For the purposes of this policy, personal information is defined as any information, in any form, about an identifiable individual, or that can be used to identify an individual, alone or in combination with other information. Personal information does not include information that is publicly available, such as business contact information that is collected, used or disclosed solely for the purpose of communicating with that person in relation to their employment or profession, or information found in a telephone directory.
Volunteers and staff are required to maintain the privacy and confidentiality of all personal information in any and all formats both while acting as an active volunteer or staff member and after they leave the organization.
1) COMPLIANCE WITH FAIR INFORMATION PRINCIPLES
Children Believe adheres to the principles set out in the Canadian Standards Association’s “Model Code for the Protection of Personal Information”, which also forms the basis for most privacy legislation in Canada. These principles are set out in more detail in section 4 of this policy. CB has adopted a privacy policy that aligns with the fair information principles to demonstrate due diligence, maintain stakeholder trust and mitigate the risks associated with privacy breaches.
1.1. Cascading this policy to country offices
Children Believe’s policies must be developed in compliance with applicable Canadian and/or Ontario laws and regulations. As a charity that carries on activities outside Canada, CB needs to be aware of the laws in its countries of operations and how they differ from laws in Canada. While the Income Tax Act does not require CB to comply with laws in foreign jurisdictions, CB is not exempt from the laws in the jurisdiction where it operates, therefore CB activities should also meet the requirements of local legislation in countries of operation.
Country Offices will review this policy against local laws and how they are enforced, and, as deemed necessary, contextualize them to comply with local laws, regulations and requirements, while respecting the spirit of this policy and ensuring that the public benefit provided by organization’s activities is not offset by harm to those carrying on the activities, the charity’s beneficiaries, or anyone else.
2) PERSONAL INFORMATION WE COLLECT
To achieve its mission, CB collects certain personal information about its donors, sponsors, fundraisers and other supporters, sponsored children and their families, staff, volunteers and partners. We collect only the minimum amount of information needed to achieve the purposes identified in this policy.
Subject to the application of the consent principle outlined in Section 4.3 below, personal information collected by CB includes, but is not limited to:
- Contact and identification information, such as name, address, telephone number and email address;
- Financial information such as payment methods and preferences, billing and banking information (credit-card number and expiry date or chequing account transit numbers, which are required to process a donation);
- Donation information such as date of gift, amount of gift, the campaign to which one contributed;
- Campaign organizer information, donor lists and donor data (which includes donor name, email address donation amount, date of transaction, transaction identification number, name of the project and event associated with the donation) that CBs receives from GoFundMe or PayPal Giving Fund Canada when someone makes a donation to CB through those platforms;
- Country locations or CB programs an individual wishes to support;
- Demographic information, such as: age, date of birth, gender, ethnic origin, marital status, household income range and occupation;
- Communication preferences for marketing purposes;
- Employment history and background checks for volunteers and employees, including results of police records checks;
- Employee records;
- Information about sponsors: all of the above plus date of birth, annual income, visits to and correspondence with sponsored children, personal gifts to children outside the program as well as any other information sponsors freely disclose about themselves such as marital status, number of own kids, profession, hobbies, and philanthropic interests;
- Information about children enrolled in our sponsorship program and their families: any information that can be used to trace a child’s identity, including but not limited to child’s name, address / community where they live, government-issued identification number, date of birth, language(s) spoken, religion, weight, height, school grade, living arrangements, hobbies and dreams, chores they do at home; parents’ names, marital status, mother’s maiden name, parents’ employment status, professions, number of people who live in the same household and their relationship, and level of household poverty; as well as any information pertaining to that child such as medical, educational, financial or employment information and responses to surveys or questionnaires that may be traced back to an individual child or family member;
- Images, including photographs and videos;
- Personal information CBs receives that it did not request such as in emails or comments on its website;
- Other personal information used for purposes that a reasonable person would consider appropriate in the circumstances.
3) HOW CHILDREN BELIEVE COLLECTS PERSONAL INFORMATION
CB collects personal information in different ways, including:
- Direct interactions: individuals may voluntarily provide CB with personal information by filling out forms; creating an account on its website; making a donation; applying to work or volunteer for CB; registering to attend an event; requesting information to be sent to them; subscribing for CB’s publications; responding to CB’s direct mail or telemarketing campaigns; participating in a CB event; posting comments on its website; or communicating with CB face to face, over the telephone, by mail, by email, by text, through social media or through other means.
- Automated interactions: when someone uses its website, CB may automatically collect technical data about their equipment and browsing history using cookies and similar technologies (See below for more information).
- Third party interactions: CB may receive personal information from GoFundMe or PayPal Giving Fund Canada if someone makes a donation to CB through those platforms.
