Website Privacy Notice

1. Introduction

Manchester Co-operative Credit Union (1977) Limited (“MCCU”, “we”, “us”, “our”) is a member-centric, financially-sound and technologically-enhanced credit union, with a mission to improve the quality of life of its members and their families, through the provision of personalized financial solutions and advice.

At MCCU, we are committed to protecting your privacy. We ensure that the processing of your Personal Data is compliant with Jamaica’s Data Protection Act (JDPA), and any country-specific data protection laws and regulations to the extent applicable to MCCU. We have also implemented a number of technical, organizational and physical measures to ensure the most complete protection of Personal Data processed through the Site or use of our Services.

We have prepared this Privacy Notice to describe to you our practices regarding the personal information we collect from our members and users of our website. It describes how MCCU collects, uses, shares and stores your Personal Data, and informs you of your rights regarding your Personal Data. This Privacy Notice applies to data we collect when you use our website, subscribe to our newsletter, take part in a survey, access our products and services, or through any other marketing initiatives.

When you visit our website, you are free to explore without providing any Personal Data about yourself. We only collect Personal Data from you when you register, subscribe to a service or fill out a form.

2. How we collect data

We may collect your Personal Data through the following means:

• Information you provide via our website, social media networks or events: any Personal Data that you choose to send or provide to us via our website, social media, or when registering for or attending an event.
• Information you provide when accessing our services: information you provide directly to us to access our products and services; for example, when applying to become a member, opening an account, or transacting at our offices.
• Third parties: in some instances we collect Personal Data from public and non-public sources and third parties for regulatory purposes or to better serve you, including credit bureaus, references, other financial institutions, regulatory bodies and related entities.

3. Types of data we collect

We collect a wide range of Personal Data to allow us to conduct business with you. The types we may collect directly from members, prospective members, visitors and users of our website include:

• Valid photo ID: for example a Passport, Driver’s Licence or ID card
• Taxpayer’s Registration Number (TRN)
• National Insurance Number (NIS)
• Proof of employment and employment status & details
• Address, including proof of address and past addresses
• Email address and character references
• Birth certificate and mother’s maiden name
• Declaration of US citizenship / tax residency, if appropriate
• Politically Exposed Person status
• Financial information and transaction records
• Image capture via CCTV or webinar recording

In operating our website, we may also collect:

• Log Data: processed to operate our website, provide our services, ensure security, maintain database back-ups and communicate with you.
• Google Analytics: collected so that we can improve our website and access to it.
• Cookies: small pieces of information a website sends to your device to gather information about the date and time of your visit and the content you searched for and viewed. On your initial visit you may accept or refuse cookies and choose the type you accept or reject; you may also configure your browser so no cookies are stored. We may use both session cookies (which expire when you close your browser) and persistent cookies (which remain until you delete them) to provide a more personal and interactive experience, enable automatic logins and content customization.

4. Bases for collecting personal data

• User consent: we obtain your clear, informed and freely given consent before processing your Personal Data, except where it is not possible but your data still needs to be processed (e.g. legal obligations, or to protect your vital interests, the public interest or the administration of justice). You may withdraw consent at any time.
• Contractual obligation: we may process your data in contemplation of entering into a contract with you or to fulfil existing contractual obligations.
• Legitimate interest: we process your data to efficiently provide and market our services, but not where doing so poses a risk to your rights, freedoms and vital interests.
• Legal obligation: we may process your data to comply with the law, including information about criminal convictions to investigate suspected financial crimes, fraud and threats, and to share data with law enforcement and regulatory bodies. We are also legally obliged to assess affordability and suitability of credit throughout the relationship.

5. How we use your personal data

We may use the information we collect in connection with the services we provide for a range of reasons, including to:

• provide our products and services;
• process and complete transactions, and send related information including transaction confirmations and records;
• manage members’ use of the services, respond to enquiries and comments, and provide customer service and support;
• send alerts, updates, security notifications and administrative communications;
• verify your identity, creditworthiness and the accuracy of information provided;
• prevent criminal activity, fraud and money laundering;
• trace debtors and recover debts;
• investigate and prevent fraudulent activities, unauthorized access and other illegal activities; and
• any other purposes about which we notify members and users.

6. Third parties and international data transfers

Our website may contain links to other sites that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party site or service.

