Privacy Policy - Canucks Autism Network

Canucks Autism Network Society

PURPOSE

The purpose of this Privacy Policy (the “Policy”) is to establish a framework for the collection, use, disclosure and retention of Personal Information by the Canucks Autism Network Society (the “Society”).

The Society respects and is committed to protecting the Personal Information that it collects and uses about its Staff, Donors and Participants as required under all applicable privacy legislation, including, without limitation, the British Columbia Personal Information Protection Act (“PIPA”).

The Society will only collect, use or disclose Personal Information for purposes that a reasonable person would consider appropriate in the circumstances.

DEFINITIONS

In this Policy, the following terms have the following meanings:

“Business Contact Information” means information used to contact an individual at a place of business, such as a business title, address, telephone number or email address.

“Minor” means any individual under the age of 19. For the purposes of this Policy, a Minor may exercise their own privacy rights, including providing consent, where the Society reasonably determines that the Minor has the capacity to understand the nature and consequences of the collection, use, or disclosure of their Personal Information.

“Participant” means any individual that accesses services provided by the Society, including Minors and parents or guardians of Minors.

“Donor” means any individual who directly contributes to or financially supports the Society.

“Employee Personal Information” means personal information collected, used or disclosed solely for purposes reasonably required to establish, manage or terminate an employment relationship. It does not include information unrelated to employment.

“Personal Information” refers to any information about an identifiable individual, including Employee Personal Information, but does not include Business Contact Information or work product information.

“Privacy Incident” means unauthorized or accidental access, collection, use, disclosure, loss, alteration, copying or disposal of Personal Information, or a failure of a safeguard.

“Privacy Officer” means the person designated by the Society to oversee compliance with PIPA and this Policy.

“Staff” means current and prospective employees, volunteers and contractors of the Society.

Other terms not specifically defined in this section will have the meanings given to them elsewhere in this Policy or as otherwise defined.

SCOPE

This Policy applies to the Personal Information of Staff, Donors, Minors and Participants that is in the Society’s control. This Policy does not apply to Business Contact Information or work product information to the extent those categories are excluded from PIPA. Other Society policies may impose additional confidentiality, records-management, cybersecurity, or information technology requirements.

PURPOSES OF COLLECTION

Staff

The Society collects, uses, discloses, processes, and maintains Personal Information to:

recruit and verify qualifications, and establish, manage or end employment or contractor relationships;
administer payroll, benefits, pensions, leave, scheduling, training, performance, succession planning and workplace investigations;
protect worker and public safety, manage accommodations and return-to-work processes, and administer claims;
confirm licensing and driving eligibility, assign company vehicles, investigate incidents and manage fleet safety, maintenance and insurance;
dispatch workers, provide and improve services, control access to sites and respond to emergencies;
administer contracts, accounts, purchases, payments, collections, warranties, claims, insurance and audits;
administer employee health, insurance, pension and benefit plans and confirm eligibility for coverage;
meet reasonable customer, site-access and safeguarding requirements for work performed for third parties or in third-party facilities;
verify and assess education, training, qualifications, certification, competency and scope of work;
improve and evaluate the Society’s services, including by establishing training and development programs;
evaluate and monitor performance;
protect the Society’s Staff, property, assets, business, systems, confidential information and legal rights, including investigating disputes, specific incidents, suspected misconduct, fraud or security events;
monitor compliance with policies and address security and internal control issues;
communicate with Staff, such as with respect to important upcoming dates, changes to benefits, health and safety-related alerts and new program rollout information;
comply with the Society’s legal, regulatory, tax, safety, licensing, court, recordkeeping and contractual requirements; and
fulfil other purposes identified at or before collection or otherwise permitted by law.

