. The following table summarises the main categories of data we collect, the types of data within each category, and examples.

2.1 Mailing List Subscriber Data is collected when a visitor subscribes to the CariHub platform mailing list. Subscription points include the email sign-up form in the landing page footer (available to all visitors) and the closed-registration waitlist form (displayed on the registration page during the WAITLIST and CLOSED_BETA launch phases when public self-service registration is disabled). With respect to Mailing List Subscriber Data, CariHub Business Link acts as the data controller. Marketing consent for the platform mailing list is governed by our Marketing and Communications Consent Notice, available at carihub.com/legal/marketing-consent.

2.2 Payment Data — Tokens, Not Card Numbers. For payments processed through automated gateways (Stripe, PayPal, Fygaro, PayWise, LuniPay), we do not receive, transmit, or store your full card number (PAN), card-security code (CVV), or the magnetic-stripe data of your card. The gateway performs card-data capture on its own PCI-DSS-certified infrastructure (Stripe Hosted Checkout, PayPal Smart Buttons, Fygaro Hosted Page). Following a successful authorisation, the gateway returns to CariHub a single-use or multi-use payment-method token (for example, a Stripe PaymentMethod ID pm_1AbCdE…, a PayPal vault payment_token, or a Fygaro transaction reference) that can be used only by our merchant account, only for the purpose of authorising a payment, and only for the customer whose token it is. We store this token, together with the card brand and last four digits (for display and reconciliation purposes) and the token expiry. We never store the PAN itself. This approach keeps CariHub within the PCI DSS Self-Assessment Questionnaire A (SAQ A) scope — the lightest PCI DSS compliance tier — under PCI DSS v4.0.1. CariHub's SAQ A self-assessment is renewed annually.

2.2.1 Multiple Active Payment Gateways (v1.9.0). The Platform may have multiple payment gateways (Stripe, PayPal, Fygaro, PayWise, and the SIM test adapter) active simultaneously at the platform level. There is no mutual exclusivity: activating one gateway does not deactivate the others. A subscriber chooses their preferred gateway at subscription checkout from among the platform-activated options. The privacy treatment described in Section 2.2 above applies identically to each gateway, regardless of which gateway the subscriber selects — CariHub stores only gateway-issued payment-method tokens (never PAN/CVV) for every active gateway. The subscriber's gateway choice is recorded on their SubscriptionPayment row and their Subscription.gatewayName field; this metadata is processed for billing, reconciliation, and refund-handling purposes only. The selection of one gateway over another does not change the lawful basis for processing (Section 5), the data retention period (Section 8), or the cross-border transfer mechanism (Section 7) — each gateway's transfer mechanism is documented in Section 6 below.

2.3 Manual Bank Transfer Receipts. Where a Business elects to pay a CariHub subscription or Featured Directory Spot by manual bank transfer, the Business uploads a receipt (bank-transfer confirmation, deposit slip, or screenshot) through the Platform. The uploaded receipt file is stored in encrypted object storage at rest (AES-256-GCM, server-side encryption). The receipt file is accessible only to (a) the Business's own administrators, (b) CariHub platform administrators who review the receipt in the manual-payments review queue, and (c) CariHub support personnel assisting with reconciliation. Receipts are retained for seven (7) years from the date of upload for tax and accounting compliance (see Section 8).

2.4 Verification Tokens and Session Data. We issue short-lived, single-use verification tokens for email verification, password reset, multi-factor authentication, and one-time-password session elevation. Verification tokens are hashed at rest (we do not store the plaintext token) and are bound to a specific user, purpose, and expiry timestamp (typically twenty-four (24) hours). Login sessions persist for up to thirty (30) days from your last activity, after which re-authentication is required. Session identifiers and refresh tokens are stored in our database and are invalidated on sign-out, password change, or active session revocation by an administrator.

2.5 Google OAuth Data — Scope Confirmation. When you sign in with Google, the only data we receive is your name, email address, and profile photo URL, as described in Section 3.5 below. We do not receive your Google password, your Google Contacts, your Gmail messages, your Google Drive files, your Google Calendar data (the optional Google Calendar Sync feature is separate from sign-in, requests a different and narrower permission on its own consent screen, and collects nothing unless you choose to connect it — see Section 3.5), or any other Google account data beyond those three fields. The OAuth scope requested for "Sign in with Google" is limited to openid, email, and profile — the minimum necessary for account authentication — and we do not request any sensitive or restricted Google API scopes for sign-in purposes.

2.6 Payment Link Event Data (v1.13.0). When the Platform generates a Payment Link on behalf of a Business (Payment Disclosure §12.1) and a client opens the link in their browser, the Platform logs a "Payment Link Event" capturing the following personal data: the Payment Link identifier, the event type (e.g., generated, opened, paid, expired, cancelled, email_sent, sms_sent, reminder_sent, link_revoked, payment_initiated, page_abandoned), the timestamp of the event, the client's IP address at the time of an opened event, and the client's user-agent string at the time of an opened event. The client's IP address is masked in the Business-facing and Platform-admin UIs (e.g., displayed as 190.80.x.x) but is stored in full in the Platform's database for the retention period set out in Section 8.7 below to support fraud investigation, abuse prevention, and dispute resolution. The user-agent string is truncated in the UIs to the browser family and major version; the full user-agent string is retained in the database. Payment Link Event Data does not include card data, gateway transaction identifiers, or any payment-method tokens — those are stored separately on the underlying Payment record (Section 2.2). The legal basis for processing the client's IP address and user-agent in this context is the Platform's legitimate interests in preventing fraud and abuse against the Platform and its Business users (Section 5).

2.7 Webhook Event Log Data (v1.13.0). When the Platform receives a webhook event from a supported payment gateway (Stripe, PayPal, Fygaro, WiPay, PayWise, HandyPay, 2Checkout, and such other gateways as may be integrated from time to time), the Platform logs the event in a "Webhook Event Log", including: the gateway that sent the event, the event type as classified by the gateway, the gateway's event identifier, the timestamp the event was received by the Platform, and the raw event payload as delivered by the gateway. The raw event payload may contain gateway transaction identifiers, gateway customer identifiers, gateway payment-method token references, the payment amount and currency, and gateway-side fraud-score indicators (where the gateway provides them). The raw event payload does not contain PAN/CVV data — gateways do not transmit card data in webhook payloads. The Webhook Event Log is accessible to Platform Administrators for audit, reconciliation, dispute resolution, and reprocessing of failed webhook events. Where the raw event payload contains personal data of the Business's clients (e.g., a gateway customer identifier tied to a client), CariHub acts as a Data Processor on behalf of the Business for the contents of that payload, and the Business's instructions and retention configuration (where applicable) prevail to the extent permitted by applicable law (Data Retention Policy §2.2). The retention period for Webhook Event Log entries is set out in Section 8.8 below.

3. How We Collect Data

3.1 Directly from You (Business Users). We collect personal data directly from you when you:

• Register for a CariHub account and provide your business and personal information.
• Complete account verification, including business email verification and identity verification.
• Set up your business profile, services, pricing, and staff accounts.
• Configure payment processing and provide payment method details.
• Subscribe to a plan, upgrade, or downgrade your subscription.
• Communicate with our support team.
• Provide feedback, respond to surveys, or participate in promotional activities.
• Configure notification and communication preferences.
• Set up multi-factor authentication (MFA), including phone numbers for SMS codes and email addresses for verification codes.
• Configure SEO aliases and search optimization settings for your services, products, events, and business profile.
• Create and publish landing page content using the page editor, including FAQ entries, testimonials, and custom text.
• Submit feedback, bug reports, or feature requests through the in-app feedback system, including file attachments.

3.2 From Your Customers (as Their Processor). We collect personal data about your customers when they:

• Book an appointment or service through your CariHub booking page.
• Fill out intake forms, consent forms, or waivers with e-signatures.
• Purchase or redeem gift cards.
• Enrol in your loyalty programme.
• Receive communications (email, SMS, WhatsApp) sent through the Platform on your behalf.
• Leave reviews or ratings.
• Make payments for your services through the Platform.

When we collect data from your customers, we do so as your data processor, acting solely on your instructions and for the purpose of providing the Platform services. You are responsible for ensuring that you have a lawful basis for collecting and processing your customers' data.

3.3 Automatically. We collect certain data automatically when you or your customers interact with the Platform, including:

• Technical Data: IP addresses, browser information, device details, and operating system information, collected via standard web technologies.
• Usage Data: Information about how the Platform is used, including pages visited, features used, session durations, and interaction patterns, collected through server logs and analytics tools.
• Cookie and Tracking Data: Information collected through cookies and similar technologies as described in our Cookie Policy at carihub.com/cookies.

3.4 From Third Parties. We may receive personal data from third-party sources, including:

• Payment Gateways: Transaction confirmation data from Stripe, Fygaro, LuniPay, PayWise, and other payment processors.
• Identity Verification Services: Verification results from third-party identity verification providers, if used.
• Business Directories: Publicly available business information to enhance your business profile.

3.5 Sign in with Google. We offer "Sign in with Google" as an optional authentication method. When you choose to sign in using your Google account, Google shares the following limited personal data with us:

• Name: Your full name as it appears in your Google profile.
• Email address: The primary email address associated with your Google account.
• Profile photo: The public profile photo URL from your Google account, if you have one set.

We use this data solely to create and authenticate your CariHub account. Specifically:

• (a) Your name and email address are used to identify your account and display your identity within the Platform.
• (b) Your profile photo is displayed on your account profile and in interface elements where your identity is shown to other users in your business.
• (c) Your email address is used for account notifications, password recovery (if you later enable password-based login), and administrative communications.

We do not request, receive, or store your Google password, Google Contacts, Gmail messages, Google Drive files, or any other Google data beyond the three data elements listed above. The OAuth scope requested for "Sign in with Google" is limited to openid, email, and profile — the minimum necessary for account authentication — and we do not request any sensitive or restricted Google API scopes for sign-in purposes.

Google Calendar Sync (optional, opt-in). You can optionally connect Google Calendar from Settings → Calendar Sync or My Profile → Connections. This is separate from "Sign in with Google": it asks for a different, narrower permission on its own Google consent screen, and nothing is requested or collected unless you choose to connect. The following data practices apply:

• (a) Calendar scope: We request only Google's "https://www.googleapis.com/auth/calendar.app.created" permission (a non-sensitive Google scope), together with the standard openid, email and profile scopes. By Google's own design this technically restricts our application's access to the calendars and events our application itself creates. We do not request the broader "calendar" or "calendar.events" scopes, which would grant access to your existing personal calendars. We cannot read, import, or modify events on any calendar other than the dedicated "CariHub" calendar — the restriction is enforced by Google at the API level, not only by our own policy.
• (b) Dedicated "CariHub" calendar: To preserve your privacy and minimise data exposure, the integration creates a separate, clearly-labelled calendar ("CariHub") in your Google account. All booking data we sync is written to this calendar. Your personal calendars remain untouched.
• (c) What is synced: For bookings in which you are the client or the assigned staff member, CariHub writes an event to the CariHub calendar containing the service name, the client's name, the date, time and time zone, the location (the branch address or the business name), the business name, and updates or removes that event when the booking changes. Booking notes are never sent to Google. We monitor the CariHub calendar for deleted events only: if you delete an event in Google Calendar we notify you in CariHub and re-create the event. We do not cancel the booking, and we do not apply other edits you make in Google Calendar to the booking.
• (d) OAuth tokens and connection data: To keep the connection working between sessions we store an encrypted OAuth refresh token and a short-lived encrypted access token (AES-256-GCM at rest, using a platform-managed key), together with your Google account email address and the identifier of the CariHub calendar. We do not store your Google password.
• (e) No broad data collection: The integration does not import your existing calendar events, contacts, or reminders into CariHub. Only booking-related events on the CariHub calendar are exchanged.
• (f) User control: You can disconnect the Google Calendar integration at any time via Settings. Disconnecting revokes the OAuth grant (via Google's token revocation endpoint), deletes the stored tokens, and removes the dedicated "CariHub" calendar from your Google account.

