PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENT POLICY

1.0 Purpose

At Camp Maple Leaf, we are committed to providing our campers and families with exceptional service. Providing this service involves the collection, use and disclosure of some personal information about our campers and families. Therefore protecting their personal information is one of our highest priorities.

While we have always respected our campers’ and families’ privacy and safeguarded their personal information, we have strengthened our commitment to protecting personal information as a result of Personal Information Protection and Electronic Document Act (PIPEDA). PIPEDA sets out the rules as to how businesses and not-for-profit organizations may collect, use and disclose personal information.

We will inform our campers and families of why and how we collect, use and disclose their personal information, obtain their consent where required, and only handle their personal information in a manner that a reasonable person would consider appropriate under the circumstances.

This Personal Information Protection and Electronic Document Policy, in compliance with PIPEDA, outlines the principles and practices we will follow in protecting campers’ and families’ personal information. Our privacy commitment includes both ensuring the accuracy, confidentiality, and security of our campers and families personal information as well as allowing our campers and families to request access to, and correction of, their personal information.

This policy is also applicable to all HR and staffing/volunteering practices regarding recruitment, hiring, negotiations, promotions, evaluations and retention of staff/volunteers. The policy also applies to any service providers collecting, using or disclosing personal information on behalf of Camp Maple Leaf

1.1 The Ten Principles of PIPEDA Summarized

The ten principles of PIPEDA that form the basis of this Privacy Policy are as follows:

  1. Accountability: organizations are accountable for the personal information they collect, use, retain and disclose in the course of their commercial activities, including, but not limited to, the appointment of a Privacy Officer;
  2. Identifying Purposes: organizations are to explain the purposes for which the information is being used at the time of collection and can only be used for those purposes;
  3. Consent: organizations must obtain an Individual’s express or implied consent when they collect, use, or disclose the individual’s personal information;
  4. Limiting Collection: the collection of personal information must be limited to only the amount and type that is reasonably necessary for the identified purposes;
  5. Limiting Use, Disclosure and Retention: personal information must be used for only the identified purposes, and must not be disclosed to third parties unless the Individual consents to the alternative use or disclosure;
  6. Accuracy: organizations are required to keep personal information in active files accurate and up-to-date;
  7. Safeguards: organizations are to use physical, organizational, and technological safeguards to protect personal information from unauthorized access or disclosure.
  8. Openness: organizations must inform their clients and train their employees about their privacy policies and procedures;
  9. Individual Access: an individual has a right to access personal information held by an organization and to challenge its accuracy if need be; and
  10. Provide Recourse: organizations are to inform clients and employees of how to bring a request for access, or complaint, to the Chief Privacy Officer, and respond promptly to a request or complaint by the individual.

1.2 Definitions

Personal information: means any information about an identifiable individual. It includes, without limitation, information relating to identity, nationality, age, gender, address, telephone number, e-mail address, Social Insurance Number, date of birth, marital status, education, employment health history, assets, liabilities, payment records, credit records, loan records, income and information relating to financial transactions as well as certain personal opinions or views of an Individual.

Business information: means business name, business address, business telephone number, business email, name(s) of owner(s), officer(s) and director(s), job titles, business registration numbers (GST, RST, source deductions), financial status. Although business information is not subject to PIPEDA, confidentiality of business information will be treated with the same security measures by Camp Maple Leaf staff members and Board members, Advisors and Consultants as is required for individual personal information under PIPEDA.

Campers: means the individuals who are going to be participating directly in a program at Camp Maple Leaf

Parents/Guardians: means the individuals who registered the camper(s) to participate in a Camp Maple Leaf program.

Families: means all individuals that are identified as living in the same household including but not limited to, the registered camper, the parents/guardian and siblings whether or not they participate in a Camp Maple Leaf program.

Staff/Volunteers: means the individuals who will be working at Camp Maple Leaf over a period of time regardless of compensation.

Individuals: means a person or people directly involved with Camp Maple Leaf by participating, sending a participant, working or volunteering.

Registration: means the registration form or related forms to be completed by parents/guardians, campers and families in order to take part in a Camp Maple Leaf program. This also includes medical and financial specific forms required to attend the program.

Application: means the application form or related forms to be completed by the staff/volunteers to work at camp. This also includes medical specific forms.

Camp Maple Leaf Program: means an onsite or virtual base series of activities of varied length in duration which are offered by Camp Maple Leaf. Programs include but are not limited to the following: Summer Camp, Family Camp, Day Camp, Funveloppe, Tradeshows.