Participants

The Society collects, uses, discloses and maintains Personal Information about Participants for:

accessing, improving and evaluating the Society’s programs and services;
maintaining and processing referrals;
determining Participant eligibility to access services or programming offered by the Society;
delivery and documentation of the Society’s services;
processing and collecting payments;
the safety and security of Participants;
investigating and responding to accidents, safety events, misconduct and similar incidents;
responding to Participant complaints and concerns;
providing requested product, program or service information;
evaluating usage of our website and related applications and improving our services, performance and user experiences, including through cookies and analytics;
complying with statistical and demographic reporting requirements stipulated by program funders and partners, such as foundations, municipalities and government agencies;
financial audit reporting; and
complying with the Society’s legal, regulatory and contractual obligations.

Donors

The Society collects, uses, discloses and maintains Personal Information about Donors for:

accepting and processing gifts and issuing tax receipts;
communicating about current and planned Society programs and activities; and
complying with the Society’s legal, regulatory and contractual obligations.

TYPES OF PERSONAL INFORMATION COLLECTED ABOUT STAFF, PARTICIPANTS AND DONORS

Staff

The information that the Society may collect about Staff for the purposes set out in this Policy includes information such as:

an individual’s name, contact information, social insurance number (SIN), and emergency contact information;
information about an individual’s employment history, education and qualifications;
job classification, union status where relevant, seniority, scheduling, attendance, leave, vacation, dispatch and assignment records;
background check information, which may include criminal, credit, income, reference checks or proof of eligibility to work in Canada;
payroll, banking, tax, pension, benefit, beneficiary and dependent information;
provincial health insurance and employee-benefit information, including coverage status plan or member numbers and, only where reasonably necessary, a Personal Health Number;
performance, training, discipline, investigation, grievance, accommodation and return-to-work records;
health or functional information required for safety, accommodation, benefits or legal obligations, with diagnosis information limited wherever practicable;
driver’s license information, driver abstracts, vehicle eligibility, collision and fleet safety records; and
images or video footage collected through video surveillance at Society locations where video surveillance is in use.

Participants

The information that the Society may collect about Participants for the purposes set out in this Policy includes information such as:

names, personal contact details and service-location information;
account, contract, billing, payment, credit and transaction information;
information needed for service and program delivery;
service requests, dispatch records, access instructions, communications, complaints and incident details;
website or portal submissions, technical logs, cookies or analytics where visitors interact with our website;
program eligibility information;
for Minors, parent or guardian contact information;
health and medical restrictions, attendance records and program progress; and
photographs and video for marketing and engagement purposes with specific consent.

Donors

The information that the Society may collect about Donors for the purposes set out in this Policy includes information such as:

contact information;
financial and banking information for gift administration;
business, partner or interest-holder relationships and affiliations; and
particular goals, preferences and interests for gift-giving.

SPECIFIC TERMS FOR DONORS

The Society will comply with Donors’ wishes to remain anonymous, except where disclosure is required by law.

The Society does not lend, exchange, rent or sell our Donor lists to third parties. The Personal Information provided when making any online or in-person donation or conducting other transactions with us will be kept securely and will not be disclosed to any third parties except as required by law.

When making a donation online, a secure connection is established and Donor information is encrypted to prevent interception during the transaction. The secure connection is maintained until the transaction is completed or terminated.

Staff who have access to Donors’ Personal Information in connection with processing donations are required to keep the information confidential. Staff are not permitted to use this information for any other purpose than to carry out the services they are performing for the Society.

If Donors provide the Society with a physical or email address for the purpose of receiving marketing communications, they may receive periodic mailings regarding the programs and services offered by the Society. If Donors prefer not to receive these mailings, they may let us know by sending an email to info@canucksautism.ca or by clicking the “unsubscribe” button in the Society’s email communications. If Donors have supplied a telephone number online for the purpose of receiving phone communications related to programs and services, they may receive telephone communications from the Society responding to any requests for information that were made.

SEPARATION BETWEEN PARTICIPANT AND STAFF PERSONAL INFORMATION

If an individual transitions from being a Participant of the Society to becoming an employee, contractor, volunteer or job applicant, the Personal Information collected by the Society during their time as a Participant will not be used, transferred, or referenced for the purposes of evaluating the individual’s employment application, administering payroll/benefits, or managing or ending the employment or contractual relationship.

