Our Commitment to Your Privacy The Refuge is committed to protecting your privacy. We value the trust of our volunteers, donors, members, supporters, and all others who work with us, and we recognize that maintaining your trust requires that we be transparent and accountable in how we handle your personal information. The following Privacy Policy explains how The Refuge collects, uses, discloses, and safeguards the personal information of volunteers, donors, members, supporters, and all others who work with us – whether provided to us through a signed registration form; orally in person or over the phone; electronically through a web site; or, in select circumstances, obtained by us from public domain sources such as published directories or other organizations’ public documents such as annual reports.

DEFINITIONS

PERSONAL INFORMATION – Personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form such as age, name, ID numbers, income, opinions, evaluations, comments, social status, employee files, disciplinary actions and the like.

CONSENT: Consent is obtaining permission to collect, store and use someone’s personal information. Consent is considered valid when it is reasonable to expect that individuals can understand the nature, purpose and consequences of the collection, use or disclosure to which they are consenting.

IMPLIED CONSENT: Implied consent arises where consent may reasonably be inferred from the action or inaction of the individual.

EXPRESS CONSENT: Express consent where the individual provides consent explicitly, either orally, in writing, or thorough a specific online action, such as clicking on “I agree”.

PRIVACY OFFICER : The Privacy Officer of The Refuge will be assigned to the Executive Director of The Refuge and is responsible for ensuring the policies in this document are followed. However, The Executive Director will have the ability to assign the duties and responsibilities to a senior director of The Refuge.

PIPEDA : Personal Information Protection and Electronic Documents Act of Canada.

PURPOSES FOR COLLECTING INFORMATION

The Refuge will collect personal information for the following purposes:

Employees and Volunteers
To process payment information, benefits and for regulatory purposes under federal and provincial legislation.
To provide opportunities for growth and development with regards to employee and volunteer performance and correction.
To provide feedback to employees and volunteers.
To advocate for the well-being of the employee or volunteer during times of peril or safety.
To communicate relevant information about the programs, policies, events and operations of The Refuge.

Donors and Event Participants
To administer events and contest information for which the donor/participant willingly registered.
To communicate relevant information about the programs, events and operations of The Refuge.
To process tax receipts.
To process regular or monthly donations.

Youth
For the purposes of current and historical program evaluation.
To provide statistical data to funding agencies/government.
To determine program eligibility.
To help youth progress towards goals/objectives.
For communication purposes with regards to the activities of The Refuge.
To advocate for the well-being of the youth during times of peril or safety.

INFORMED CONSENT

Consent is valid only if it is reasonable to expect that individuals to whom an organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure, to which they are consenting.

The Refuge will seek the informed consent of staff, volunteers, donors, event participants and youth. The Refuge will not obtain consent by deceptive means.

The Refuge will also not withhold or deny products or services to an individual who fails to consent to the collection, use or disclosure of information beyond that required to fulfill an explicitly specified and legitimate purpose.

Donors and Event Participants
When a donation is made by an individual or business, the donor’s information will be collected using implied consent.
When an individual signs up for an event hosted by The Refuge, their information will be collected using implied consent for both financial purposes as well as to communicate the details of that specific event to the individual in the future.
Express consent will be used to add an event participant to the general communication list of The Refuge.

Youth

When a youth voluntarily signs up or uses a regular program of The Refuge, it will be understood that they are implying consent to collect personal information based on the approved purposes listed above in this policy.
Expressed consent will be obtained for the Housing First program, formal counselling and Wilderness Rocks and financial assistance programs.

Exceptions to Consent
There are a number of specific exceptions to the requirements to obtain knowledge and consent for the collection, use or disclosure of personal information.

The Refuge may collect personal information without the individual’s knowledge or consent only:
-if it is clearly in the individual’s interests and consent is not available in a timely way;
-if knowledge and consent would compromise the availability or accuracy of the information and collection is required to investigate a breach of an agreement or contravention of a federal or provincial law;
-for journalistic, artistic or literary purposes so long as the material is subjective in nature and does not identify the individual;
-if it is publicly available as specified in the regulations;
-where it is produced by individuals in the course of their employment as long as the collection is consistent with the purpose for which the information was produced.

