DATA PROTECTION
Our obligations under the Barbados Data Protection Act.
We are a Barbadian company, so the Data Protection Act 2019-29 is our primary framework. Because we work internationally, we apply the same standards to everyone and meet the additional requirements of other regimes where they apply to you.
Effective 25 August 2026
1Data controller
Versatile Group of Companies is the data controller for personal data collected through this website and in the course of our business.
St. Patrick's, Christ Church, Barbados BB17074
info@versatilegroupbb.com · +1 (246) 428-8077
Data-protection enquiries are handled by the group’s operations management. Write to the address above marked Data Protection and it will be routed appropriately.
2The data protection principles
The Act requires personal data to be handled according to a set of principles. Here is what each means in practice for us.
| Principle | How we meet it |
|---|---|
| Lawful, fair and transparent | We tell you what we collect at the point we collect it, and this notice and our Privacy Policy set out our lawful bases in full. |
| Collected for specified purposes | We collect to answer enquiries, deliver projects, and — where you agree — to send you news. We do not repurpose data for something unrelated without telling you. |
| Adequate, relevant, not excessive | Our forms ask only what is needed to route and answer an enquiry. Budget band and project brief are optional. |
| Accurate and kept up to date | You can ask us to correct anything inaccurate, and we act on it. Our team updates records as a project progresses. |
| Not kept longer than necessary | We operate published retention periods — see the Privacy Policy — and delete or anonymise data at the end of them. |
| Processed securely | Encryption in transit and at rest, access limited by role and enforced at the database, sensitive commercial fields restricted to decision-makers, and an audit log of access and change. |
| Respecting the rights of data subjects | We operate the request process in clause 4 and apply it to everyone, not only to people the Act covers. |
3Your rights under the Act
The Act gives you the right to:
- be informed whether we hold personal data about you, and to be given a description of it and the purposes for which it is held;
- access that data and be given a copy in an intelligible form;
- have inaccurate data rectified, blocked, erased or destroyed;
- prevent processing likely to cause substantial and unwarranted damage or distress;
- prevent processing for direct marketing at any time, without giving a reason;
- object to decisions taken solely by automated means that significantly affect you;
- data portability, where the data was provided by you and is processed by automated means;
- complain to the Data Protection Commissioner, and to seek compensation through the courts for damage caused by a contravention.
We do not make decisions about you by automated means. Enquiries are routed automatically to the right member of staff, but every one is reviewed by a person and routing has no legal or similarly significant effect.
4Making a request
Write to info@versatilegroupbb.com, or to our address marked Data Protection. Tell us what you want and give us enough detail to find your records — the email address or phone number you used, and roughly when you contacted us, is usually enough.
- Identity. We may ask you to confirm your identity. We would rather ask than send your information to the wrong person.
- Timing. We respond within the period the Act allows, and in any event within one month. If a request is complex we may extend, and we will tell you why before the first month is out.
- Cost. There is no fee. We may charge a reasonable administrative fee only where a request is manifestly unfounded or repetitive, and we will tell you before doing so.
- Agents. Someone may act for you with written authority.
There are limits. We may withhold information where releasing it would reveal another person’s personal data without their consent, prejudice legal proceedings or professional privilege, or where an exemption in the Act applies. We will tell you if we rely on one.
5International clients and other regimes
Our clients, consultants and suppliers are not only in Barbados. Where another regime applies to you, it applies alongside the Act and we meet it:
- EU and UK GDPR — for individuals in the European Economic Area or the United Kingdom. This includes the lawful bases set out in our Privacy Policy, the right to object and to data portability, and Standard Contractual Clauses or the UK Addendum for transfers out of those territories.
- CCPA / CPRA — for California residents. We do not sell personal information and do not share it for cross-context behavioural advertising. You may request disclosure, deletion or correction, and we will not discriminate against you for asking.
- PIPEDA — for individuals in Canada, including the requirement for meaningful consent and the right of access.
- Other Caribbean regimes — including Guyana and Saint Lucia, where our regional offices operate.
Where two regimes differ, we apply the higher standard rather than the minimum.
6Transfers out of Barbados
The Act restricts transferring personal data to a country without an adequate level of protection. Our hosting, database and email providers operate in the United States, so such transfers do occur.
We rely on written contracts with each provider requiring them to act only on our instructions and to maintain appropriate security, together with Standard Contractual Clauses where applicable, encryption in transit and at rest, and access controls limiting who can see what. A list of our providers and where they operate is in the Privacy Policy.
7If something goes wrong
We maintain procedures for detecting, investigating and reporting personal data breaches. Where a breach is likely to result in a risk to your rights, we will notify the Data Protection Commissioner within the time the Act requires, and notify you directly where the risk to you is high.
Our internal audit log records sign-ins, changes, reassignments and exports, which is what allows us to establish quickly what happened and who was affected.
8Complaints
If you are unhappy with how we have handled your personal data, please tell us first at info@versatilegroupbb.com. We take complaints seriously and most are resolved quickly.
You also have the right to complain to the Data Protection Commissioner of Barbados, or, if you are outside Barbados, to the supervisory authority in your own country. Contacting us first does not affect that right.