Privacy Policy

1. Who we are

H.O.M.E.® (Home Ownership Made Easy) is a digital platform operated by Ferguson Law, a law firm practising in Jamaica. Our registered address is Kingston, Jamaica. References to "we", "us" or "our" mean Ferguson Law operating the H.O.M.E.® platform at home.fergusonlawja.com.

2. Personal data we collect

We collect personal information only when you voluntarily provide it or when it is automatically generated through your use of the platform:

• Identity data — full name, email address, phone number
• Assessment data — answers you submit in the readiness assessment
• Booking data — preferred dates, consultation topics, payment reference numbers
• Communication data — messages sent through the AI chat assistant or contact forms
• Technical data — IP address, browser type, pages visited, session duration (via analytics)
• Account data — email address and profile information if you create an account

We do not collect sensitive personal data (national ID numbers, financial account credentials, health information) unless you explicitly provide it in a free-text field.

3. How we use your data

We use your personal data to:

• Deliver your readiness assessment results and personalised action plan
• Process and confirm consultation bookings with Ferguson Law attorneys
• Connect you with professionals listed in the directory at your request
• Send transactional emails (booking confirmations, guide downloads, account notifications)
• Respond to enquiries submitted via chat, forms, or email
• Maintain records required for our professional legal obligations
• Improve the platform through aggregated, anonymised analytics

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal basis for processing

Under Jamaica's Data Protection Act 2020, we process your personal data on the following grounds:

• Contract — to perform a consultation booking or service you have requested
• Legitimate interests — to improve the platform and maintain security
• Consent — for marketing emails (you may withdraw consent at any time by clicking 'Unsubscribe')
• Legal obligation — to retain records required by law as a professional law firm

For visitors from the United Kingdom or European Union, we also rely on the equivalent lawful bases under UK GDPR and EU GDPR respectively.

5. Who we share your data with

We share personal data with the following categories of third-party processors only to the extent necessary to provide the service:

• Supabase Inc. — database and authentication (hosted in the United States; SOC 2 Type II certified)
• Resend Inc. — transactional email delivery (United States)
• Anthropic PBC — AI responses in the chat assistant (messages are processed but not retained for training)
• Vercel Inc. — website hosting and infrastructure (United States)
• Clerk Inc. — user account authentication (United States)

All processors are bound by data processing agreements. Where data is transferred outside Jamaica, we rely on standard contractual clauses or the processor's adherence to equivalent privacy frameworks.

6. Data retention

We retain personal data for as long as necessary to fulfil the purpose for which it was collected:

• Consultation enquiries — 7 years (professional legal records obligation)
• Booking records — 7 years
• Account profiles — until you delete your account, then 30 days
• Chat messages — 90 days, then anonymised
• Analytics data — 26 months (aggregated only)

After the applicable retention period, data is securely deleted or anonymised.

7. Your rights

Under the Data Protection Act 2020 and, where applicable, UK/EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — ask us to limit processing while a complaint is resolved
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for marketing emails at any time

To exercise any right, email contact@fergusonlawja.com with the subject line "Data Request". We will respond within 30 days. You may also lodge a complaint with Jamaica's Office of the Information Commissioner (OIC) or, for UK/EU visitors, your local supervisory authority.

8. Cookies

We use the following cookies:

• Essential cookies — session management and security (cannot be disabled)
• Preference cookies — remember your consent choices
• Analytics cookies — anonymised usage data to improve the platform (disabled until consent is given)

You can manage cookies through the consent banner on your first visit or through your browser settings.

9. Security

We apply industry-standard safeguards including:

• TLS encryption for all data in transit
• Row-level security on all database tables — each user and administrator can only access their own records
• Security headers (Content-Security-Policy, X-Frame-Options) on every page
• Access controls limiting staff access to personal data on a need-to-know basis

No transmission over the internet is completely secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify affected individuals and the OIC as required by the Data Protection Act 2020.

10. Children

This platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us immediately at contact@fergusonlawja.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page will always reflect the most recent version. Material changes will be communicated via email if you have an account.

12. International visitors — additional rights by jurisdiction

H.O.M.E.® is used by people in multiple countries. Depending on your country of residence, you may have additional rights under local law. Contact us at contact@fergusonlawja.com to exercise any of these rights — we respond within 30 days.

• EU & UK (GDPR / UK GDPR) — rights of access, rectification, erasure, restriction, portability, and objection. Supervisory authority complaints: ICO (UK), DPC (Ireland), or your local EU authority.
• United States — California (CCPA/CPRA) — right to know what we collect, right to delete, right to opt out of sale (we do not sell data), right to non-discrimination. Email us with subject 'CCPA Request'.
• South Africa (POPIA) — right to access, correct, delete, and object. Complaints to the Information Regulator (inforeg.org.za).
• United Arab Emirates (UAE PDPL, Federal Decree-Law No. 45 of 2021) — rights of access, correction, and deletion. We do not transfer UAE resident data internationally without adequate safeguards.
• India (DPDPA 2023) — right to access, correct, erase, and grieve. We process Indian residents' data only with consent or a lawful purpose under the Act.
• Qatar (PDPL, Law No. 13 of 2016) — rights of access, rectification, and objection. Data is processed lawfully and protected in cross-border transfers.
• Singapore (PDPA 2012) — right to access and correct. We collect only what is reasonably necessary and retain it no longer than required.

In all cases we commit to: collecting only what is necessary, being transparent about use, responding within 30 days, and never selling your personal data.

13. Contact us

For any privacy-related questions, requests, or complaints: Ferguson Law — H.O.M.E.® Privacy Email: contact@fergusonlawja.com Phone: (876) 658-2182 Address: Kingston, Jamaica