top of page
24 Loci Markers, Probably the most accurate paternity test in Jamaica.
Privacy Policy
Your Data — You Own It, We Respect It. Whos The Daddy operates in strict compliance with global data protection standards, including the United Kingdom Information Commissioner’s Office (ICO) guidelines, the UK/EU General Data Protection Regulation (GDPR), Jamaica’s Data Protection Act (DPA), and relevant North American state and federal privacy laws.
1. A NOTE FOR OUR UNITED STATES & CANADIAN CLIENTS
While our commercial and business operations are headquartered in Jamaica, we offer our specialised testing services to a worldwide audience. If you are accessing our website or purchasing our services from North America, this policy is intentionally built to acknowledge, protect, and respect your regional consumer rights. This includes compliance frameworks aligned with United States State Privacy Laws (such as the California Consumer Privacy Act / CPRA) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Your specific data rights—including access, deletion, and transparency regarding sensitive biological data—are fully integrated into our global data safety standards.
2. ABOUT US AND IMPORTANT INFORMATION
Purpose of This Privacy Notice
At Whos The Daddy, we understand that protecting the privacy of visitors to our website is paramount. This privacy notice explains how and why we collect, use, and safeguard personal information when you visit our website (regardless of where you access it from), including any information you may provide through our interactive forms.
Hosting and Website Technology Platform
Our website, underlying digital database infrastructure, and content management systems are built on enterprise-grade, globally distributed cloud hosting architecture. This platform provides secure server networks, data isolation layers, and multi-layered physical and software protection to keep transaction data safe.
Company Details
Whos The Daddy is a commercial brand of Aqua Sports & Entertainment Xaymaca Ltd., a company legally registered in Jamaica under Company No. 88584. Aqua Sports & Entertainment Xaymaca Ltd. is the Data Controller and is legally responsible for your personal information.
Designated Data Protection Officer (DPO)
Because our core operations involve processing special category data (specifically genetic, biometric, and biological information), we have appointed a statutory Data Protection Officer (DPO) in strict compliance with international legal frameworks. The DPO is responsible for overseeing all questions, audits, and operations in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal data rights, please contact our DPO directly at: compliance@whosthedaddy.net.
Children's Data: Our website is not intended for children, and we do not knowingly collect personal information relating to children without the express, verifiable written consent of a parent or legal guardian.
Children's Data
Our website is not intended for children, and we do not knowingly collect personal information relating to children without the express, verifiable written consent of a parent or legal guardian.
External Links and Third-Party Sites
Our website contains links to third-party websites, plug-ins, and digital applications. This privacy notice applies exclusively to WhosTheDaddy.net. Clicking on external links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy standards.
3. THE DATA WE COLLECT ABOUT YOU
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been completely removed (anonymous data).
We may collect, use, store, and transfer different kinds of personal information about you when you access our website and employ our testing services, which we have grouped together as follows:
• Identity Data: Includes your first name, last name, date of birth, title, gender, ethnicity, corporate name (if applicable), and your presumed or established relationship status to other tested individuals. If you apply for a career opening or professional role at Whos The Daddy, you will be asked to send your CV and a covering letter, which will include additional information about your employment history, qualifications, and background.
• Contact Data: Includes your billing address, delivery/home address, email address, and contact telephone numbers.
• Financial Data: Includes your financial payment details, which will be used solely for the purposes of processing secure transactional payments in accordance with your contract with us.
• Biometric & Technical Verification Data: Includes photographic images or physical identification documents submitted by you for the explicit purpose of confirming and verifying your legal identity.
• Biological Sample Data: Consists of physical biological samples (routinely oral saliva or buccal swabs). The biological sample will be identified with a minimum of your unique alphanumeric tracking ID, name, and date of birth to maintain an unbroken, strict chain of custody. Physical samples will be analysed and processed solely so that we can perform the specific genetic testing services you have contractually requested from us.
• Genetic Information: Genetic information refers to the specific features, full chromosomal profiles, genomic sequences, or individual DNA markers extracted from the physical biological sample you provided to us. We use this genetic information exclusively to provide information such as your connection to genetic relatives or ancestry profiles in accordance with your contract with us.
• Technical Data: Includes the domain name of the website providing you with internet access, your internet protocol (IP) address used to connect your computer to the internet, browser type and version, time zone setting, browser plug-in types, the operating system your device is running, and other site visit data such as the pages you view and the terms you search for.
• Usage Data: Includes information about how you use our website, browse our pages, and interact with our products and services.