Alumni: means any past participant who has either participated or worked at a Camp Maple Leaf program who has registered to continue to be involved with the Camp Maple Leaf organization.

Data base: means the list of campers, parents/guardian, families and staff/volunteers – personal information held by Camp Maple Leaf in the form of, but not limited to, computer files, paper files, files on computer hard drives and files on cloud base 3rd party servers.

File: means the information collected in the course of processing an application or registration, as well as information collected/updated during the operations of the program and any other information provided afterward in order to maintain up-to-date information about campers, parents/guardian, families and staff/volunteers.

Express consent: means the individuals sign the application/registration, or other forms containing personal information, authorizing Camp Maple Leaf to collect, use, and disclose the individual’s personal information for the purposes set out in the application, registrations and/or forms.

Implied Consent: means the organization may assume that the individual consents to the information being used, retained and disclosed for the original purposes, unless notified by the individual.

Third Party: means a person or company that provides services to Camp Maple Leaf in support of the programs, benefits, and other services offered by Camp Maple Leaf.

Privacy Officer: means the individual designated responsibility for ensuring that Camp Maple Leaf complies with this policy and PIPEDA.

2.0 Purpose of Collecting Personal Information

Unless the purposes for collecting personal information are obvious and the campers, families and staff/volunteers voluntarily provide his or her personal information for those purposes, we will communicate the purposes for which personal information is being collected, either orally or in writing, before or at the time of collection.

We will only collect campers, parents/guardians, families and staff/volunteers information that is necessary to fulfill the following purposes:

  • To enroll individuals and families in a program
  • To deliver the requested program
  • To deliver a high standard of service to our campers, families
  • To assess suitability for staffing/volunteering
  • To process payments from parents/guardians for program participation
  • To process payments to staff/volunteering/3rd party regarding work rendered for Camp Maple Leaf
  • To meet regulatory requirements
  • To send out communications regarding registered program information, upcoming programs and any alumni related information and opportunities
  • To gain feedback from individuals to help improve programs through writing surveys or online surveys
  • To hire staff/volunteers (driver’s license may be required depending on position description)
  • To guarantee that camper, parents/guardian, families, staff/volunteers transportation choices are correctly provided

3.0 Consent

We will obtain individual consent to collect, use or disclose personal information (except where, as noted below, we are authorized to do so without consent.

Consent can be provided orally, in writing, electronically, through an authorized representative or it can be implied where the purpose for collecting, using, or disclosing the personal information would be considered obvious and the individual voluntarily provides personal information for that purpose.

Consent may also be implied where an individual is given notice and a reasonable opportunity to opt out of their personal information being used for including but not limited to emails, newsletters, mail outs, marketing of new services or products, fundraising, but the individual does not opt out.

Subject to certain exceptions (e.g., the personal information is necessary to provide the service or product, or the withdrawal of consent would frustrate the performance of a legal obligation), individuals can withhold or withdraw their consent for Camp Maple Leaf to use their personal information in certain ways. An individual’s decision to withhold or withdraw consent to certain uses of personal information may restrict our ability to provide a particular service or program and may result in not being able to provide a specific service or program. If so, we will explain the situation to assist the individual in making the decision.

We may collect information without the individual’s knowledge or consent in the following limited circumstances:

  • If the collection is clearly in the individual’s interest and consent cannot be obtained in a timely manner
  • If the knowledge or consent would compromise the availability or accuracy of the information and collection required to investigate a breach of an agreement or contravention of a federal or provincial law
  • If it is publicly available
  • When it contains a witness statement and the collection is necessary to assess, process, or settle an insurance claim
  • Where it is produced by an individual in the course of their employment, business or profession – as long as the collection is consistent with the purpose(s) for which the information was produced
  • When an individual is employed or volunteering with Camp Maple Leaf and the collection is necessary to establish, manage or terminate an employment relationship. Camp Maple Leaf will, however, inform the individual in advance that their personal information could be collected for such purposes.