The Refuge may use personal information without the individual’s knowledge or consent only:
-for an emergency that threatens an individual’s life, health or security;
-if it is clearly in the individual’s interests and consent is not available in a timely way;
-if knowledge and consent would compromise the availability or accuracy of the information and collection is required to investigate a breach of an agreement or contravention of a federal or provincial law;
-for journalistic, artistic or literary purposes so long as the material is subjective in nature and does not identify the individual;
-if it is publicly available as specified in the regulations;
-where it is produced by individuals in the course of their employment as long as the collection is consistent with the purpose for which the information was produced.

The Refuge may disclose personal information without the individual’s knowledge or consent only:

-to a lawyer representing The Refuge;
-to collect a debt the individual owes to The Refuge;
-to comply with a subpoena, a warrant or an order made by a court or other body with appropriate jurisdiction;
-to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as required by the Proceeds of Crime and Terrorist Financing Act;
-to a government institution that has requested the information, identified its lawful authority to obtain the information, and indicates that disclosure is for the purpose of enforcing, carrying out an investigation, or gathering intelligence relating to any federal, provincial or foreign law; or suspects that the information relates to national security, the defence of Canada or the conduct of international affairs; or is for the purpose of administering any federal or provincial law;
-if it is publicly available as specified in the regulations;
-where it is produced by individuals in the course of their employment as long as the collection is consistent with the purpose for which the information was produced.
in an emergency threatening an individual’s life, health or security (The Refuge must inform the individual of the disclosure);
-to a government institution, individual’s next of kin, or authorized representative if necessary to identify an individual who is injured, ill or deceased (and if alive, the individual must be informed in writing that the disclosure has taken place);
-20 years after the individual’s death or 100 years after the record was created;
-if required by law.

RETENTION AND DESTRUCTION

The Refuge will keep and retain information for only as long as it is necessary to fulfill the purposes for which the information was collected or in compliance with the law or various regulatory bodies. This information will be stored in a manner that is safe and secure and that protects. Once the information is no longer necessary, it will be destroyed/deleted in a manner that protects the identity and personal information of the individual.

RETENTION

Donors
The Ontario Public Guardian and Trustee has the ability to conduct an audit on an Ontario charitable organization with no limit. As such, financial records such as donation source, amount must be kept digitally and/or hard copy without limit. However, The Refuge will only limit a donor’s personal information to:
-Name
-Address
-Phone or email contact information
-Donation dates and amounts
-Method of donation and/or cheque image if available

The Refuge will not retain a donor’s credit card information, envelopes with personal addresses, personal notes and/or cards for longer than it is needed to complete the intended purpose for retaining this information. After this information is no longer useful it will be destroyed in accordance with this policy.
Donor’s personal information will be kept in a secured location and will be physically locked when stored in hard copy or will be locked by password encryption when stored electronically.

Youth
-Youth personal information will be retained for a period of 7 years after a youth no longer receives services from The Refuge or for a period as specified by the staff member’s overseeing college or regulatory organization of which she/he is a member; whichever is greater.
-Each April, The Refuge will evaluate which information needs to be destroyed.
-Youth personal information will be stored in a secured location and will be physically locked when stored in hard copy or will be locked by password encryption when stored electronically.

Employees/Volunteers
-The Ontario Employment Standards Act (ESA) legislates that employee records must be kept for three years after the employee ceases to be employed by The Refuge. Volunteer records will be treated in the same manner as an employee’s records. After a period of three years, the personal information will be destroyed.
-Each April, The Refuge will evaluate which information needs to be destroyed.
-Employee and volunteer information will be stored in a secured location and will be physically locked when stored in hard copy or will be locked by password encryption when stored electronically.