• Marketing and Communications Data: Includes your preferences in receiving information or promotional materials from us and our third parties, and your stated communication choices.
We may also collect, use, and share Aggregated Data such as statistical or demographic data for internal business operations. Aggregated Data may be derived from your personal information but is not considered personal information in law as it does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the
combined data as personal information which will be used in strict accordance with this privacy notice. We do not collect any information regarding criminal convictions or offenses.
Failing to Provide Personal Information
Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our genetic testing services). In this case, we may have to cancel a product or service, but we will notify you immediately if this is the case. Please refer to our Terms and Conditions for further information pertaining to the cancellation of tests.
4. HOW YOUR PERSONAL DATA IS COLLECTED
We may collect personal information from you using the following methods:
• Direct Interactions: You may give us your Identity, Contact, and Financial Data by filling in forms (such as our ‘Book This Test’ or ‘Contact Us’ forms) or by corresponding with us by post, phone, email, or otherwise. This includes personal data you provide when you purchase our products, use our customer service tools, subscribe to our mailing lists, enter a promotion or survey, or give our team feedback on our services.
• Automated Technologies or Interactions: As you interact with our website, our server infrastructure may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal information by using cookies, web beacons, and other similar technologies.
• Third Parties or Publicly Available Sources: We may receive technical personal information about you from various third parties and public sources, including global analytics providers and search information networks.
5. HOW WE USE YOUR PERSONAL INFORMATION (LEGAL BASES)
We only ever use your personal information when global data laws allow us to. Most commonly, we will use your personal information in the following circumstances:
• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.
• Where we have received your express, explicit opt-in consent.
We will only use your information for the specific purpose it was collected, unless we reasonably consider that we need to use it for another reason and that reason is fully compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in strict compliance with the above rules, where this is explicitly required or permitted by law.
Primary operational processing activities mapped to their legal bases:
• Customer Registration: Processed under the legal basis of Performance of a Contract to establish your account.
• Kit Delivery, Processing, & Financial Payments: Processed under the legal basis of Performance of a Contract to fulfil your order.
• DNA Extraction & Genetic Analysis: Processed under the legal basis of Explicit, Affirmative Consent because genetic data constitutes sensitive, special category information.
• Identity Verification & Fraud Prevention: Processed under the legal basis of Explicit Consent and Legitimate Business Interests to protect the integrity of legal or relationship testing.
Separate Opt-In for Research and Parameters
Our standard service agreement permits our laboratory partners to utilise your data and results in an entirely anonymised, un-traceable manner for studies relating to statistical and genetic parameters for DNA testing. This prevents the identity of any individual from being traceable. However, in strict adherence to Article 9 of the GDPR and Jamaica's DPA, any use of your surplus biological samples or identifiable genetic profiles for broader scientific, research, or medical studies requires a separate, explicit opt-in checkbox at the time of registration. You have the right to withhold or withdraw this research consent at any moment without it impacting your standard testing services.
6. DISCLOSURES OF YOUR PERSONAL DATA (THIRD PARTIES)
We will never sell your personal information or share it with third parties who might use it for their own independent commercial purposes without your express opt-in consent.
Any third parties handling personally identifiable information, such as our email marketing systems (Mailchimp) and our specialised laboratory sub-processors, act strictly as Data Processors on behalf of Whos The Daddy. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our direct, written instructions.
We may have to share your personal information with the parties set out below:
• Platform Infrastructure Providers: Personal data collected via forms, traffic logs, and registrations is securely transmitted through and processed by our enterprise website hosting and server networks.
• Service Providers: This includes accredited laboratory sub-processors, specialised sample collection technicians, logistics couriers, and IT/system administration service providers.
• Professional Advisers: Including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Regulators and Authorities: Government commissioners, tax authorities, and other official regulators who require reporting of processing activities in certain circumstances (such as Jamaica's OIC or the UK ICO).
• Business Transfers: Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, the new owners may use your personal information in the same way as set out in this privacy notice.
To protect our proprietary trade secrets, unique global supply lines, and operational network security, we disclose our third-party laboratory partners by operational category and geographic region rather than full corporate entity names.
7. INTERNATIONAL DATA TRANSFERS & REGIONAL ROUTING
Because Whos The Daddy is a global service based in Jamaica, your personal data and physical biological samples will cross international borders depending on the specific testing product purchased. To maintain full legal compliance, we route specialised testing only to accredited, specialised laboratory networks in the following regions:
• Relationship Testing: Transferred contractually to accredited laboratory facilities located in the USA, Canada, the UK, Australia, or China.