The "Sign in with Google" authentication flow continues to request only the openid, email, and profile scopes — the calendar permission is requested only when you explicitly choose to connect Google Calendar. Further detail is set out in our Integrations and Connected Accounts Policy, available at carihub.com/legal/integrations-policy.

How we store Google data: Your name, email address, and profile photo URL are stored in our PostgreSQL database hosted on Supabase, encrypted at rest, and associated with your user record. For "Sign in with Google" authentication, our authentication is stateless (JWT-based) and we do not store Google access tokens, refresh tokens, or any OAuth credentials — we do not retain persistent access to your Google account on the basis of sign-in alone. Google Calendar Sync, described above, is the only scenario in which encrypted OAuth credentials (a refresh token and a short-lived access token) are stored, and only after you explicitly choose to connect it.

How we share Google data: We do not share, sell, rent, or transfer the Google user data we receive to any third party, except as required by law or as necessary to provide the Platform service (e.g., hosting providers who process data on our behalf under strict data processing agreements). We do not use Google user data for advertising purposes, and we do not transfer Google user data to third parties for their own purposes.

Limited Use compliance: Our use of Google user data complies with Google's Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide user-facing features that are prominent in our application's user interface, for security purposes, to comply with applicable law, or with the user's affirmative consent.

AI training: We do not use your Google user data to train, fine-tune, or improve any artificial intelligence or machine learning models, whether our own or third-party.

Disconnecting Google sign-in: You may disconnect Google sign-in from your account at any time through your account settings. After disconnection, we will stop receiving new data from Google, though data we have already lawfully received and stored will be retained in accordance with our data retention policy (Section 8) unless you request its deletion.

Google's terms: Your use of "Sign in with Google" is also subject to Google's Terms of Service and Privacy Policy, available at https://policies.google.com/privacy. We encourage you to review Google's privacy practices.

4. Legal Bases for Processing

We process personal data only when we have a lawful basis to do so. The legal bases we rely on are:

• Create and maintain your account.
• Provide the Platform features and services you have subscribed to.
• Process your subscription payments.
• Provide customer support.
• Send service-related notifications (such as system alerts, security notifications, and billing reminders).
• Delivering web push notifications and in-app alerts about your bookings, payments, and account security.

• Sending marketing communications that are not related to the service you have subscribed to.
• Using cookies and tracking technologies that are not strictly necessary (see our Cookie Policy).
• Processing special categories of personal data (such as health information provided in intake forms), where such consent is obtained by you from your customers.

• Improving and developing the Platform and its features.
• Analysing usage patterns to enhance user experience.
• Preventing fraud, abuse, and security threats.
• Maintaining the security and integrity of the Platform.
• Communicating with you about product updates, new features, and changes to our services.
• Sending platform broadcast messages (outage notices, security advisories, product updates) to keep you informed about the service you subscribe to.
• Tracking communication usage to enforce plan-tier quotas and prevent abuse.

• Responding to lawful requests from public authorities.
• Complying with tax and financial reporting obligations.
• Enforcing our Terms of Service and other agreements.

5. How We Use Data

We use the personal data we collect for the following purposes:

• Managing your account and subscription.
• Enabling appointment scheduling, POS transactions, and CRM features.
• Processing bookings, cancellations, and rescheduling.
• Managing gift cards, loyalty programmes, and events.
• Facilitating e-signature collection and document management.
• Generating AI-assisted content, insights, and recommendations.
• Tracking communication usage counts per business per channel per month to enforce plan-tier quotas.
• Recording which delivery channels (in-app, email, SMS, WhatsApp, push) carried each notification, for audit and deduplication purposes.

• Charging your subscription fees and add-on fees.
• Routing customer payments through our integrated payment gateways (Stripe, Fygaro, LuniPay, PayWise, and others).
• Generating invoices and receipts.
• Managing refunds and chargebacks.
• Calculating and applying applicable taxes.

• Sending service-related notifications (booking confirmations, reminders, cancellations).
• Delivering security alerts (unusual login activity, password changes).
• Providing billing notifications (invoices, payment failures, plan changes).
• Responding to your support requests.
• Sending marketing communications (where you have consented).
• Sending platform broadcast messages (outage notices, security advisories, product updates) to business administrators via in-app notifications, email, and web push.
• Delivering web push notifications to your device when the Platform is not actively open, using your stored push subscription data.

5.3.1 Platform Mailing List. We use Mailing List Subscriber Data to send marketing communications about platform launches, new features, product updates, promotions, events, and other CariHub-related news to subscribers who have explicitly opted in via the platform mailing list. The lawful basis for this processing is your consent, captured at the time of subscription. Consent is captured through an explicit opt-in action (an unchecked checkbox or a clear "Subscribe" button), and a snapshot of the consent text, the consent version, the timestamp, your IP address, and your user agent string are stored immutably as a Consent-of-Record in the MailingListConsent audit table. You may withdraw your consent at any time through the methods described in Section 9.10, and withdrawal is recorded as a separate consent event in the same audit trail.

• Processing natural language queries to the AI assistant.
• Generating suggested responses, content, and insights based on your business data.
• Providing smart scheduling recommendations and operational insights.
• Drafting communications on your behalf.

Important: We do not use your business data or your customers' personal data to train, fine-tune, or improve third-party AI models. AI processing occurs within the scope of providing the service and in accordance with the data processing instructions you provide. Data sent to AI providers (OpenAI, Anthropic, Google, xAI, Mistral, OpenRouter) is subject to those providers' respective data processing terms, and we have selected providers that offer appropriate data protection commitments.

• Aggregating and anonymising usage data to identify trends and patterns.
• Conducting A/B testing to evaluate feature changes.
• Identifying and fixing bugs, errors, and performance issues.
• Developing new features and improving existing ones.

• Detecting and preventing fraud, unauthorised access, and abuse.
• Monitoring for security vulnerabilities and threats.
• Enforcing rate limits and access controls.
• Investigating suspected violations of our Terms of Service.
• Platform Admin Impersonation: Creating temporary authenticated sessions as subscriber users for technical support and troubleshooting. All impersonation sessions are audit-logged with the administrator's identity, timestamp, and target user. Impersonation tokens expire after 5 minutes and can only be used once.

