Your Privacy Matters to Us

Privacy Policy - STEMpower Foundation

STEMpower Foundation ("we", "us", "our") is a youth-centered nonprofit initiative based in Jamaica. We are committed to protecting your personal data and handling it responsibly, transparently and in full compliance with Jamaica's Data Protection Act, 2020 (DPA).

This Privacy Policy explains what personal information we collect through this website and our programmes, why we collect it, how we store and protect it, how long we keep it and what rights you have over your data.

By using our website or submitting information through any of our forms, you agree to the collection and use of your personal data as described in this policy. If you do not agree, please do not submit your information.

Jamaica's Data Protection Act, 2020

The Data Protection Act, 2020 (DPA) is Jamaica's primary legislation governing the collection, processing, storage and transfer of personal data. Passed by Jamaica's Parliament in 2020 and fully in force since 2023, the Act establishes a comprehensive legal framework that applies to all organisations - public and private - that handle the personal data of Jamaican residents.

The DPA is comparable in structure and intent to the European Union's General Data Protection Regulation (GDPR) and similar legislation across the Caribbean, including Trinidad and Tobago's Data Protection Act 2011. It is enforced by the Office of the Information Commissioner (OIC).

As an organisation that collects and processes personal data from students, mentors, volunteers and partners - including individuals who may be under the age of 18 - STEMpower Foundation operates as a data controller under the DPA. This means we determine the purposes for which personal data is collected and the manner in which it is processed and we are legally responsible for ensuring that this is done in accordance with the Act.

The Eight Data Protection Standards

The DPA requires all data controllers to comply with eight data protection standards. Below is how STEMpower Foundation applies each standard to the way we handle your data.

What Personal Data We Collect

Depending on how you interact with STEMpower Foundation, we may collect the following categories of personal data:

Contact & Identity Information

• Full name
• Email address
• Organisation or school name
• Role or position (e.g. student, teacher, mentor)

Programme-Specific Information

• STEM field or area of study / profession (for mentor applications)
• Mentorship preferences and availability
• Motivation and personal statements submitted through application forms
• School visit requests and scheduling information

Communications

• Messages submitted through our contact form
• Email correspondence with our team
• Newsletter subscriptions (email address only)

Why We Collect Your Data

Under Standard 1 and Standard 2 of the DPA, we must have a clear, lawful purpose for collecting personal data. Our legal basis for processing is your informed and freely given consent, in accordance with Section 23(1) of the Act. We collect and process personal data for the following specific purposes only:

• To process and respond to contact form submissions - so we can reply to your enquiry, request, or message.
• To process mentor applications - to review, assess and follow up on applications to join the STEM & Still Standing Mentorship Programme.
• To coordinate school visit requests - to plan and schedule STEM school tours and outreach at your institution.
• To process volunteer and partnership enquiries - to connect you with the appropriate member of our team.
• To send newsletter updates - only if you have explicitly opted in and only about STEMpower Foundation programmes, opportunities and resources.
• To maintain internal records - for programme delivery, reporting and compliance purposes.

We will never use your data for direct marketing unrelated to our programmes, sell it to third parties, or use it for any purpose not stated above without first contacting you and obtaining fresh consent.

How We Store & Protect Your Data

Under Standard 7 of the DPA, we are required to implement appropriate technical and organisational measures to keep your data secure. Here is how we do that:

• Google Workspace - Form submissions are stored in Google Sheets accessible only to authorised members of the STEMpower Foundation executive board. Google's infrastructure is encrypted at rest and in transit and complies with international data protection standards including GDPR.
• Access controls - Only named members of our executive board have access to data submissions. Access is role-based and reviewed regularly.
• No public sharing - We do not share, publish, or display any personal data submitted through our forms publicly.
• Secure email - Internal communications containing personal data are handled through secured email accounts.

Special Protections for Students & Minors

STEMpower Foundation works directly with students, many of whom may be under the age of 18. The DPA requires special care when collecting and processing data relating to children and minors. We take this responsibility very seriously.

In addition to the standard protections in this policy, we apply the following measures specifically for student data:

• Student data is stored separately from adult/mentor data and is subject to stricter access controls.
• We collect only the minimum information necessary - typically name, school and contact email - and nothing beyond what is required for programme participation.
• Student data is never shared with third parties, sponsors, or partners without explicit written consent from the student and their parent or guardian.
• We have a clear deletion protocol - student data is deleted within 12 months of programme completion unless the student or guardian requests earlier deletion.
• Any photographs or media featuring students taken at school tours or events will only be used with written consent and will never be published without approval.

Your Rights Under the DPA

Under Jamaica's Data Protection Act, 2020, you have the following rights with respect to your personal data. You may exercise any of these rights at any time by contacting us at stempowerfoundation@gmail.com.

Third-Party Services & Data Sharing

STEMpower Foundation uses a small number of trusted third-party services to operate this website and deliver our programmes. Where these services involve the processing of personal data, we have ensured they operate to a standard consistent with the DPA.

• Google Workspace (Google LLC) - We use Google Forms and Google Sheets to collect and store form submissions. Google operates under its own Privacy Policy and is certified under international data protection frameworks including GDPR. Data is stored on Google's servers. You can view Google's Privacy Policy at policies.google.com.
• Google Fonts - This website loads fonts from Google Fonts. This may involve your browser making a request to Google's servers. No personal data is transmitted in this process beyond standard browser information.

We do not share your personal data with sponsors, partner organisations, schools, or any other third party without your explicit consent. We do not use your data for advertising. We do not sell data.

How Long We Keep Your Data

Under Standard 5 of the DPA, personal data must not be kept for longer than is necessary for the purposes for which it was collected. The following retention periods apply to data collected by STEMpower Foundation:

• Contact form submissions - Retained for up to 12 months from the date of submission, or until the matter raised has been fully resolved, whichever comes first.
• Mentor applications - Retained for the duration of the mentorship programme cycle plus 6 months thereafter, then securely deleted.
• School visit requests - Retained for 12 months from the date of the visit, then deleted.
• Volunteer enquiries - Retained for the duration of active volunteering plus 6 months, then deleted.
• Newsletter subscribers - Retained until you unsubscribe. You may unsubscribe at any time by emailing us.
• Student data (minors) - Retained for a maximum of 12 months from the end of the relevant programme, then deleted unless legal obligations require otherwise.

At the end of each retention period, data is permanently and securely deleted from all storage systems. You may request earlier deletion of your data at any time - see Your Rights above.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make significant changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Where changes are material, we will make reasonable efforts to notify affected individuals directly - for example, by email if you are a current programme participant.

Continued use of our website or participation in our programmes after changes have been posted constitutes acceptance of the updated policy.

Questions About Your Privacy?

If you have any questions about this Privacy Policy, wish to exercise any of your rights under the DPA, or want to make a complaint about how we have handled your personal data, please contact us:

If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Information Commissioner (OIC), the authority responsible for enforcing the Data Protection Act in Jamaica:

• Website: oic.gov.jm
• The OIC is empowered to investigate complaints, conduct audits and impose penalties for non-compliance with the DPA.