We may use personal information without individual’s knowledge or consent only:

  • If Camp Maple Leaf has reasonable grounds to believe the information could be useful when investigating a contravention of a federal, provincial, or foreign law and the information is used for that investigation.
  • For an emergency that threatens an individual’s life, health or security • For statistical or scholarly study or research (Privacy Commissioner of Canada will be notified prior)
  • If it is publicly available
  • If the use is clearly in the individual’s best interests and consent is not available in a timely way
  • When it contains a witness statement and the collection is necessary to assess, process, or settle an insurance claim
  • Where it is produced by an individual in the course of their employment, business or profession – as long as the collection is consistent with the purpose(s) for which the information was produced
  • When an individual is employed or volunteering with Camp Maple Leaf and the collection is necessary to establish, manage or terminate an employment relationship. Camp Maple Leaf will, however, inform the individual in advance that their personal information could be collected for such purpose.
  • If the knowledge and consent would compromise the availability or accuracy of the information and collection was required to investigate a breach of an agreement or contravention of a federal or provincial law

We may disclose personal information without the individual’s knowledge or consent only:

  • To a lawyer representing Camp Maple Leaf
  • To collect a debt the individual owes to Camp Maple Leaf
  • To comply with a subpoena, a warrant, or an order made by a court or other body with appropriate jurisdiction
  • To the Financial Transaction and Report Analysis Centre of Canada (FINTRAC) as required by the Proceeds of Crime (money laundering) and Terrorist Financing Act
  • To a government institution that has requested the information, identified its lawful authority to obtain the information, and indicates that disclosure is for the purpose of enforcing, carrying out an investigation, or gathering intelligence relating to any federal, provincial, or foreign law; or suspects that the information relates to national security, defence of Canada or conduct of the international affairs; or is for the purpose of administering any federal or provincial law.
  • To a government institution or an individual’s next of kin authorized representative when there are reasonable grounds that the individual has been, is, or may be the victim of financial abuse. Camp Maple Leaf, however, may make such disclosure only for the purpose of preventing or investigatiing the abuse, and only if it is reasonable to expect that the disclosure with the knowledge or consent of the individual would compromise the ability to prevent or investigate the abuse.
  • To another organization in instances where it is reasonable for the purpose of:
    • Investigating a breach of an agreement or contravention of a federal or provincial law that has been, is being, or is about to be committed or;
    • Detecting or suppressing or preventing fraud that is likely to be committed. (However, it must be reasonable to expect that disclosure with the knowledge or consent of an individual would compromise the investigation of a law or agreement being broken or the ability to prevent, detect or suppress the fraud.)
  • In connection with a business transaction, provided certain conditions are met, to, among other things, protect the information and limit its use
  • When it contains a witness statement and the collection is necessary to assess, process, or settle an insurance claim
  • Where it is produced by an individual in the course of their employment, business or profession – as long as the collection is consistent with the purpose(s) for which the information was produced
  • In an emergency that threatens an individual’s life, health or security (individual will be informed of the disclosure)
  • When an individual is employed or volunteering with Camp Maple Leaf and the collection is necessary to establish, manage or terminate an employment relationship. Camp Maple Leaf will, however, inform the individual in advance that their personal information could be collected for such purpose.
  • To a government institution, individual’s next of kin, or authorized representative if necessary to identify an individual who is injured, ill or deceased (and if alive, the individual has been informed in writing that the disclosure took place)
  • For statistical or scholarly study or research (Privacy Commissioner of Canada will be notified prior)
  • 30 years after the individual’s death or 100 years after the records were created. No health information is to be released on the individual before 100 years after the record was created.
  • If it is publicly available
  • If required by law.

PIPEDA permits Camp Maple Leaf to transfer personal information to a third party, without the individual’s knowledge or consent, if the transfer is simply for processing purposes and the third party only uses the information for the purposes for which it was transferred. Camp Maple Leaf will ensure, by contractual or other means, that the third party protects the information and uses it only for the purposes for which it was transferred.

4.0 Limiting Collection

Personal information collected will be limited to the purposes set out in this Privacy Policy, Camp Maple Leaf applications, registrations, and/or other forms. Camp Maple Leaf will review all forms including applications and registration forms in order to determine if the information being requested is still required from the individuals.

5.0 Retaining Personal Information

Personal information will be retained in individuals’ files as long as the file is active and for such periods of time as may be prescribed by applicable laws and regulations. Campers, parents/guardians and families’ files will be deemed inactive 5 years after the camper has reached the age of 18. After 5 years the file will be archived and stored in order to keep proper records that could be necessary for any legal reasons.

Parent/guardian credit card information will be kept on file for the duration of the child’s ability to take part of the Camp Maple Leaf program (eligible age). The information will be confirmed with parents every year before use. After the camper has aged out of the program, all credit card information will be disposed in a secured manner.

Staff/volunteer files will be deemed inactive 5 years after the last day of work. After 5 years the file will be archived and stored in order to keep proper records that could be necessary for any legal reasons.

Staff payroll information will be kept for a period of 7 years.

All other forms from survey(s) and feedback forms will be kept indefinitely unless private information is present and, if so, will be kept as indicated above.