CB may collect personal information when someone interacts with its content on its website or on third party sites or platforms, such as Facebook, Instagram or You Tube. This may include data such as comments or feedback, “likes” or shares, profile data or the fact that someone viewed or interacted with its content.
CB may receive personal information from third parties such as regulatory bodies, government agencies, social workers or health professionals in the course of providing its services.
Personal information collected through GoFundMe platform
Children Believe is using the services of GoFundMe, which provides technology that enables CB to create fundraising appeals and campaigns, and third-party individuals to fundraise for CB. Funds donated through GoFundMe (GFM) are processed by PayPal Giving Fund Canada (PPGFC).
When making a donation through GFM, an individual’s personal information will be processed in a foreign jurisdiction and may be accessed by authorities in that jurisdiction. Donors are advised to review GFM’s and PPGFC’s terms of service and user agreements carefully before agreeing.
Personal information collected through our website(s)
Children Believe may use “cookies”. A cookie is a small text file that a website can send to an individual’s browser, which may then store the cookie on the person’s hard drive. Some of the cookies we use may be necessary for security purposes, to authenticate you and enable you to use our website. Other cookies may not be essential but may make it easier for you to use our website (such as by identifying you, remembering your preferences and helping you navigate the website) Some cookies are used to help us analyze the use and performance of the website, as well as for advertising or tracking purposes, including allowing our advertising partners to track and analyze your behaviour on our website and across the internet So, when an individual visits CB website again, we can tailor information to suit their individual preferences. The goal is to save the person time, provide them with a more meaningful visit and to measure website activity. Browsers allow an individual to disable cookie collection if they wish or inform them when a cookie is being stored on their hard drive. If you do not want information collected through the use of cookies, you can disable cookies by changing the setting of your Internet browser. If you disable cookies, you may be unable to use or access some features on our Websites.
Children Believe collects information from users at several different points on its website. We use IP addresses to analyze trends, administer the site, track users’ movements, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.
- the Internet domain for an individual’s Internet service provider, such as “company.com” or “service.ca” and the IP address of the computer accessing the website, such as “ppp-55”
- the type of browser or operating system being used
- the date and time of an individual’s visit to our site, along with the address of the previous website the person was visiting, and if they linked to us from another site
This tracking system doesn’t record personal information about individuals or link this information to any personal data collected. It’s used to help us make our site more useful to visitors.
Links to Other Websites
Our website contains links to other sites. Clicking on those links may allow third parties to collect or share information about users. CB is not responsible for the privacy practices of other such sites. CB cannot control these third party websites and is not responsible for the actions or policies of such third parties. Users should check the privacy policies of third parties when visiting their websites or when providing any personal information to them.
CB may collect personal information when someone interacts with its content on third-party sites or platforms, such as Facebook, Instagram or You Tube. This may include data such as comments or feedback, “likes” or shares, profile data or the fact that a person viewed or interacted with its content. If someone voluntarily posts or submits any information on these platforms, their personal information may be automatically included in the posting and may be collected and used by others.
4) WITH WHOM DOES CHILDREN BELIEVE SHARE PERSONAL INFORMATION?
CB may share personal information with the parties set out below for the following purposes:
- GFM or PPGFC, subject to data sharing agreements with those organizations, in connection with its fundraising activities.
- Other registered charities in connection with specified fundraising activities, subject to agreements requiring them to follow appropriate privacy practices.
- Service providers, such as those who provide it with IT and system administration services, fundraising services, telemarketing services, direct mail services, donor relations services, donation management services, database management services and after hours calls management services.
- Professional advisors, such as lawyers, auditors, bankers and insurers who provide it with legal, accounting, auditing, banking and insurance services.
- Government, regulatory authorities, law enforcement, dispute resolution bodies, courts and similar entities to comply with any legal or regulatory obligation, to detect and prevent crimes or to assert or defend legal rights and interests.
- Any persons or entities where it has a legitimate business reason for doing so, such as to manage risk, to process payments f or to perform or carry out the terms of any contract.
- To the transferee if it transfers, sells or disposes of all or substantially all of its assets or operations.
- To anyone it reasonably believes is an individual’s agent.
- To other third parties if it has told someone about them and they have given it their consent.
Treatment of donor information and donor lists
Children Believe does do not rent, sell, barter or trade donor lists.
