Privacy

1. Purpose of This Privacy Policy

This Privacy Policy explains how Community Development Council Durham collects, uses, discloses, stores and protects personal information obtained through our programs, services, community activities, fundraising, employment processes, volunteer activities, research initiatives, websites and other interactions.

CDCD recognizes that individuals have a right to understand how their information is handled. We seek to collect only the information that is reasonably necessary for legitimate purposes and to use or disclose that information only for those purposes, with consent where required, or as otherwise permitted or required by law.

2. Our Privacy Principles

CDCD is committed to responsible information-management practices. Personal information under our control will be managed in a manner that supports the following principles:

• Personal information will be collected fairly and lawfully.
• We will identify the purposes for which information is being collected, wherever reasonably practicable.
• We will obtain meaningful consent when consent is required.
• We will limit collection to information reasonably necessary for the identified purpose.
• Information will be used or disclosed only for appropriate purposes, unless further consent is obtained or another use or disclosure is permitted or required by law.
• We will take reasonable steps to maintain accurate and up-to-date information where accuracy is necessary.
• Personal information will be protected using reasonable administrative, technical and physical safeguards.
• Information will be retained only for as long as reasonably necessary or as required by law, contractual obligations, funder requirements or applicable records-retention policies.
• Individuals may ask questions, request access to information about themselves, request corrections where appropriate, or raise concerns about CDCD’s privacy practices.

3. What We Mean by Personal Information

Personal information is information about an identifiable individual. Depending on the program, service or interaction, this may include information such as:

• Name, address, telephone number and email address;
• Date of birth or age;
• Preferred language and communication needs;
• Immigration, settlement or residency-related information where relevant to a program or service;
• Housing, income, employment, education or family information;
• Information about services requested or received from CDCD;
• Personal health or wellness-related information where relevant and permitted by law;
• Emergency-contact information;
• Donation and donor-history information;
• Employment, volunteer or applicant information;
• Information submitted through forms, surveys, registrations, referrals or correspondence;
• Other information reasonably necessary to deliver services, administer programs or carry out CDCD’s charitable and organizational activities.

Information that has been properly anonymized or aggregated so that an individual cannot reasonably be identified is generally not treated as personal information.

4. Why CDCD Collects Personal Information

CDCD may collect, use and, where appropriate, disclose personal information for purposes including:

• Assessing eligibility for programs, services or financial assistance;
• Delivering housing, settlement, newcomer, humanitarian, community-development and other services;
• Developing individualized service plans and coordinating appropriate supports;
• Making referrals to another service provider or organization with appropriate consent;
• Communicating with clients about appointments, programs, services or follow-up;
• Maintaining service records and documenting services provided;
• Evaluating program quality, outcomes and service effectiveness;
• Meeting reporting, accountability or audit obligations to government funders and other authorized funding partners;
• Conducting approved research, planning, evaluation or community-development activities;
• Managing donations and issuing charitable tax receipts where applicable;
• Recruiting and administering employees, volunteers, students and applicants;
• Responding to inquiries, complaints, compliments or requests;
• Protecting the safety, security and legal interests of clients, staff, volunteers, visitors and CDCD;
• Meeting legal, regulatory, contractual or funding requirements.

5. Consent

Where consent is required, CDCD will seek consent that is appropriate to the sensitivity of the information and the circumstances in which it is collected, used or disclosed. Consent may be express or implied where permitted by law.

Individuals may ask questions about why information is needed and how it will be used before providing consent.

An individual may withdraw consent to a particular use or disclosure of personal information, subject to legal, contractual, funding, safety or service-delivery limitations. Withdrawal of consent may affect CDCD’s ability to provide a particular service where the information is necessary to deliver that service.

6. Client and Service Records

CDCD may maintain electronic or paper records relating to clients and service users. The information contained in a record will depend on the program or service and may include:

• Contact and identifying information;
• Information relevant to the individual’s circumstances, needs or service goals;
• Program eligibility information;
• Assessments, referrals and service plans;
• Case notes or records of services provided;
• Documentation required by funders or applicable law;
• Personal health information where required for a particular service and where CDCD is authorized to collect it.

Access to client information is limited to employees, volunteers, contractors or authorized service providers who require the information to carry out legitimate duties and who are subject to appropriate confidentiality obligations.

7. Personal Health Information

Certain CDCD programs or services may involve the collection or handling of personal health information. Where applicable, such information will be managed in accordance with applicable Ontario privacy and health-information legislation and CDCD policies.

CDCD will seek to limit the collection, use and disclosure of personal health information to what is reasonably necessary for the relevant service, purpose or legal requirement.

8. When CDCD May Share Personal Information

CDCD does not sell or rent personal information.

We may disclose information to another organization or individual where:

• The individual has provided appropriate consent;
• Disclosure is necessary to provide a requested referral, service or coordinated support;
• An authorized service provider performs work on CDCD’s behalf and is required to protect the information;
• Disclosure is necessary to meet legitimate funding, audit or reporting requirements, subject to applicable privacy rules;
• The disclosure is permitted or required by applicable law.