Destruction
-When personal information is no longer relevant for the purposes for which it was collected, that information must be destroyed in a way that prevents privacy breach.
-Hard copy documents must be shredded using a cross-cut shredder
-Electronic documents must be deleted and purged from the recycle/trash bin
-Electronic devices containing personal information must be purged of all personal information and must be ‘reset’ when being disposed.-

SAFEGUARDS
The Refuge will protect personal information against loss or theft in a way that does not breach the privacy of the individual(s) by:
-password protecting all electronic devices that contain personal information;
-storing all hard copy personal information in a locked area/cabinet which will remain locked when not being accessed/used;
-password protecting all software that contains personal information;
-restricting access to offices where personal information is located;
-having all staff and volunteers sign and abide by The Refuge’s confidentiality agreement;
-removing sharing rights on all cloud stored documents unless intentionally granted.

ACCESS TO INFORMATION

Generally, individuals have a right to access the personal information that The Refuge holds about them. While The Refuge has a general obligation under PIPEDA to provide access to personal information upon request, there are exceptions to this obligation.

Mandatory Exceptions
The Refuge must refuse an individual’s access to personal information if it would reveal personal information about another individual unless there is consent or a life-threatening situation.

Discretionary Exceptions
The Refuge may refuse access to personal information if the information:
-is protected by solicitor-client privilege;
-would reveal confidential commercial information if the information cannot be severed;
-would reasonably be expected to harm an individual’s life or security if the information cannot be severed;
-was collected without the individual’s knowledge or consent to ensure its availability and accuracy, and the collection was required to investigate a breach of an agreement or contravention of a federal or provincial law (the Privacy Commissioner of Canada must be notified in this case);
-was generated in the course of a formal dispute resolution process.

Process

-If an individual requests access to their personal information that has been collected by The Refuge, they must make their request in writing or by email that has been sent to privacy@refugeoutreach.com
-When a request has been made, The Refuge will take steps to validate the individual’s identity to ensure that it is the individual making the request. This could be by providing date of birth, mailing address or other personal information that has been collected by The Refuge.
-The Refuge will respond to the request for information as quickly as possible but no later than 30 days after receipt of the request.
-The normal 30-day response limit may be extended for a maximum of 30 additional days
     -if responding to the request within the original 30 days would interfere unreasonably with the activities of The Refuge.
     -if additional time is necessary to conduct consultations
     -if additional time is necessary to convert personal information to an alternate format.
-In the event that the normal response time of 30 days is extended, The Refuge will notify, in writing if possible, the individual making the request within 30 days of receiving the request, and of her/his right to complain to the Privacy Commissioner of Canada.
-If The Refuge has no grounds (as described in this policy) to refuse the request, The Refuge will provide the requested information at no cost to the individual.
-If The Refuge has grounds to refuse the request (as described in this policy), The Refuge will inform, in writing, the individual that her/his request has been denied and set out the reasons and any recourse available to the individual.

RECOURSE

The Refuge seeks to provide the utmost integrity when it comes to collecting and retaining personal information. However, if, at any time, an individual has concerns or complaints about how The Refuge handles her/his privacy, that individual has the ability to make a formal complaint.

-All complaints regarding privacy must be made in writing or by email to privacy@refugeoutreach.com
-The date the complaint is received and the nature of the complaint will be recorded (eg. delay in responding to a request, incomplete or inaccurate responses, or improper collection, use, disclosure or retention). Privacy complaints will be stored and treated privacy information as per this policy.
-The Refuge will acknowledge, in writing or by email, that the complaint has been received.
-The individual making the complaint will be contacted if more information/clarity is needed.
-The complaint will be assigned to the Executive Director who will review the complaint fairly and impartially. In the event the complaint is against the Executive Director, either the staff member assigned to be the Acting Executive Director or the Board of Directors will investigate the complaint.
-The individual will be made aware of the outcome of the investigation clearly and promptly, informing them of any relevant steps taken.
-The ED will correct any inaccurate personal information or modify policies and procedures based on the outcome of the complaint, and ensure that employees and volunteers at The Refuge are aware of any changes to this policy.
-If the complainant is unsatisfied with the outcome, that individual will have the right to appeal the decision to the Board of Directors of The Refuge in writing or by email to board@refugeoutreach.com
-If the complainant is unsatisfied with the decision of the Board of Directors of The Refuge, the individual may make a formal complaint to:

The Office of the Privacy Commissioner of Canada
Place de Ville Tower B
3rd Floor
112 Kent Street
Ottawa, ON K1A 1H3
(613) 947-1698