Privacy Policy

1.1. CFLF accepts full responsibility for protecting personal information under its possession or control. CFLF’s National Privacy Officer is accountable for the Foundation’s compliance with this policy.

1.2. The National Privacy Officer delegates responsibilities relating to privacy management, oversight, and compliance to functional and regional privacy representatives on an as-needed basis. The functional and regional privacy representatives are the first point of contact for privacy inquiries, concerns, or incidents and escalate privacy matters to the National Privacy Officer per CFLF's internal privacy incident management procedure.

1.3. The duties of the National Privacy Officer and those of the functional and regional privacy representatives, as delegated, include:

• developing and, regularly, reviewing CFLF policies and practices to ensure consistent implementation and compliance;
• ensuring all staff are trained on privacy best practices and the importance of safeguarding any personal information that they are privy to;
• ensuring that all inquiries and complaints relating to privacy are appropriately handled;
• ensuring all third parties to whom CFLF provides access to personal information adhere to appropriate standards of care in managing that information; and,
• informing the Executive Director and/or Board about significant privacy breaches that could potentially cause harm to CFLF’s reputation.

2.1. Personal information is collected for purposes such as:

• providing physical literacy-related information and support services;
• responding to any concerns or inquiries about CFLF’s activities;
• fundraising and promoting CFLF events and services;
• recruiting, screening, placing and managing relationships with volunteers;
• communicating with the community, including communications with donors, funders, partners, volunteers and individuals who participate in CFLF events or use CFLF services;
• determining an individual’s suitability to be in a position of trust, including the handling of cash or working with vulnerable persons;
• accounting and other financial purposes, such as issuing tax receipts; and
• maintaining an employment relationship with employees of CFLF.

2.2. Aggregated information is used for service planning and delivery, program promotion, and the general administration of CFLF’s business, including assessing the effectiveness of CFLF programs and campaigns, improving donor experience and assisting in developing new programs and channels. This information will be compiled and analyzed on an aggregate basis, and unless we have your specific consent to use identified information, it does not identify any individual and, therefore, is not treated as personal information under this policy.

2.3. Each time an individual accesses a CFLF website, we automatically receive and store certain types of non-personally identifiable information. Please refer to Website Practices for more information.

3.1. Consent requirements for the collection, use, or disclosure of personal information vary depending on circumstances and the type of personal information. Consent can be obtained in person, by phone, by mail, or via the Internet.

3.2. In determining whether implied or explicit consent is required and, if so, which form of consent is appropriate, CFLF will take into account the sensitivity of the personal information at issue, the purposes for which CFLF will use the information and any legal requirements. Consent may be implied based upon the reasonable expectations of the individual. For example, if you provide personal information in response to a fundraising communication, consent may be implied to use the information for fundraising. In determining the appropriate form of consent, CFLF will consider the sensitivity of the personal information. Implied consent will generally be applicable where the personal information is non-sensitive in nature and context. Express consent will always be sought should the primary purpose of collection be to promote a corporate partner's products or should we wish to disclose your personal information to a third party, such as another charity.

3.3. Your provision of personal information to CFLF means that you agree and consent to the fact that we may collect, use, and disclose your personal information in accordance with this privacy policy. If you do not agree with these terms, please do not provide any personal information to CFLF. Failure to provide your personal information to CFLF may prevent us from offering you the products or services you have requested.

3.4. CFLF will usually obtain your informed consent at the time that we collect your personal information. If your personal information will be used or disclosed for any additional purposes that are not outlined in this policy, CFLF will advise you of these new purposes before such use or disclosure unless otherwise required by law.

3.5. Consent may be time-limited and may be revoked by the individual who gave it, subject to legal restrictions, limited exceptions and reasonable notice. Withdrawal of consent will not exclude an individual from service delivery unless the information requested is required to fulfill an explicitly specified and legitimate purpose.

4.1. CFLF only collects personal information for the purposes outlined under Principle 2.

4.2. Every CFLF business unit, if applicable, is responsible for ensuring that all information collected is limited, both in amount and type, to what is needed to fulfill the identified purposes.

4.3. CFLF usually collects personal information directly from the individual in the course of its business through various means including, but not limited to:

• registration and application forms;
• CFLF programs and services;
• donor and fundraising forms; 
• online applications, services and systems; and
• telephone conversations and instant messaging.

