3.   Why We Collect Data (Purpose & Legal Basis)
AFS may process, transfer, and share personal data for several purposes, including but not limited to the following:

3.1  Performance of a Contract

AFS processes personal data to fulfill contractual obligations, including:
 

• Assessing loan applications and conducting credit checks

• Managing and servicing loan accounts

• Communicating about personal accounts or services

• Providing customer support

3.2   Legal Obligation

AFS processes personal information to meet legal and regulatory requirements, including:
 

• Consent – where an individual has given clear and specific permission for AFS to process personal information for particular purposes.

• Regulatory and legal compliance – to meet obligations under laws and regulations, such as KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements.

• Prevention of financial crime – to perform activities necessary to prevent fraud, money laundering, or other financial crimes.

3.3   Legitimate Interests of AFS

AFS may process personal data where it is necessary for the Company’s legitimate
interests, provided these interests do not override individual rights. Examples include:

•    Recovering debts owed to AFS 
•    Investigating and preventing fraudulent activity
•    Using CCTV on Company premises to:

• Ensure the safety and security of employees, visitors, and property

• Support the administration of justice, including cooperating with law enforcement in case of an incident

• Defend or initiate legal claims, such as filing or defending lawsuits

4.    How AFS uses personal information

AFS uses personal information for the following purposes:

​

• To offer, administer, and manage the products and services provided, including updating and maintaining personal records.

• To verify identity and ensure the accuracy of information provided.

• To perform KYC due diligence checks.

• To improve the Company’s website and services.

• To ensure compliance with internal controls and external regulatory requirements.

• To enforce contracts and recover any outstanding debts related to the services provided.

• To fulfill legal and regulatory obligations.

• To respond to requests and provide customer support.

5.    Data Retention

AFS retains personal data only for as long as necessary to fulfill the purposes described in this Notice or as required by law. Under the Microcredit Act, 2019, the Company is required to retain personal data for 7 years from the date it was collected or from the date a loan is repaid, whichever is later. In certain circumstances, AFS may retain personal data for longer than 7 years for legal, regulatory, or technical reasons.

6.    How Information is Protected

AFS implements industry-standard security measures to safeguard personal data, including:

​

• Encrypted data transmission (HTTPS/SSL)

• Secure server infrastructure, including firewalls and antivirus protections

• Access controls and password protection to limit access to authorized personnel only

• Secured physical storage, such as locked cabinets for paper records

• Regular audits and security updates to maintain the integrity and safety of systems

7.    Sharing of Personal Information

AFS does not rent or sell personal data. Personal data is shared only when legally permitted or necessary to deliver, administer, and manage the Company’s services.

AFS may share personal data with the following categories of recipients:
 

• Within AFS – between departments, as required to provide services

• Third-party service providers – for IT support, cloud storage, verification, and related services

• Regulators and legal authorities – where required by law or regulation

• Credit reporting agencies – for creditworthiness checks

• Third parties at the client’s request or with the client’s consent

• External auditors – where necessary for audits of the Company

• Debt recovery agents – to recover outstanding amounts owed to the Company

8.    Accuracy of Information

AFS relies on accurate personal data to provide and manage its services effectively. Clients are responsible for informing the Company of any changes to their personal information, including updates to contact details or any other information that may affect the proper management and administration of services.
 

9.    Information Security

AFS has implemented appropriate technical and organizational measures to protect the confidentiality, integrity, and availability of personal data, ensuring that it is processed in accordance with applicable data privacy laws.

Security measures include, but are not limited to:
 

• Firewalls and antivirus protections

• Encryption of sensitive data

• Regular software updates

• Written policies and procedures governing data handling

• Restricted access to personal information, limited to staff who require it to perform their roles

These measures are regularly audited and reviewed at the senior management level.

Additionally, CCTV is used on Company premises as a deterrent and to help protect the personal data of staff and customers.
 

11.    Marketing

AFS may send marketing communications by mail, phone, email, text, or other electronic means only with the consent of the customer, typically provided through the completion of a direct marketing form.

Customers can withdraw their consent at any time by:
 

• Clicking the unsubscribe link in email communications, or

• Contacting the Company directly.

For contact details, please refer to the “Contact Us” section of this Privacy Notice.
 

12.    Rights Under the Data Protection Act (2020)

The Data Protection Act, 2020 (Jamaica) provides individuals with the following rights regarding their personal data: