<div><b><u>YMCA of Simcoe/Muskoka - Privacy Policy and Principles</u><br /><br />Introduction<br /><br /></b></div><div>The federal and provincial governments have passed legislation that require charities and not-for-profit organizations to have in place by January 1, 2004 a privacy policy and public statement, plus a framework for practices to implement the policy and monitoring to ensure compliance.<br /> </div><div>The following is our Association’s privacy policy and statement, plus a set of principles to guide how we implement the policy in practice.<br /> </div><div><b>For YMCA Staff and Volunteers</b></div><div>The following Privacy Policy is to be included in our Association Human Resources Policies and published in our communication materials and on our website.<br /> </div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><i>“The YMCA strives to ensure that volunteers and employees conduct their relationships with each other, participants and all other Association contacts with integrity, good judgement and fairness. The YMCA respects the right of individuals to the protection of their personal information. The YMCA is committed to maintaining the confidentiality, privacy, and accuracy of personal information it collects, uses and discloses about its participants, members, donors, parents/guardians, staff and volunteers.”</i></div></blockquote><div><br /><b>Protecting the Privacy of Personal Information</b></div><div><b><i>Personal information</i></b> is information about an identifiable individual.</div><div><ul><li>Examples of personal information include, but are not limited to, name, address, gender, age, ID numbers, income, racial or ethnic origin, relationship status, employee files, payment or medical/health records, assessments or evaluations.</li><li>An individual’s name does not need to be attached to the information in order for it to qualify as personal information.</li><li>Personal information does not include name, title, business address, or business phone number of an employee of an organization.</li></ul></div><div><b>Available Resources</b></div><div>The following websites provide useful information on privacy:</div><div><ul><li>Office of the Information and Privacy Commissioner/Ontario - <a href="http://www.ipc.on.ca" target="_self">http://www.ipc.on.ca</a></li><li>Privacy Commissioner of Canada - <a href="https://www.priv.gc.ca/en/" target="_self">https://www.priv.gc.ca/en/</a></li></ul></div><div><span style="font-size: 10pt;"><b>Privacy Protection Procedure</b></span></div><div><i>All staff and volunteers must…</i></div><div>Protect personal information by following responsible information handling practices, in keeping with privacy laws. See Protecting the Privacy of Personal Information. YMCA staff and volunteers having access to personal information must follow the ten fair information principles and steps for implementing these principles, in keeping with privacy laws. These principles form the ground rules for the collection, use and disclosure of personal information, as well as for providing access to personal information. Collection, use or disclosure of personal information must only be for purposes that a reasonable person would consider appropriate in the circumstances.<br /> </div><div><b>PIPEDA Fair Information Principles</b></div><div><i>Office of the Privacy Commissioner of Canada, revised May 2019</i></div><div><u><br />Principle 1 – Accountability</u></div><div>An organization is responsible for personal information under its control. It must appoint someone to be accountable for its compliance with these fair information principles.</div><div><br /><u>Principle 2 - Identifying Purposes</u></div><div>The purposes for which the personal information is being collected must be identified by the organization before or at the time of collection.</div><div><br /><u>Principle 3 - Consent</u></div><div>The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.</div><div><br /><u>Principle 4 - Limiting Collection</u></div><div>The collection of personal information must be limited to that which is needed for the purposes identified by the organization. Information must be collected by fair and lawful means.</div><div><br /><u>Principle 5 - Limiting Use, Disclosure, and Retention</u></div><div>Unless the individual consents otherwise or it is required by law, personal information can only be used or disclosed for the purposes for which it was collected. Personal information must only be kept as long as required to serve those purposes.</div><div><br /><u>Principle 6 - Accuracy</u></div><div>Personal information must be as accurate, complete, and up-to-date as possible in order to properly satisfy the purposes for which it is to be used.</div><div><br /><u>Principle 7 - Safeguards</u></div><div>Personal information must be protected by appropriate security relative to the sensitivity of the information.</div><div></div><br /><div></div><div><u>Principle 8 - Openness</u></div><div>An organization must make detailed information about its policies and practices relating to the management of personal information publicly and readily available.</div><div><br /><u>Principle 9 - Individual Access</u></div><div>Upon request, an individual must be informed of the existence, use, and disclosure of their personal information and be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.</div><div><br /><u>Principle 10 - Challenging Compliance</u></div><div>An individual shall be able to challenge an organization’s compliance with the above principles. Their challenge should be addressed to the person accountable for the organization’s compliance with PIPEDA, usually their Chief Privacy Officer.</div><div><br /><b>Ongoing Relevancy</b></div><div>The YMCA regularly reviews its policies and procedures to ensure we remain current with changing laws and evolving public expectations.</div><div><br /><b>Privacy Officer</b></div><div>The Association’s Privacy Officer is responsible for ongoing monitoring of the privacy policy and practices to ensure compliance. Privacy breaches are to be reported to the Privacy Officer immediately. Any inquiries or concerns can be directed to the Privacy Officer at <a href="mailto:hr@sm.ymca.ca" target="_self">hr@sm.ymca.ca</a> or 705-726-9622 x1439.</div>