• Responding to legal processes, court orders, and government requests.
• Complying with tax, financial, and regulatory reporting requirements.
• Enforcing our legal rights and defending against legal claims.

6. Data Sharing and Sub-Processors

We share personal data with third-party service providers ("sub-processors") who assist us in providing the Platform. The following table lists all sub-processors with whom we share personal data, the purposes for which data is shared, and the data categories involved:

> Multiple Active Gateways (v1.9.0): As of v1.9.0, the Platform may have multiple payment gateway sub-processors (Stripe, PayPal, Fygaro, LuniPay, PayWise) active simultaneously at the platform level. A subscriber chooses their preferred gateway at subscription checkout from among the platform-activated options. All active gateway sub-processors process payment-method tokens under the same PCI DSS SAQ A scope described in Section 2.2 — the subscriber's gateway choice does not change the data categories processed, the purpose of processing, or the location of processing for any individual sub-processor. Each sub-processor's cross-border transfer mechanism is documented in Section 7 below.

6.1 Sub-Processor Due Diligence. We conduct due diligence on all sub-processors before engaging them, including reviewing their security practices, data protection compliance, and privacy policies. We enter into data processing agreements with all sub-processors that process personal data on our behalf.

6.2 Sub-Processor Changes. We will notify you of any material change to our sub-processor list at least thirty (30) days before the change takes effect. You may object to the change by contacting privacy@carihub.com, and we will work with you to address your concerns. For the avoidance of doubt, this notification obligation covers only sub-processors engaged by CariHub Business Link in respect of the Platform. It does NOT cover Business-Connected Communication Providers (BYOK) as described in Section 6.5 — those providers are engaged by, and remain under the control of, the Business, and the Business is responsible for monitoring and managing its own relationship with its BYOK providers.

6.3 Legal Requirements. We may also share personal data when required by law, regulation, or legal process, including in response to court orders, subpoenas, government investigations, or requests from law enforcement authorities. We will notify you of such requests unless prohibited by law.

6.4 Business Transfers. In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, personal data may be transferred as part of the transaction. We will notify you of any such transfer and the choices available to you regarding your data.

6.5 Business-Connected Communication Providers (BYOK). The Platform offers an optional feature known as Bring Your Own Key (BYOK), whereby a Business may connect its own third-party communication provider account (Resend for email, Twilio for SMS and WhatsApp) so that outbound messages route through the Business's own provider account rather than the shared sub-processor accounts listed in the table in Section 6. The following terms apply when a Business enables BYOK:

• (a) Contracting Party. When a Business connects its own Resend or Twilio account, the Business — NOT CariHub — is the contracting party with that provider. The BYOK provider becomes a sub-processor engaged by the Business (Data Controller) for the personal data transmitted through the BYOK routing. CariHub is not a party to the Business↔provider agreement and has no contractual relationship with the Business's BYOK provider.
• (b) CariHub's Limited Role. Where BYOK is active, CariHub's role is limited to: (i) transmitting the message content and recipient data (e.g., the email body, the recipient's email address or phone number, the WhatsApp message payload) to the BYOK provider's API on the Business's behalf at send time; (ii) storing the Business's BYOK API credentials (Resend API key, Twilio account SID and auth token) encrypted at rest using AES-256-GCM with the platform's AI_ENCRYPTION_KEY, and transmitting those credentials to the BYOK provider only at the moment of sending or webhook signature verification; and (iii) receiving bounce, complaint, delivery, and inbound-message webhooks from the Business's BYOK provider account and acting on them (per-business suppression-list writes, delivery-status updates) in accordance with the Business's instructions.
• (c) Not CariHub's Responsibility. CariHub is NOT responsible for the Business's BYOK provider's data practices, retention policies, sub-processing chain, security controls, or compliance with applicable data protection law. The Business should review the BYOK provider's privacy policy, data processing agreement, and breach notification practices directly. Links to the providers' privacy policies are: Resend — https://resend.com/legal/privacy-policy; Twilio — https://www.twilio.com/legal/privacy.
• (d) Credential Handling. BYOK API credentials are never displayed in plaintext after saving, never logged in plaintext, and never transmitted to any party other than the BYOK provider's own API endpoint. Only the last four characters of a credential are surfaced in the Platform UI for identification. Credentials are removed from CariHub's systems when the Business disconnects the BYOK configuration.
• (e) Routing Switch. The Business may flip outbound email routing between the Platform's shared Resend account and the Business's own BYOK Resend account at any time without disconnecting the BYOK configuration. The routing selection is stored on the BYOK configuration row and applies only to the Business's outbound email.
• (f) Force-Fallback. CariHub may, in limited circumstances, force-fallback outbound routing from the BYOK provider to the Platform's shared account (or suspend BYOK routing entirely) if the Business's BYOK credentials fail authentication, the BYOK provider account is suspended or terminated, the plan feature gating the BYOK channel is downgraded, or CariHub reasonably believes continued BYOK routing would violate applicable law or the BYOK provider's acceptable use policy. CariHub will use reasonable efforts to notify the Business of any forced fallback.
• (g) Quota and Policy Gates. BYOK sends are exempt from the Platform-wide send-limit counter (which protects the Platform's shared sub-processor quota) but the Business's plan-tier communication quota and the Platform's policy gates (consent, suppression list, quiet-hours) remain enforced upstream of the BYOK routing decision.
• (h) Indemnity. The Business agrees to indemnify CariHub from any claim, loss, fine, or expense arising from the Business's BYOK provider's acts or omissions, except to the extent directly caused by CariHub's breach of this Privacy Policy or the DPA.

6.6 No Sale or Independent Use of Your Data. We do not sell, rent, or trade personal data to any third party. We do not share personal data with any third party for that third party's own independent purposes, such as their own marketing, research, or analytics. We share data only with the service providers named in this Section 6, each bound by a data processing agreement that restricts them to processing data solely to provide the Platform on our instructions. Consistent with Section 5.4, we do not use client data, or data received from any source, to train, fine-tune, or improve any artificial intelligence or machine learning model, whether our own or a third party's, except to the extent a business has opted in for its own business content under a future explicit AI-training opt-in feature, should one be introduced.