5) THE PURPOSES FOR WHICH CHILDREN BELIEVE USES PERSONAL INFORMATION
The main purposes for which CB generally uses personal information are:
- To manage, oversee and administer its operations
- To deliver its programs and services
- To administer its child-sponsorship program
- To pursue government relations and advocacy initiatives
- To deliver public education
- To conduct and facilitate fundraising appeals
- To administer gifts in accordance with donor wishes
- To process donations
- To receive and process donations through GoFundMe or PayPal Giving Fund Canada when someone makes a donation to CB through those platforms
- To contact donors who have made donations to CB through GoFundMe or PayPal Giving Fund Canada
- To manage its relationship with donors
- To conduct marketing efforts
- To undertake statistical reporting
- To meet funder requirements
- To with any legal regulatory requirements
- To maintain and manage relationships and provide customer service
- To identify and authenticate users in its information system and network
- To provide, administer and protect its website, information system and network
- For privacy and quality management audits and training
- To protect its rights, property or safety or that of its employees, volunteers or any other person
- For other purposes to which individuals consent
- To fulfill other purposes permitted or required by law
Children Believe does not collect more personal information than it needs to achieve these purposes.
We may provide restricted information (name, address, partial credit-card number) for administrative purposes to vendors located in the United States.
Treatment of personal information of children and families in our sponsorship programs
Children Believe programs in the countries where we work — including our child-sponsorship program — are implemented by local organizations who have been carefully selected and screened and have entered in a contractual relationship with CB (“Partners”). Our Partners are bound by this policy when they collect, use and disclose any personal information on behalf of CB.
As a member of ChildFund Alliance, CB has entered into an affiliate relationship with the Taiwan Fund for Children and Families, ChildFund Korea and Barnfonden (Sweden) who are sponsoring children in CB’s sponsorship programs. For this purpose, we share with our affiliates the following information: child name, child ID, sponsor name and sponsor ID.
Personal information relating to children and youth is particularly sensitive, especially the younger they are. Consistent with the position of the Office of the Privacy Commissioner of Canada, it will not knowingly collect personal information from children under the age of 13 unless we have the consent of their parents or guardians. We collect the minimum amount of personal information of children and youth necessary to achieve our purposes.
If you are a child or youth, you should review this Privacy Policy with your parents or guardians to make sure that you understand and consent to everything in it. IF YOU ARE UNDER THE AGE OF 13, you should not access our website or provide us with any personal information unless your parent or guardian has consented. If we discover that we have collected personal information from a child under the AGE OF 13 without parental consent, we will delete that personal information.
6) PRIVACY AND CONFIDENTIALITY PRINCIPLES WE UPHOLD
6.1. Accountability
Children Believe is responsible for the personal information under its control. To this end we commit to:
- Designating an individual or individuals to ensure compliance with this policy
- Implementing practices and procedures to carry out this policy including:
- Procedures to protect personal information
- Procedures to receive and respond to complaints and enquiries from individuals regarding their personal information
- Training and communicating to staff, volunteers and partners about this policy and practices
- Developing information to explain its privacy policy and practices to its stakeholders
6.2. Identifying purposes
Children Believe will identify the purposes for which personal information is collected. The identified purposes will be specified at or before the time of collection to the individual from whom the personal information is collected. When personal information that has been collected is to be used for a purpose not previously identified, we will communicate the new purpose to each individual and obtain their consent to use the information.
6.3. Consent
Children Believe only collects, uses and discloses personal information with your knowledge and consent. Your consent may be expressed orally, electronically or in writing or it may be implied. We are committed to obtaining meaningful consent and use clear explanations and plain language to make sure that our consent processes are understandable and user friendly.
You have the right at any time to withdraw or cancel your consent to the collection, use or disclosure of your personal information by contacting the CB’s Privacy Officer. Withdrawals of consent only take effect from the date of cancellation. They cannot be retroactive. We will let you know if your withdrawal could have any consequences, such as CB being unable to provide you with goods or services.
The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where consent is not required for very specific reasons. It is anticipated that instances in which knowledge and consent of the individual would not be required would be extremely rare and would include legal, medical or security reasons, which would have to be fully documented.
Consent is considered valid only if it is reasonable to expect that individuals to whom CB’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure, to which they are consenting.
6.3.1. Typically, CB staff and volunteers will seek consent for the use or disclosure of the information at the time of collection. The form of the consent sought by CB may be either express or implied, depending upon the circumstances and the sensitive nature of the personal information.
6.3.2.Express consent is required from an individual before CB will disclose personal information about children in our sponsorship programs. Express consent can be provided verbally or in writing. For children under age 13, consent must be given by parents or guardians. CB ensures that the consent process for youth able to provide consent themselves reasonably considers their level of maturity.
6.3.3. The provision of personal information to CB constitutes implied consent to collect, use and disclose their personal information in accordance with this policy, unless an individual expressly instructs otherwise.