Participant Personal Information is stored securely within our Participant databases and is kept separate from Staff human resources databases.

Any Personal Information required for establishing, managing or ending a former Participant’s employment or contractual engagement (such as accommodation information, background checks, payroll and emergency contact information) will be collected fresh and managed entirely independently of the individual’s history as a Participant.

Notwithstanding the foregoing, an exception applies in cases of safety, security, or legal compliance in that if a Participant’s history involves investigated and documented misconduct, harassment, or fraudulent activity which occurred while as a Participant with the Society, the Society reserves the right to review and utilize this information during the hiring process. This information may be used to evaluate the former Participant’s suitability for employment and to protect the safety, security, and integrity of our workplace, Staff, assets and other Participants.

CONSENT AND NOTICE

The Society collects, uses and discloses Personal Information with the knowledge and consent of Staff, Donors and Participants where PIPA requires it. Consent may be express or implied, depending on sensitivity, reasonable expectations and the circumstances. The Society will not require consent to unnecessary collection, use or disclosure as a condition of providing a product or service.

The Society will collect separate, express consent prior to capturing and using videos, photos and other content for marketing purposes. Because this type of marketing is considered a non-essential activity, individuals have the clear right to opt out of these activities.

PIPA permits the Society to collect, use or disclose Employee Personal Information without consent when doing so is reasonable for establishing, managing or terminating an employment or contractor relationship. The Society will give prior notice of the collection, use or disclosure and its purposes unless a statutory exception applies. This Policy largely supports that notice but does not replace a more specific notice when required.

An individual may withdraw consent on reasonable notice, subject to legal and contractual restrictions. The Society will inform individuals of the implications of withdrawal of consent, including where certain services or benefits may become unavailable as a result of the withdrawal. Withdrawal does not apply where the law permits or requires the Society to proceed without consent.

HOW AND WHEN THE SOCIETY SHARES PERSONAL INFORMATION

The Society shares Personal Information internally only on a need-to-know basis and information shared between Staff must be limited only to that which is necessary for the purposes of fulfilling applicable job duties.

The Society may also share Personal Information to recipients who require it for an authorized purpose, including payroll and benefit administrators, insurers, pension providers, banks, technology and cloud providers, fleet providers, advisers, auditors, regulators, safety authorities, customers or general contractors for site access or service delivery, unions where permitted or required, and government or law-enforcement bodies where authorized or required by law.

The Society will limit disclosures to what is reasonably required and uses due diligence, contracts, confidentiality terms and other safety controls where appropriate. A service provider may process or store information outside British Columbia or Canada. The information may then be subject to that foreign jurisdiction’s laws and lawful access requirements. The Society takes reasonable steps to understand where service providers store information and to require appropriate contractual, technical and organizational safeguards. Questions about service-provider locations may be directed to the Privacy Officer.

The Society does not sell Personal Information.

PROTECTION OF PERSONAL INFORMATION

The Society implements security safeguards to protect Personal Information against risks such as loss or theft, as well as unauthorized access, disclosure, copying, use, storage or modification. These security safeguards will vary depending on the sensitivity of the information as well as the format in which the information is held and may include:

Physical security measures such as locked filing cabinets and restricted access;

Organizational measures such as security clearances, access only on a “need to know” or “least-privilege” basis, training, and imposing internal limits on data to restrict access and disclosure;

Technological measures such as the use of passwords, multi-factor authentication, firewalls and regular backups; and

Contractual measures such as taking reasonable steps to ensure that a comparable level of protection is implemented by service providers used by the Society.

ACCOUNTABILITY

The Society is responsible for the Personal Information under its control. The Society has appointed a designated Privacy Officer who is accountable for the Society’s compliance with this Policy and with PIPA. The Society’s Privacy Officer can be contacted by writing to: privacy@canucksautism.ca

Staff must consult the Privacy Officer before introducing or materially changing technology or practices that collect, monitor, analyze or disclose Personal Information.