7. International Data Transfers

7.1 As described in Section 6, some of our sub-processors are located outside the Caribbean region, primarily in the United States and the European Union. This means that personal data collected through the Platform may be transferred to, stored, and processed in these jurisdictions.

7.2 Legal Framework for Transfers. We ensure that international transfers of personal data are carried out with appropriate safeguards:

• (a) Standard Contractual Clauses (SCCs): Where the European Commission has not made an adequacy decision with respect to the recipient country, we rely on Standard Contractual Clauses approved by the European Commission (or equivalent mechanism under applicable Caribbean law) to provide appropriate safeguards for the transfer.
• (b) Adequacy Decisions: Where the receiving country has been deemed to provide an adequate level of data protection by the relevant Caribbean data protection authority or equivalent body, we may transfer data based on that adequacy decision.
• (c) Consent: Where no other legal mechanism is available and the transfer is in your explicit interest, we may seek your informed consent for the international transfer.
• (d) Contractual Safeguards: We have entered into data processing agreements with all sub-processors that include appropriate security and confidentiality obligations.

7.3 US Transfers. Transfers to US-based service providers are made in reliance on the applicable legal framework, including Standard Contractual Clauses and, where applicable, any data protection framework agreed between the Caribbean Community (CARICOM) and the United States. We have selected US-based sub-processors that maintain appropriate security certifications (such as SOC 2 Type II) and that commit to processing data in accordance with our instructions. Specifically:

• (a) Stripe, Inc. (United States) processes subscription and one-time payment card transactions. Stripe is certified to PCI DSS v4.0.1 Level 1 and operates its own cardholder-data environment; CariHub only exchanges payment-method tokens with Stripe, never raw card data.
• (b) PayPal Holdings, Inc. (United States) processes alternative-payment transactions. PayPal is certified to PCI DSS v4.0.1 Level 1 and operates its own cardholder-data environment; CariHub only exchanges payment-method references with PayPal.
• (c) Supabase Inc. (United States, with EU-region database hosting available) hosts the PostgreSQL database that stores personal data at rest. Supabase is SOC 2 Type II certified and provides AES-256-GCM encryption at rest.
• (d) Google LLC (United States) provides OAuth sign-in ("Sign in with Google") and the optional Google Calendar Sync integration. The data we receive via OAuth is limited to name, email, and profile photo URL (for sign-in) and, when a user explicitly chooses to connect Google Calendar, booking-event data on a dedicated "CariHub" calendar only.

7.4 EU Transfers. Transfers to EU-based service providers (such as Brevo and Mistral AI) benefit from the European Union's comprehensive data protection framework under the General Data Protection Regulation (GDPR), which provides a high level of protection for personal data.

7.5 Trinidad and Tobago Data Protection Act 2011. We process personal data in compliance with the Data Protection Act, 2011 (Act No. 12 of 2011) of the Republic of Trinidad and Tobago, including the principles of lawful processing (Part III), data minimisation, purpose limitation, accuracy, storage limitation, and security (Part IV), and the cross-border transfer restrictions in sections 17–20. Where the Act has not been fully brought into force, we extend the rights described in Section 9 of this Policy to Trinidad and Tobago residents as a matter of company policy. Where personal data is transferred outside of Trinidad and Tobago (including to Stripe US, PayPal US, or Supabase US/EU), we rely on Standard Contractual Clauses approved by the European Commission or an equivalent transfer mechanism recognised under the Act.

7.6 Standard Contractual Clauses. We have executed Standard Contractual Clauses (the European Commission's 2021 modules, where applicable to the controller/processor roles of each transfer) with each of our sub-processors that receives personal data from EU/UK or Trinidad and Tobago data subjects. Copies of the executed SCCs are available on request from privacy@carihub.com, subject to applicable confidentiality obligations.

7.7 BYOK Transfers. Where a Business has enabled Bring Your Own Key (BYOK) under Section 6.5, the Business's outbound messages (and the recipient data necessary to deliver them) are transmitted directly to the Business's chosen BYOK provider. Resend is headquartered in the United States and Twilio is headquartered in the United States; the Business's BYOK provider account may also route data through additional jurisdictions chosen by the BYOK provider (e.g., Twilio's super-network operates across multiple regions). Such transfers are made under the Business's own transfer arrangement with its BYOK provider (e.g., the Resend DPA, the Twilio DPA, including any Standard Contractual Clauses the Business has executed with its provider). CariHub is not responsible for the lawfulness of the Business's international transfer arrangement with its BYOK provider. The Business should consult its BYOK provider's terms and privacy policy for details on the jurisdictions to which personal data is transferred when BYOK is active.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, as required by applicable law, or as described below.

8.1 Upon termination or cancellation of your account, we will retain your data for the periods specified above, after which it will be securely deleted in accordance with Section 14 of our Terms of Service.

8.2 You may request earlier deletion of certain data categories by contacting us at privacy@carihub.com, subject to legal and contractual retention requirements.

8.3 Mailing List Subscriber Data Retention. When a subscriber unsubscribes from the platform mailing list, the subscriber's record is immediately flipped to UNSUBSCRIBED status and a WITHDRAW consent event is recorded in the MailingListConsent audit trail. The subscriber's personal data (email address, optional name, interests, and tags) is retained for ninety (90) days following the unsubscribe to support suppression-list enforcement (so that inadvertently re-subscribed addresses are not re-added without a fresh consent) and bounce monitoring. After the 90-day retention period, the subscriber's record is anonymised: the email address is replaced with a one-way hash, the name and any other personally identifiable information are removed, and the record is retained only for aggregate statistical and trend analysis. The MailingListConsent audit trail (the immutable consent-of-record entries, including consent text snapshots, timestamps, IP addresses, and user agents) is retained for six (6) years from the date of each consent event, in accordance with the data protection legislation of Jamaica (DPA 2020), Trinidad and Tobago (DPA 2011), Barbados (DPA 2019), and Guyana (DPA 2022), and the OECS member state data protection acts.