4.4. CFLF may also collect personal information from other sources (including personal references and family members), with the consent of the individual or where permitted or required by law (for example, when the information is about a minor) or is publicly available.

5.1. Personal information is only used and disclosed for the purposes for which it was initially collected (as outlined under Principle 2) unless specific consent has been obtained or if otherwise required by law. There are circumstances where a disclosure without consent is justified or permitted, for example, in the context of a legal investigation or a request from law enforcement authorities, or where CFLF believes, upon reasonable grounds, that the disclosure is necessary to protect the rights or safety of an identifiable person or group.

5.2. Also, note that your personal information may be shared with volunteers and service providers (collectively “Affiliates”). Such Affiliates assist us in establishing, managing and maintaining our relationship with you and providing products and services to CFLF, such as mailing and fulfillment organizations and third-party fundraising agencies. Affiliates will only use your personal information for the abovementioned purposes, are bound by confidentiality agreements, and commit to safeguarding your personal information. Note that in working with our service providers, your personal information may be transferred to a foreign jurisdiction to be processed or stored. Such information may be provided to law enforcement or national security authorities of that jurisdiction upon request to comply with foreign laws.

5.3. Personal information is only retained as long as necessary to fulfill the purposes identified in this policy (under Principle 2) and as required by law. CFLF has established retention timelines for staff to follow and periodically reviews CFLF’s retention needs.

5.4. The retention period may extend beyond your relationship with us. When your personal information is no longer required for CFLF’s purposes, the information is either physically destroyed or deleted.

6.1. CFLF makes reasonable efforts to keep personal information as accurate, complete, and up-to-date as necessary to fulfill the purposes for which the information is to be used.

6.2. We rely on our donors, fundraisers, event participants, individuals who use the services of CFLF, volunteers and employees to provide us with accurate information and to notify us if their information needs to be updated.

7.1. CFLF takes reasonable measures to ensure that personal information is kept safe from loss, theft, unauthorized access, use, copying, disclosure, or modification. Safeguards include physical, organizational and technical measures, such as (but not limited to):

• security card access to premises;
• restriction of employee access to files on a “need to know” basis;
• confidentiality undertakings by all employees;
• locking up personal information and not leaving it unattended or in plain view;
• firewalls, anti-virus, strong passwords and software solutions for technical security (including secure, 128-bit encrypted Secure Socket Layer sessions on our website); and
• regular reviews of privacy compliance initiatives.

8.1. CFLF always makes information about our privacy practices available upon request. CFLF also takes steps to ensure that all staff and volunteers can answer inquiries about our information-handling practices and appropriately refer unanswered questions or privacy complaints to the National Privacy Officer.

9.1. An individual should direct a request for access to their personal information to the National Privacy Officer in writing (contact information is set out at the end of this policy). The written request must provide sufficient detail so that the National Privacy Officer can properly and efficiently respond to the request.

9.2. In order to safeguard personal information, an individual may be required to provide sufficient identification information in order for CFLF to authenticate the individual and to authorize access to the individual’s file.

9.3. CFLF will respond to access requests in a timely manner, and in accordance with the timeframe prescribed by any relevant legislation.

9.4. An individual may challenge the accuracy and completeness of the information obtained if appropriate. CFLF shall promptly correct or complete any personal information found to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness shall be noted in the individual’s file. Where appropriate, CFLF shall transmit to third parties having access to the personal information in question any amended information or information regarding the existence of any unresolved differences.

9.5. Individuals will be provided with any help needed to access their personal information, including clarifying exactly what they are looking for. Requested information will be provided in a timely manner and in a form that is generally understandable. 

9.6. If CFLF does not have custody of the personal information requested or must decline to provide an individual with access to their personal information for legal, regulatory or other reasons, an explanation will be provided.

10.1. An individual shall address a challenge concerning CFLF’s compliance with the principles set out in this privacy policy to the National Privacy Officer. Complaints must be in writing and will be handled in a timely manner.

10.2. CFLF has procedures in place to receive, investigate, respond to and track concerns or complaints about its management of personal information. By following these procedures, a remedy or corrective action will be undertaken to resolve the issue, including, if necessary, amending CFLF’s policies and procedures.

10.3. Within a reasonable time of the conclusion of the investigation, the National Privacy Officer will inform the complainant of:

• the results of the investigation; and
• any appropriate measures CFLF will take to rectify the source of the complaint.