Privacy notice
Garrison · Hamilton, Bermuda · Last updated 3 November 2026
This notice explains what personal information Garrison collects, why, and what rights you have. It is written to meet the Personal Information Protection Act 2016 (PIPA), which is enforced by the Office of the Privacy Commissioner for Bermuda.
Who we are
Garrison provides senior technology leadership and technology compliance to Bermuda's regulated firms. Until the company is incorporated, it is operated by Adam Wenham trading as Garrison, Hamilton, Bermuda.
Privacy officer: Adam Wenham, adam@garrison.re, +1 441 732 2308. Direct any question, request or complaint about personal information to him.
What we collect and why
We do not collect sensitive personal information as PIPA defines it (for example health, race, religion, sexual orientation, family status, biometric or genetic information) on purpose. If it appears in client material, we do not extract, copy or comment on it, and it is deleted with the rest of the material.
Who sees it
- People working on an engagement. A named second reviewer and a contract cyber specialist may see client material. Each is bound by a written confidentiality agreement and sees only what their part of the work needs.
- Service providers. Google (Google Workspace, for email and document storage) and Gamma (website hosting). Each is an overseas third party under PIPA and holds the information under its standard business terms, which include confidentiality, security and breach-notification commitments.
- Professional advisers. Our lawyers, accountants and insurers, where needed for the work or a claim.
- No one else. We do not sell or share personal information for marketing. We never contact the Bermuda Monetary Authority or the Privacy Commissioner about a client without the client's instruction, and we disclose personal information to a regulator, court or law enforcement only where the law requires it.
Where it goes
Our email, storage and website hosting run on Google's and Gamma's services, whose data centres are in the United States and the European Union. Before personal information leaves Bermuda, PIPA requires us to assess whether it will receive a comparable level of protection and, where it will not, to put a contractual or other mechanism in place. We have recorded that assessment for each provider; we rely on their contractual commitments, encryption in transit and at rest, and access limited to named people. The risk, where protection in the destination is not comparable, is that the information is subject to that country's laws and authorities. During an engagement, client material stays in the client's own systems wherever the client prefers; where it does not, the engagement letter states where it is held.
How long we keep it
How we protect it
Encryption in transit and at rest; multi-factor authentication on every account; access limited to named people; no personal information in public AI tools; devices encrypted and managed. We review these safeguards periodically. If we become aware of a breach of the security of your information, including loss of access to it, that is likely to adversely affect you, we notify the Privacy Commissioner and then you, without undue delay.
Your rights
Under PIPA you may ask us:
- what personal information we hold about you, and for a copy;
- to correct it if it is wrong or incomplete;
- to block, erase or destroy it where its use is unlawful or we no longer need it;
- to withdraw consent, where consent is the basis we rely on.
Write to adam@garrison.re. We acknowledge your request in writing and respond within 45 days, as PIPA requires, extending by up to 30 days with reasons only where the Act allows. We do not charge for a request. Where we hold information only as part of a client engagement, we will tell the client of your request and respond with them, so that you receive one answer.
If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner for Bermuda at privacy.bm.
Children
Our services and website are for businesses. We do not knowingly collect information about children, and we offer no online service directed at anyone under 14.
Changes
We update this notice when our practices change and show the date at the top. Material changes to how we handle client material are reflected in engagement letters.
Garrison · Hamilton, Bermuda · adam@garrison.re
PRIVACY