8.4 Audit Logs and Invite-Code Lifecycle Events. The Platform records invite-code lifecycle events — including creation, redemption, disablement, re-enablement, and deletion — in the audit log together with relevant metadata (code identifier, label, before-and-after statuses, and the actor who performed the action). These events are logged for security, fraud-prevention, and compliance purposes and are retained according to the standard audit log retention profile applicable to your business (see Section 12.5). Audit log entries containing personal data are processed in accordance with this Privacy Policy and our Data Processing Agreement.

8.5 Auto-Renew (Future Feature). The Platform plans to launch an auto-renew feature for subscriptions paid through gateway-based payment methods (Stripe and PayPal). This feature is not yet active. When it launches, the following data practices will apply:

• (a) Gateway-native tokenisation. We will store a gateway-issued payment-method token (for example, a Stripe PaymentMethod ID or a PayPal vault payment_token) — never raw card numbers, never gateway login credentials, never bank-portal passwords. The token can be used only by CariHub's merchant account, only to authorise a payment, and only for the customer whose token it is.
• (b) Consent capture. Before enabling auto-renew, we will obtain your affirmative-action consent (an unchecked checkbox that you must check) together with a snapshot of the disclosure text shown at the time of consent. The consent record (user identifier, timestamp, IP address, user-agent string, disclosure version) will be retained for three (3) years to satisfy California Auto-Renewal Law (Cal. Bus. & Prof. Code § 17600 et seq.) record-retention requirements.
• (c) Token revocation. You may revoke the stored payment-method token at any time from Settings → Subscription → Cancel Auto-Renew or by removing the saved payment method. Revocation deletes the token from our database and, where applicable, revokes it at the gateway via the gateway's token-revocation API. Cancellation takes effect at the end of the current billing period.
• (d) PCI DSS scope. Use of gateway-native tokenisation keeps CariHub within the PCI DSS SAQ A compliance tier. We do not implement our own payment-vault; all cardholder-data functions remain fully outsourced to PCI-DSS-certified gateways.
• (e) Fygaro and LuniPay. Where these gateways do not expose a public auto-charge API, auto-renew will not be available for them. In those cases, the Platform will send a renewal reminder email with a one-time payment link ("assisted manual renewal"). Manual bank transfer subscriptions do not support auto-renew.
• (f) Compliance references. The auto-renew feature will comply with: PCI DSS v4.0.1 SAQ A; PSD2 Strong Customer Authentication (where the first transaction is SCA-authenticated and recurring Merchant-Initiated Transactions are out of SCA scope); Regulation E (12 CFR Part 1005.10) for preauthorised electronic fund transfers; California Auto-Renewal Law (Cal. Bus. & Prof. Code § 17600 et seq., including the 1 July 2025 amendments requiring click-to-cancel); and the Trinidad and Tobago Data Protection Act 2011. Further technical and legal analysis is documented in our internal Auto-Renew Analysis, available on request from privacy@carihub.com.

8.6 Unverified Account Data. When a User registers with an email address and password but does not complete email verification, the Platform retains the following "Pending Account Data" for a limited period:

• Email address and hashed password;
• Business profile details entered during registration (business name, type, contact information);
• Any uploaded logos or brand assets;
• Quick-setup progress (service catalog drafts, branch configurations); and
• Verification token issuance records (with timestamps and IP addresses for audit).

Retention period: Pending Account Data is retained for thirty (30) days after the verification token expires (i.e., 30 days after the 24-hour token window closes). If the User does not verify their email within this period, the Pending Account Data is automatically purged, except for:

• Anonymized audit-log entries retained per the Audit Log Retention Schedule (see Section 8.4); and
• Email address retained solely for the purpose of preventing re-registration abuse for 90 days, then deleted.

Verification audit events: The Platform logs the following audit events related to email verification, retained per the Audit Log Retention Schedule:

• EMAIL_VERIFIED (HIGH severity — retained 730 days);
• EMAIL_VERIFICATION_RESENT (LOW severity — retained 90 days);
• EMAIL_VERIFICATION_GATE_BLOCKED (MEDIUM severity — retained 365 days).

These events record: timestamp, user ID (where available), email address, IP address, and the resource path that triggered the gate. See the Data Retention Policy for the full retention schedule.

8.7 Payment Link Event Data Retention (v1.13.0). Payment Link Event records (Section 2.6) are retained for seven (7) years from the date of the event, on the same retention basis as the underlying Billing and Payment records to which they relate (Section 3.1, "Billing records" and "Refund and chargeback records" in the Data Retention Policy). The 7-year retention supports fraud investigation, chargeback dispute response, and tax/accounting compliance — a client may dispute a card charge up to several months after the payment, and the Platform's retention of the Payment Link Event log (including the client's IP address and user-agent at the time the link was opened) supports the Business's response to such disputes. The client's full IP address and the full user-agent string are retained for the full 7-year period; the masking applied in the UIs (Section 2.6) is a UI-level display control only and does not shorten the retention of the underlying data. Where CariHub acts as a Data Processor on behalf of the Business for the contents of a Payment Link Event (e.g., where the event relates to a Business's client), the Business's retention configuration (where applicable) prevails to the extent permitted by applicable law (Data Retention Policy §2.2), subject to the minimum 7-year retention required by tax and accounting law.

8.8 Webhook Event Log Retention (v1.13.0). Webhook Event Log entries (Section 2.7) are retained for seven (7) years from the date the event was received by the Platform, on the same retention basis as the underlying Billing records and Refund/chargeback records to which they relate. The 7-year retention supports audit, reconciliation, dispute resolution, and reprocessing of failed webhook events. The raw event payload may include gateway-side personal data (e.g., the gateway's customer identifier, the gateway's payment-method token reference); this data is processed by CariHub solely for the purposes of recording and reconciling the payment event and is not used for any other purpose. No PAN/CVV data is ever present in a Webhook Event Log entry — gateways do not transmit card data in webhook payloads (Section 2.7). Where the raw event payload contains personal data of the Business's clients, CariHub acts as a Data Processor on behalf of the Business, and the Business's retention configuration (where applicable) prevails to the extent permitted by applicable law (Data Retention Policy §2.2), subject to the minimum 7-year retention required by tax and accounting law.