We may disclose your Personal Data to third parties to whom you expressly ask us to send it, or for whom you consent. Third parties include our partners, affiliates, service providers and professional advisors. Personal Data may also be shared with regulators to demonstrate compliance with legal obligations. Personal Data will only be shared to provide our services to you and/or to comply with legal obligations; these third parties do not retain, share, use or process personal data beyond the defined purpose of providing our services to you.

Where we transfer your Personal Data outside of Jamaica, we do so only to a country or territory that ensures an adequate level of protection, or where appropriate safeguards or your consent are in place, as required by the JDPA.

7. How we protect your personal data

MCCU is committed to protecting the security of your Personal Data. We (and our third-party service providers) use a variety of industry-standard security technologies, procedures and organizational measures to help protect your data from unauthorized access, use or disclosure, such as:

• vulnerability scanning and/or scanning to PCI standards;
• regular malware scanning;
• storing Personal Data behind secured networks, accessible only by a limited number of persons with special access rights who are required to keep it confidential: sensitive information is encrypted via Secure Socket Layer (SSL) technology;
• a variety of security measures when a user enters, submits or accesses their information; and
• processing all transactions through a gateway provider, so they are not stored or processed on our servers.

However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while MCCU uses reasonable efforts to protect your Personal Data, we cannot guarantee its absolute security.

8. Your rights

Under Jamaica’s Data Protection Act, data subjects enjoy the following rights:

• Right to access your personal data: make a written request to be informed whether your data is being processed, request a copy of your data, or request that it be transferred to a third party.
• Right to be informed about automated decision making: request in writing that decisions made solely on the basis of automated processing be reconsidered with human involvement.
• Right to prevent processing: make a written request that we cease or not begin processing your data in a specific manner or for a specific purpose.
• Right to rectification: request that inaccuracies be rectified (amended, blocked, erased or destroyed), and that your data be erased on the expiration of any applicable retention period.
• Right to prevent direct marketing: ask us at any time to stop processing your Personal Data for direct-marketing purposes, such as newsletters and promotional messages.
• Right to complain to the Information Commissioner: if you are dissatisfied with how we handle your Personal Data or respond to a request, you may lodge a complaint with the Office of the Information Commissioner.

9. Retention policy

We retain your Personal Data only for as long as necessary to provide our services to you, to fulfil the purposes for which it was collected, and to comply with applicable legal and regulatory requirements. Retention periods are determined in accordance with MCCU’s Records Retention and Disposal Schedule. We therefore typically retain members’ Personal Data for a minimum of seven years following the date of transaction or termination of the customer relationship. We may keep your data for longer than seven years if we cannot delete it for legal, regulatory or technical reasons.

10. Notifiable data breaches

We take data breaches very seriously. We will endeavour to meet the 72-hour deadline imposed by the JDPA to report any data breach to the Information Commissioner. Where there is likely to be a high risk to your rights, we will endeavour to contact you without undue delay. Our report will inform you of:

• the nature of the security breach;
• the measures taken or proposed to mitigate or address the possible adverse effects of the breach; and
• the name, address and other relevant contact information of our Data Protection Officer or other designated representative.

We will review every incident and/or breach and take action to prevent future incidents or breaches.

11. Children’s privacy

Our services are not offered to persons under the age of 18 without parental or guardian consent. Any information that is in breach of this provision will be deleted. If you become aware that a child has provided us with information, please contact our Data Protection Officer.

12. Changes to this privacy notice

Data privacy and protection is an ongoing responsibility, and so this Privacy Notice is subject to occasional revision to ensure it remains in line with the ever-evolving regulatory and security landscape. MCCU reserves the right, at its sole discretion, to modify or replace any part of this Privacy Notice. It is your responsibility to check this Privacy Notice periodically for changes; the last date of modification is noted below. Continued use of our Site or Services indicates your acknowledgement that it is your responsibility to review this Privacy Notice periodically and become aware of any modifications. Changes are effective once uploaded to our website.

13. Contact information

MCCU welcomes your comments or questions regarding this Privacy Notice. If you have a question or comment, would like to make a complaint, or need to report a data protection concern or breach, please contact our Data Protection Officer using the details below.

If at any time you would like to unsubscribe from receiving future emails, you can email us at dpo@mccuja.com and we will promptly remove you from ALL correspondence.

Last update: 13 July 2026