The Society investigates non-compliance with this Policy and with PIPA where the Society has reasonable grounds to believe that Personal Information is being inappropriately collected, modified, used, stored or disclosed. Staff who fail to properly maintain the safety and security of Personal Information or who engage in unauthorized collection, access, use, modification or disclosure of Personal Information may be subject to discipline up to and including termination of their employment or contractual engagement, as applicable.

PRIVACY BREACHES

The Society views any Privacy Incident as a serious matter. In the event of a Privacy Incident, the Society’s response will include the following steps:

The Society will endeavor to contain the Privacy Incident as soon as possible and/or stop the unauthorized activities, as applicable;

The Society will designate an appropriate individual to lead an initial investigation;

The Society will notify individuals of any Privacy Incidents involving their Personal Information under the Society’s control if such notification is required by PIPA or as the Society otherwise determines is appropriate to do so; and

The Society will keep a record of Privacy Incidents involving Personal Information under its control.

All Staff are expected to provide their full cooperation with any Privacy Incident investigation.

Staff must immediately report actual or suspected Privacy Incidents to the Privacy Officer. If there is any question about whether a Privacy Incident has occurred or may occur, individuals are directed to immediately consult with the Privacy Officer.

ACCURACY AND CORRECTION OF PERSONAL INFORMATION

The Society makes reasonable efforts to ensure that Personal Information is as accurate, complete and current as required for the purposes for which it was collected. In some cases, the Society relies on Staff, Donors and Participants to ensure that certain information about them (such as contact information) is current, complete, and accurate. Individuals are expected to inform the Society of any updates to their Personal Information as soon as reasonably possible.

Individuals may, under PIPA, challenge the accuracy and completeness of their Personal Information by contacting the Privacy Officer. If the Society is satisfied that an individual’s request for correction is reasonable, the Society will amend the information as appropriate. If the Society is not satisfied that the request for correction is reasonable, the Society will annotate the information, noting that a correction was requested but not made.

RETENTION

If the Society uses Personal Information to make a decision that directly affects an individual, the Society will retain it for at least one year after use so the individual has a reasonable opportunity to obtain access. Otherwise, the Society will retain information only as long as reasonably required for the identified purpose or a legal, regulatory, contractual, insurance, audit, limitation-period or legitimate business requirement.

The Society will maintain or apply a retention schedule by record category. A legal hold, investigation, claim, grievance or audit suspends normal destruction. When retention is no longer required, the Society will securely destroy or delete the information.

RIGHT OF ACCESS

An individual may make a written request to the Privacy Officer for access to Personal Information under the Society’s control, information about its use, and information about the persons or organizations to whom it has been disclosed, subject to PIPA’s exceptions. The request must identify the individual and records sought.

The Privacy Officer will assist the individual with the access request and will respond in a manner consistent with PIPA. The Society may take reasonable steps to verify the individual’s identity and their right to access the requested information.

The Society will respond within the time required by PIPA, normally 30 business days, unless extended as permitted. The Society will assist the requester and explain any refusal, applicable exception and review rights. A fee may be charged only as permitted by PIPA, with an estimate provided before the service is performed.

CHALLENGING COMPLIANCE

The Society will investigate and respond to any complaints or inquiries relating to its compliance with PIPA or this Policy. Complaints or inquiries are to be in writing and forwarded to the Privacy Officer. The Privacy Officer will make efforts to investigate and respond to any complaints or inquiries within the timeframe required under PIPA.

Individuals who are not satisfied with the Privacy Officer’s response may file a complaint with the Office of the Information and Privacy Commissioner for British Columbia at: https://www.oipc.bc.ca/for-the-public/how-do-i-make-a-complaint/

CHANGES TO THIS POLICY

The Society reserves the right to make changes to this Policy at any time. Such changes will be effective when posted. Please review this Policy from time to time to become aware of any changes that have been made. This Policy can be made available in an alternative format upon request.

Date: October 8, 2026