8.9 Automated Payment Reminders (v1.13.0). For Payment Links with an expiry window of six (6) hours or longer, the Platform may send automated payment reminders to the client via the same channel (email or SMS) used to deliver the original Payment Link (Payment Disclosure §12.5). Reminders are sent at approximately fifty percent (50%) of the expiry window and again approximately one (1) hour before the link expires. The processing of the client's email address or phone number for the purpose of sending these reminders is on the same legal basis as the original Payment Link delivery — namely, the Business's legitimate interests in collecting payment for goods or services rendered to the client, and (where applicable) the client's consent to receive communications from the Business. Reminders are not sent for Quick-Pay Links (expiry < 6 hours) or for links that have already been paid, cancelled, or revoked. The reminder delivery is logged in the Platform's Communication Log (Section 3.1, "Communication logs" in the Data Retention Policy) and in the Payment Link's event log (Section 2.6) as a reminder_sent event. The Business may disable automated reminders on a per-link or per-Business basis where the Platform exposes such a setting; where reminders are disabled, no reminder messages are sent and no reminder_sent events are logged.

9. Your Rights

Depending on your jurisdiction and the applicable data protection law, you may have the following rights with respect to your personal data:

9.1 Right of Access. You have the right to request information about the personal data we hold about you and to obtain a copy of that data. For business accounts, you can access most of your data directly through the Platform's dashboard and data export features.

9.2 Right to Rectification. You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can correct most of your personal data directly through your account settings.

9.3 Right to Erasure ("Right to Be Forgotten"). You have the right to request the deletion of your personal data in certain circumstances, including: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw your consent and there is no other legal basis for processing; (c) you object to the processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. This right is subject to exceptions, including where retention is required by law or for the establishment, exercise, or defence of legal claims. You may request deletion of your push subscription data at any time by disabling push notifications in your browser or through the Platform's notification preferences, which immediately removes the subscription record.

9.4 Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV), and to transmit that data to another service provider. You can export your business data through the Platform's data export feature at any time.

9.5 Right to Object. You have the right to object to the processing of your personal data based on legitimate interests, direct marketing, or processing for research and statistical purposes. We will cease processing your data for such purposes unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

9.6 Right to Restrict Processing. You have the right to request the restriction of processing of your personal data in certain circumstances, including where you contest the accuracy of the data, the processing is unlawful but you prefer restriction over erasure, or we no longer need the data but you require it for legal claims.

9.7 Right to Withdraw Consent. Where we rely on your consent as the legal basis for processing, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9.8 Exercising Your Rights. To exercise any of the above rights, please contact us at privacy@carihub.com. We will respond to your request within thirty (30) days, or sooner if required by applicable law. We may need to verify your identity before processing your request. In some cases, we may not be able to comply with your request in full, in which case we will explain the reasons.

9.9 Customer Data Rights. If you are a customer of a business using CariHub and wish to exercise your data protection rights (such as access, correction, or deletion of your personal data), you should first contact the business directly, as they are the data controller for your data. If the business does not respond, you may contact us at privacy@carihub.com and we will forward your request to the relevant business.

9.10 Right to Unsubscribe from the Platform Mailing List. If you have subscribed to the CariHub platform mailing list, you have the right to unsubscribe at any time, free of charge, without providing a reason, and without needing to log in to any account. You may unsubscribe through any of the following methods:

• (a) One-Click Token-Based Unsubscribe Link: Every marketing email sent through the platform mailing list includes a unique unsubscribe link in the email footer. The link contains a per-subscriber unsubscribe token (unsubscribeToken) that, when clicked, immediately flips your subscription status to UNSUBSCRIBED and records a WITHDRAW consent event in the MailingListConsent audit trail. No login is required. This method satisfies the one-click unsubscribe requirements of the CAN-SPAM Act and the GDPR.
• (b) Subscriber Portal: Where available, you may manage your subscription preferences (including interests, tags, and channel preferences) through the platform subscriber portal. The portal requires email-verification access (no full Platform account required).
• (c) Direct Contact: You may contact us at privacy@carihub.com or unsubscribe@carihub.com with the email address you wish to unsubscribe, and we will process your request within five (5) business days.

Unsubscription takes effect immediately upon processing. As described in Section 8.3, your subscriber data is retained for 90 days after unsubscribe for suppression-list enforcement and then anonymised. The consent audit trail is retained for 6 years.

10. Children's Data

10.1 The Platform is not intended for use by children. We do not knowingly collect personal data from children.

• For users in Jamaica (Data Protection Act, 2020), Barbados (Data Protection Act, 2019-29), the Cayman Islands (Data Protection Act, 2017), and Trinidad and Tobago (Data Protection Act, 2011): the age of consent is eighteen (18) years.
• For users in the United States: the threshold is thirteen (13) years in accordance with the Children's Online Privacy Protection Act (COPPA).
• For users in the European Union: the threshold is sixteen (16) years in accordance with GDPR Article 8, unless the member state has lowered it to thirteen (13).

If we learn that we have collected personal data from a child under the applicable age threshold without parental consent, we will promptly delete that data. Parents or guardians who believe their child has provided personal data to us should contact us at privacy@carihub.caribbean to request deletion.

11. Cookies and Tracking Technologies

11.1 We use cookies and similar tracking technologies to collect information about your browsing activity on the Platform. For a comprehensive description of the cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy at carihub.com/cookies.

11.2 The Cookie Policy is incorporated herein by reference and forms part of this Privacy Policy.

12. Data Security Measures

We implement robust technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

12.1 Encryption at Rest. All personal data stored in our databases (hosted on Supabase PostgreSQL) is encrypted at rest using AES-256-GCM encryption. This ensures that even if the underlying storage is compromised, the data remains unreadable without the encryption keys.