6.3.4. No consent: There are certain activities for which consent is not required to use or disclose personal information. These activities are permitted or required by law. For example, we do not need consent from individuals to (this is not an exhaustive list) respond to legal proceedings or comply with mandatory reporting obligations, investigations/fraud detection and prevention, witness statements in insurance claims, financial abuse, personal information produced in the course of employment, business or profession, or other as identified by law from time to time.
CB may use or disclose an individual’s personal information without consent where the organization believes, upon reasonable grounds, that it is necessary to protect the rights, privacy or safety of an identifiable group or person (including the individual in question) or the public.
6.3.5. Withholding or Withdrawal of Consent: If consent is sought, an individual may choose not to give consent (“withholding consent”). If consent is given, an individual may withdraw consent at any time, but the withdrawal cannot be retroactive. The withdrawal may also be subject to legal or contractual restrictions and reasonable notice
6.4. Limiting collection
The collection of personal information will be limited to that which is necessary for the purposes identified by CB. Information will be collected by fair and lawful means.
6.5. Limiting use, disclosure and retention
Personal information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information will be retained only as long as necessary for the fulfillment of those purposes.
Whenever possible, access to personal information will be limited to authorized users only. Personal information may only be used within the limits of each staff and volunteer role. Staff and volunteers may not read, look at, receive or otherwise use personal information unless they have a legitimate “need to know” as part of their position.
Personal information may only be disclosed within the limits of each staff / volunteer role. Staff and volunteers may not share, talk about, send to, or otherwise disclose personal information to anyone else unless that activity is an authorized part of their position.
When CB discloses personal information to third‐party service providers with whom it has a contractual relationship, the third‐party providers will only be given access to personal information that is needed to perform the related function and may not use it for any other purpose. We require all third parties to respect the security of your personal information and to treat it in accordance with all applicable legal requirements. All third party service providers are required to enter into contractual agreements with us that prevent them from using your personal information for their own purposes and require them to use your personal information only for specific purposes in accordance with our instructions and all applicable legal requirements.
6.6. Accuracy
Children Believe will take reasonable steps to ensure that personal information in its custody is accurate, complete and up‐to‐date as is necessary for the purposes for which it is to be used. We will not routinely update personal information, unless such a process is necessary to fulfil the purposes for which the personal information was collected. Individuals will always have the opportunity to contact CB to update their personal information by contacting the Privacy Officer.
6.7. Safeguards
Children Believe will use appropriate security safeguards (depending on the sensitivity of the information) to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification, regardless of the format in which it is held. It uses security safeguards appropriate to the sensitivity of the information.
Safeguards will include: physical safeguards (such as locked filing cabinets and rooms, clean desk policies); administrative safeguards (such as permitting access to personal information by staff on a “need‐to‐know” basis only); and technological safeguards (such as the use of password protocols, encryption software, routine updates of our software and audits)
Children Believe requires that any individual or third‐party who collects, uses or discloses personal information on behalf of the organization complies with the provisions of this policy. This will be done through the signing of confidentiality agreements, privacy training and other contractual means. We require all third party service providers to enter into contractual agreements that require them to respect the security of your personal information and to treat it in accordance with all applicable legal requirements.
We securely destroy personal information so that reconstruction is not reasonably possible to prevent unauthorized parties from gaining access to the information.
While it uses appropriate safeguards, CB cannot guarantee the absolute security of the personal information in its custody and we cannot ensure or warrant the security of any information you provide to us. You can reduce risk to your own personal information by using strong passwords, keeping your passwords confidential and following other personal information security best practices.
6.8. Openness
Information about CB privacy policies and practices relating to the management of personal information will be available to the public, including:
- Contact information for our Privacy Officer[s], to whom complaints or enquiries can be made;
- The process for obtaining access to personal information held by CB, and making requests for its correction;
- A description of the type of personal information held by CB, including a general account of our uses and disclosures;
- A description of how an individual may make a complaint to CB; and Copies of any materials or other information that explain the CB’s policies, standards, or codes.
6.9. Individual access
If an individual requests it, CB will inform them of the existence, use, and disclosure of their personal information. The individual will be given access to that information, will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
In certain situations, CB may not be able to provide access to all the personal information it holds about an individual. Exceptions to the access requirement will be limited and specific. The reasons for denying access will be provided to the individual upon request. Exceptions may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal, security, or commercial proprietary reasons, and information that is subject to solicitor‐client or litigation privilege.
6.10. Challenging compliance
An individual will be able to address a challenge concerning CB’s compliance with its own Privacy and Confidentiality Policy to the Privacy Officer(s).
Privacy officers will receive and respond to complaints or enquiries about organizational policies and practices relating to the handling of personal information. They will inform individuals who make enquiries or lodge complaints of other available complaint procedures.
CB will investigate all complaints. If a complaint is found to be justified, CB will take appropriate measures to respond.