• Ancestry Testing: Routed exclusively to our specialised ancestry laboratory infrastructure in the UK.
• Whole Genome Sequencing (WGS): Routed contractually to our advanced, clinical-grade genomic sub-processing partners. Physical sequencing, multiomics processing, and clinical extraction are performed directly within highly accredited clinical-grade labs located in Italy and the United Arab Emirates (Dubai), or within vetted, highly accredited partner laboratory networks across the United States and Europe.
Cross-Border Safeguards
For transfers out of the UK, EEA, or Jamaica to third countries that do not have a blanket adequacy agreement, we implement robust legal transfer mechanisms to ensure your data receives the same elite level of protection it has under the GDPR:
• We enforce strict, pre-approved Standard Contractual Clauses (SCCs) and International Data Transfer Addendums that legally bind overseas labs to international security standards.
• For US-based data tools or infrastructure, we ensure our partners maintain valid certifications under the active EU-U.S. Data Privacy Framework (DPF).
If you explicitly request an ad-hoc transfer of your personal information to an unvetted third party outside of these safeguards, the legal expectation is placed upon you as our customer to ensure that appropriate levels of data protection are in place by the data recipient.
8. DATA SECURITY AND CHAIN OF CUSTODY
We employ exceptional technical, physical, and organisational security measures to keep your personal information, biological samples, and high-risk genetic files safe and to prevent accidental loss, misuse, alteration, or unauthorized access. These measures include enterprise-grade database encryption, secure firewalls, network isolation layers, secure HTTPS data transmission, and strict password protection.
We maintain a logged, legally binding chain of custody for every biological sample from the moment it is collected until its analytical destruction. We have also put in place strict internal procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. It remains your responsibility to ensure that your personal device used to access our website is adequately secured and protected.
9. DATA RETENTION AND SAMPLE DESTRUCTION
We will retain your data only for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, clinical, accounting, or reporting requirements.
Our standard digital retention period for customer files, digital genetic profiles, and case histories will usually be 2 years from when we have fulfilled the purposes we collected it for (the date the final test results are delivered to you). This timeframe is adjusted based on the nature, sensitivity, and potential risk of harm from unauthorised disclosure of the information, and applicable legal retention requirements.
Physical biological samples (buccal swabs/saliva) are held securely by our laboratory partners and are permanently incinerated or chemically destroyed post-testing within standard laboratory parameters. You maintain the right to request that your digital profile and records are destroyed prior to this 2-year date by contacting our DPO at compliance@whosthedaddy.net.
10. YOUR LEGAL DATA RIGHTS
We want to ensure you remain in total control of your personal information. Under global data protection laws (including the UK GDPR, Jamaica DPA, and North American privacy standards), you have comprehensive, enforceable rights regarding your personal and genetic data:
• Right of Access (DSAR): You can request a copy of all personal information, case records, and digital genetic profiles we hold about you.
• Right to Rectification: You can demand the immediate correction of inaccurate or incomplete personal records we hold about you.
• Right to Erasure ('Right to be Forgotten'): You can ask us to delete or destroy your personal data where there is no overriding legal, clinical, or contractual reason for us to continue processing it.
• Right to Restrict or Object: You can object to, or request that we completely suspend, the processing of your data (e.g., opting out of marketing tracking or profiling).
• Right to Data Portability: You can request the transfer of your digital data profiles to you or a designated third-party provider in a structured, machine-readable, commonly used format.
• Right to Withdraw Consent: Where we rely on your explicit consent to process your genetic, biological, or biometric data, you can withdraw that consent at any moment.
Executing Your Rights
To exercise any of these rights, please email our DPO at compliance@whosthedaddy.net. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We try to respond to all legitimate requests within one calendar month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. For security purposes, we will require specific identity verification data before releasing any records to ensure data is never disclosed to an unauthorised individual.
Right to Lodge a Complaint
You have the right to lodge a formal complaint regarding our data practices at any time with the appropriate regulatory body:
• In the UK: The Information Commissioner’s Office (ICO) at www.ico.org.uk.
• In Jamaica: The Office of the Information Commissioner (OIC) at www.oic.gov.jm.
We would, however, sincerely appreciate the chance to deal with your concerns internally before you approach a government commissioner, so please contact our DPO in the first instance.
11. CHANGES TO THIS STATEMENT
Our privacy policy may be updated from time to time, and the latest version will always appear on the Whos The Daddy website, superseding any previous agreements.
This privacy notice was last updated on 30th August 2026
bottom of page