12.1.1 Payment Data Encryption and PCI DSS Compliance. CariHub does not store, process, or transmit primary account numbers (PANs / full card numbers), card-security codes (CVV), or magnetic-stripe data. All card-data capture is performed on the gateway's PCI-DSS-certified infrastructure (Stripe Hosted Checkout, PayPal Smart Buttons, Fygaro Hosted Page). CariHub stores only gateway-issued payment-method tokens (which are opaque references that cannot be used to retrieve the underlying card data), card-brand and last-four digits (for display), and token expiry. CariHub completes an annual PCI DSS Self-Assessment Questionnaire A (SAQ A) under PCI DSS v4.0.1, the lightest compliance tier, which applies where all cardholder-data functions are fully outsourced to PCI-DSS-compliant third parties and the merchant stores no card data itself. Manual bank transfer receipt files (uploaded images and PDFs) are stored in encrypted object storage at rest (AES-256-GCM, server-side encryption).

12.2 Encryption in Transit. All data transmitted between your browser or device and the Platform is encrypted using TLS 1.3 (Transport Layer Security). We enforce HTTPS across the entire Platform and use HSTS (HTTP Strict Transport Security) headers to prevent downgrade attacks.

12.3 Access Controls. We implement strict role-based access controls (RBAC) to ensure that only authorised personnel have access to personal data. Access is granted on a need-to-know basis and is regularly reviewed and audited.

12.4 Authentication and Authorisation. User accounts are protected by password-based authentication with minimum complexity requirements. We offer and, for certain access levels, require multi-factor authentication (MFA). API access is controlled through API keys and token-based authentication. Login sessions persist for up to thirty (30) days from your last activity to enable push notification click-throughs to land directly on the relevant alert. After 30 days of inactivity, re-authentication is required. You may end your session sooner by signing out manually.

12.5 Audit Logging. We maintain comprehensive audit logs of all access to and modifications of personal data. Audit logs include the identity of the user, the timestamp, the action performed, the IP address, the user agent, and the data affected. Audit logs are retained according to configurable retention profiles: critical-severity events for 730 days, high-severity events for 365 days, and standard business events for 90 to 365 days. Audit logs are regularly reviewed for unauthorised activity.

12.6 Network Security. Our infrastructure is protected by firewalls, intrusion detection systems, and DDoS protection provided by Cloudflare. We regularly conduct vulnerability assessments and penetration testing.

12.7 Employee Training. All employees and contractors with access to personal data receive regular training on data protection, information security, and their obligations under applicable data protection laws.

12.8 Incident Response. We maintain a documented incident response plan that defines procedures for detecting, containing, investigating, and remediating data security incidents.

12.9 Secure Development. We follow secure software development practices, including code reviews, static analysis, and security testing throughout the development lifecycle.

13. Data Breach Notification

13.1 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify affected users without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach, in accordance with our obligations under applicable data protection laws.

• (a) A description of the nature of the breach, including the categories and approximate number of individuals and data records affected.
• (b) The name and contact details of our Data Protection Officer (privacy@carihub.com).
• (c) A description of the likely consequences of the breach.
• (d) A description of the measures we have taken or propose to take to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.
• (e) Recommendations for steps the affected individual can take to protect themselves.

13.3 Where the breach is likely to result in a high risk to the rights and freedoms of individuals, we will also notify the relevant data protection authority or commissioner in the applicable Caribbean jurisdiction without undue delay and within seventy-two (72) hours.

13.4 We will document all personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken, regardless of whether notification is required.

California Consumer Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

1. Right to Know: You have the right to know what personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

1. Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (e.g., completing transactions, detecting security incidents, complying with legal obligations).

1. Right to Correct: You have the right to request correction of inaccurate personal information.

1. Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. You have the right to opt out of any future sale or sharing of your personal information.

1. Right to Limit Use of Sensitive Personal Information: You have the right to limit our use of your sensitive personal information (e.g., health data, precise geolocation) to that which is necessary to perform the services or provide the goods reasonably expected.

1. Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

1. Authorized Agent: You may designate an authorized agent to make requests on your behalf. We may require proof of authorization.

To exercise your CCPA/CPRA rights, submit a request through our Data Subject Access Request form or email privacy@carihub.caribbean with the subject line 'CCPA Request'. We will verify your identity and respond within 45 days, as required by California law.

For more information about California privacy rights, visit the California Attorney General's website at oag.ca.gov/privacy/ccpa.

14. Changes to This Privacy Policy

14.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will provide at least thirty (30) days' advance notice of material changes by:

• (a) Posting the updated Policy on the Platform and updating the "Last Updated" date at the top.
• (b) Sending an email notification to the address associated with your account.
• (c) Displaying a prominent in-app notification.

14.2 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy.

14.3 If you do not agree with any changes to this Privacy Policy, you may terminate your account by contacting support@carihub.com.

15. Caribbean Data Protection Law References

This Privacy Policy and our data processing practices comply with the following Caribbean data protection legislation, as applicable to the user's territory: Data Protection Act, 2011 (Act No. 12 of 2011) of Trinidad and Tobago (partially proclaimed); Data Protection Act, 2020 of Jamaica (fully enforceable since 1 December 2023); Data Protection Act, 2019-29 of Barbados (in force since 26 March 2021); Data Protection Act, 2017 of the Cayman Islands (in force since 30 September 2019); Data Protection (Privacy of Personal Information) Act, 2003 of The Bahamas (in force); Data Protection Act, 2023 (Act No. 18 of 2023) of Guyana (commencement pending); Data Protection Act, 2021 (Act No. 45 of 2021) of Belize (commencement pending); Data Protection Act, Cap 8.18 of Saint Lucia (partially in force since January 2023); Privacy Act, 2003 of St Vincent and the Grenadines (in force); Data Protection Act, 2018 of St Kitts and Nevis (commencement pending). The Turks and Caicos Islands have no standalone comprehensive data protection legislation. Antigua and Barbuda, Dominica, Grenada, and Montserrat have not enacted the OECS Model Data Protection Bill.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Data Protection Officer

CariHub Business Link (Operator of CariHub)

• Email: privacy@carihub.com
• General Support: support@carihub.com
• Website: carihub.com

We aim to respond to all privacy-related inquiries within five (5) business days.

By using the CariHub Platform, you acknowledge that you have read and understood this Privacy Policy.