Permission is the one rule that every framework touching a Kittitian or Nevisian business agrees on. The Data Protection Act, 2018 makes consent the general basis for using personal data. Canada’s CASL demands it before you send. The GDPR expects it to be freely given and provable. If you get permission right, most of the rest follows.
Please note: this is general information, not legal advice.
What counts as permission
Under section 7 of the Data Protection Act, you should not process someone’s personal data without their consent unless a specific exception applies, such as performing a contract. Sending a receipt or a booking confirmation is part of the contract. Sending next season’s villa offer is marketing, and marketing needs a separate yes.
A usable consent has four features:
- It is active. The person ticks a box, types an address into a sign-up form or replies to confirm. A pre-ticked box is not consent.
- It is specific. The form says what you will send: monthly offers from our Nevis restaurant is clear; updates is not.
- It is informed. Section 8 of the Act expects you to tell people the purpose, who else may receive the data and how to reach you.
- It is recorded. Keep the date, the source and the wording shown at the time.
The difference between single opt-in and double opt-in matters here. With double opt-in, the subscriber confirms through a link in an email, which gives you proof that the address is real and that its owner agreed. Mailpro’s double opt-in subscription does this automatically.
Where Kittitian and Nevisian businesses collect consent
The collection point shapes the wording. Some local examples:
- Hotel and villa check-in. Add a separate, unticked box to the registration card or tablet: Send me offers and news from the resort by email. Don’t bundle it into the terms of stay.
- Tour and cruise excursion bookings. Cruise passengers landing at Port Zante often book on the day. A QR code on the voucher that opens a Mailpro sign-up form lets them opt in on their own phone.
- Citizenship by Investment enquiries. Agents and developers receive enquiries from many countries. Keep enquiry handling and marketing separate: answering the question is fine, adding the person to a promotional sequence needs a clear opt-in, and GDPR or CASL may apply depending on where the applicant lives.
- Student and campus audiences. Businesses serving Ross University’s veterinary students in St Kitts should remember that students rotate every semester. Consent given by one intake does not carry to the next.
- Events. A paper list at a Culturama stall or a Sugar Mas fete should state what people are signing up for, and the list should be typed up and confirmed by email soon after.
Keeping permission valid
Permission is not permanent. Section 11 of the Act says data should not be kept longer than necessary, and a list full of people who stopped opening your emails two years ago is a deliverability risk too. Three habits help:
- Include an unsubscribe link in every message, and treat an unsubscribe as final.
- Run a re-permission email to long-inactive contacts once a year, and remove anyone who does not respond.
- Use Mailpro’s campaign statistics to spot segments that have gone quiet.
What not to do
Don’t buy lists, scrape addresses from the business directory or share a guest list with the sister property on the other island. Under section 9 of the Act, data should not be disclosed beyond the purpose stated at collection without consent. It also wrecks sender reputation: the reasons are laid out in why you should never buy email lists.
Once your permission process is solid, turn to the content itself with how to send effective email campaigns from St Kitts and Nevis, or read the broader guide to email marketing law in the Federation.