Privacy Policy (Canada / PIPEDA-aligned)
1 Who we are & scope
This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information from visitors, account holders, volunteers, donors, petition signers, and other participants (“you”) across our website, apps, newsletters, events, and community tools (the “Services”). We follow the 10 Fair Information Principles under PIPEDA—accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. (Privacy Commissioner Canada)
2 What we collect
- Information you provide: name, email, phone, postal address, province/country, organization, petition signatures, volunteer/donation details, messages, uploaded content, profile info.
- Automatically collected data: IP address, device/browser, referring URLs, pages viewed, timestamps, session IDs, error logs.
- Cookies & similar tech: used for login sessions, preferences, analytics, fraud prevention, and performance. You can adjust cookie settings in your browser; some features may not work without them.
3 Why we collect it (purposes)
- Operate and improve the Services; personalize content and experiences.
- Manage accounts, memberships, petitions, donations, and event/volunteer logistics.
- Send updates/newsletters (only if you opt-in); manage unsubscribes.
- Community safety (moderation, abuse prevention, fraud/security monitoring).
- Legal compliance, dispute resolution, and record-keeping consistent with PIPEDA. (Privacy Commissioner Canada)
4 Lawful basis & consent
We seek meaningful consent before collecting, using, or sharing personal information, except where otherwise permitted or required by law. You can withdraw consent at any time (it won’t affect prior lawful processing). We keep collection/use limited to identified purposes and use safeguards proportionate to sensitivity. (Privacy Commissioner Canada)
5 Sharing & disclosures
We do not sell personal information. We may share limited data with:
- Service providers (e.g., email delivery, analytics, secure hosting, payment processors) under confidentiality and security obligations.
- Professional advisors (legal, accounting) as needed.
- Authorities where required by law or to protect rights, safety, and integrity.
- Anonymized/aggregated insights that cannot identify you.
6 Cross-border transfers
If we use tools or hosting outside Canada (e.g., US-based email/analytics), your data may be processed abroad subject to foreign laws. We apply contractual and organizational safeguards for such transfers. (This is standard practice and should be disclosed under PIPEDA.) (Privacy Commissioner Canada)
7 Retention
We retain personal information only as long as necessary for stated purposes (or as required by law), then securely delete or anonymize.
8 Security
We use TLS/HTTPS, access controls, encryption at rest where appropriate, network segmentation, auditing, least-privilege permissions, and staff confidentiality/training. No method is 100% secure, but we continually improve safeguards aligned with risk.
9 Your rights
You can request access to your personal information, ask for corrections, request deletion (where permissible), or withdraw consent. We’ll respond within a reasonable time (typically 30 days). Contact privacy@cometogethercanada.com.
10 Children
We don’t knowingly collect data from children under 18 without parental consent. If you believe a minor provided data, contact us to remove it.
11 Updates
We may update this policy; we’ll post changes with a new “Effective date.” For material changes, we’ll provide reasonable notice.
12 Contact / Privacy Officer
Privacy Officer
privacy@cometogethercanada.com
Reference guidance used in shaping this policy:OPC’s PIPEDA summaries & principles (official). (Privacy Commissioner Canada)