6.0 Accuracy

Camp Maple Leaf endeavours to ensure that any personal information provided by the individual in their active file(s) is accurate, current, and complete as is necessary to fulfill the purposes for which the information has been collected, used, retained, and disclosed. Individuals are requested to either notify Camp Maple Leaf of any change in their personal or business information or access their files online and update the information as required.

Information contained in inactive files are not updated.

7.0 Safeguards

Camp Maple Leaf will use physical, organizational, and technological measures to safeguard personal information of Camp Maple Leaf employees, volunteers, or third parties who need to know this information for the purposes set out in this Privacy Policy.

Organizational Safeguards: Access to staff and volunteer personal information will be limited to Camp Director(s), Administration Coordinator(s), HR Coordinator(s) and/or the President and any other staff member(s) given permission by the President. Camper’s personal information provided to Camp Maple Leaf will only be shared with camp staff/volunteers and will be limited only to the information required to carry out their job. Camp Maple Leaf staff/volunteers and/or Board of Directors are not permitted to copy or retain any personal information on individuals and must return for destruction all such information given to them for review once the purpose for being provided with this information has been fulfilled.

Staff/volunteers, 3rd party providers and/or Board of Directors are required to sign a confidentiality agreement binding them to maintaining the confidentiality of all personal information to which they have access.

Physical Safeguards: Active files are stored in locked filing cabinets when not in use. Access to work areas where active files may be in use is restricted to Camp Maple Leaf staff/volunteers only and authorized third parties who have been given permission by the President.

All inactive files or personal information no longer required are shredded prior to disposal to prevent inadvertent disclosure to unauthorized persons.

Technological Safeguards: All personal information will be contained on 3rd party cloud stored electronic databases which will be password protected or on 3rd party cloud file storing servers which are also password protected. Access to any individual personal files will be limited to staff/volunteers given authorized access by the President. No personal files will be stored on any Camp Maple Leaf computers directly.

Camp Maple Leaf’s Internet router or server will have firewall protection sufficient to protect personal and confidential business information against virus attacks and “sniffer” software arising from Internet activity. Personal information is not transferred to staff/volunteers, committees, the Board of Directors, or third parties by e-mail or other electronic form.

8.0 Openness

Camp Maple Leaf will ensure its privacy policies and procedures are made known to the individual via this privacy policy as well and the Camp Maple Leaf Privacy Statement. This document will also be available on the Camp Maple Leaf website.

9.0 Individual Access

Campers, parents/guardians, families and staff/volunteers who wish to review or verify what personal information is held by Camp Maple Leaf, or to whom the information has been disclosed (as permitted by the Act), may make the request for access, in writing, to Camp Maple Leaf’s President. Upon verification of the individual’s identity, the President will respond within 30 days.

If the individual finds that the information held by Camp Maple Leaf is inaccurate or incomplete, once the individual provides the correct updated information, Camp Maple Leaf will promptly make the required changes to the individual’s active file(s).

Exception: No person under the age of 16 has the authority to demand access to file information unless requested by the parental authority or by their attorney in the context of a judicial proceedings as stated in the privacy act for the provinces in which we are operating.

10.0 Questions and Complaints

If an individual has a concern about Camp Maple Leaf’s personal information handling practices, a complaint, in writing, may be directed to the Camp Maple Leaf President.

Upon verification of the individual’s identity, the Camp Maple Leaf President will act promptly to investigate the complaint and provide a written report of the investigation’s findings to the individual.

Where Camp Maple Leaf’s President makes a determination that the individual’s complaint is well-founded, the President will take the necessary steps to correct the offending information handling practice and/or revise Camp Maple Leaf’s privacy policies and procedures.

Where Camp Maple Leaf’s President determines that the individual’s complaint is not well founded, the individual will be notified in writing.

If the individual is dissatisfied with the finding and corresponding action taken by Camp Maple Leaf’s President, the individual may bring a complaint to the Federal Privacy Commissioner at the address below:

Office of the Privacy Commissioner of Canada
30 Victoria St.
Gatineau Quebec
K1A 1H3
Tel 1-800-282-1376

https://www.priv.gc.ca/en/report-a-concern/

Questions/Access Request/Complaint

Any questions regarding this or any other privacy policy of Camp Maple Leaf may be directed to the President. Requests for access to information, or, to make a complaint, must be made in writing and sent to the President at the address below:

Camp Maple Leaf
Att: President
132 Reynolds St.
Oakville, ON
L6J 3K5
Tel 1-905-338-5200
Email address: info@campmapleleaf.ca