Wherever reasonably possible, CDCD will disclose only the information necessary for the particular purpose.

9. Limits to Confidentiality

Confidentiality is an important part of CDCD’s relationship with clients and community members. However, there are circumstances in which information may be disclosed without consent where the law permits or requires disclosure.

Depending on the circumstances and applicable law, this may include situations involving:

• A serious or imminent risk of harm to an individual or another person;
• Child-protection concerns where there is a legal duty to report;
• A subpoena, summons, warrant, court order or other lawful authority;
• An investigation or proceeding where disclosure is legally authorized;
• Other circumstances in which disclosure is required or expressly permitted by law.

CDCD will seek to disclose only the information that is reasonably necessary in the circumstances.

10. Your Rights Regarding Your Information

Subject to applicable law and reasonable limitations, individuals may have the right to:

• Ask what personal information CDCD has about them;
• Request access to their personal information or client record;
• Ask for assistance understanding information contained in their record;
• Request correction of information they believe is inaccurate or incomplete;
• Ask how their information has been or may be used or disclosed;
• Refuse or withdraw consent where permitted;
• Request an explanation of CDCD’s privacy and confidentiality practices;
• Raise a concern or make a complaint about how their information has been handled.

CDCD may need to verify identity before providing access to personal information.

In certain circumstances, access may be restricted or refused where permitted or required by law. If this occurs, CDCD will provide an explanation where legally appropriate.

11. Accuracy of Information

CDCD makes reasonable efforts to maintain personal information that is accurate, complete and up to date where the information is used to make decisions about an individual or provide services.

Individuals are encouraged to advise CDCD if their contact information or other relevant information changes.

12. Safeguarding Personal Information

CDCD uses reasonable administrative, physical and technical safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, copying, modification, loss, theft or disposal.

Safeguards may include, as appropriate:

• Password-protected and access-controlled systems;
• Role-based restrictions on access to client and organizational information;
• Secure storage of paper records;
• Privacy, confidentiality and information-security policies;
• Staff and volunteer privacy and confidentiality obligations;
• Secure technology, systems and service providers;
• Procedures for responding to privacy or security incidents;
• Secure destruction or deletion of information when retention is no longer required.

No method of electronic transmission or storage can be guaranteed to be completely secure. CDCD nevertheless takes reasonable steps appropriate to the nature and sensitivity of the information under its control.

13. Retention and Disposal

CDCD retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected and to satisfy applicable legal, contractual, funding, operational and records-management requirements.

When personal information is no longer required, CDCD will take reasonable steps to securely destroy, delete, anonymize or otherwise dispose of it in accordance with applicable policies and requirements.

14. Donor Information

CDCD values the trust of donors and supporters and is committed to protecting donor privacy.

Donor information may include a donor’s name, address, telephone number, email address, donation history, communication preferences and information necessary to process a donation or issue an official charitable tax receipt.

Donor information may be used to:

• Process and acknowledge donations;
• Issue charitable tax receipts where applicable;
• Maintain financial and donor records;
• Communicate information about CDCD’s work, impact, fundraising activities or opportunities to support the organization;
• Meet legal, accounting, audit and regulatory requirements.

CDCD does not sell or rent donor information. Donors may contact us if they wish to update their communication preferences.

15. Website Privacy

Individuals can generally browse CDCD’s website without directly providing personal information. Certain website features, registrations, forms, donations, applications or service requests may require visitors to voluntarily submit information.

Information submitted online may include:

• Name and contact information;
• Information submitted through a contact or referral form;
• Program registration information;
• Employment or volunteer application information;
• Donation information or other information necessary to process an online transaction;
• Any other information a visitor voluntarily submits.

CDCD will use information submitted through the website for the purpose for which it was provided and for other compatible purposes permitted by law.

16. Cookies, Analytics and Technical Information

CDCD’s website may use cookies and similar technologies to support website functionality, security, accessibility, performance and analytics.

When a visitor uses our website, certain technical information may be collected automatically, such as:

• Internet Protocol (IP) address;
• Browser type;
• Device type;
• Operating system;
• Pages visited;
• Date and time of a visit;
• Referring website or page;
• Other technical or usage information used to understand how the website is functioning.

This information may be used to improve website performance, understand how visitors interact with the site, identify technical problems and improve access to information and services.

Visitors may be able to adjust cookie preferences through their browser settings. Disabling certain cookies may affect how some website features operate.

17. Online Payments and Third-Party Service Providers

CDCD may use third-party organizations to support activities such as payment processing, donations, website hosting, email communications, event registration, cloud services or other technology functions.

Where third parties process personal information on CDCD’s behalf, CDCD seeks to use service providers that maintain appropriate privacy and security safeguards.

Some third-party services may store or process information outside Ontario or outside Canada. Where information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction.

18. External Websites and Links

CDCD’s website may contain links to websites, platforms or services operated by third parties. CDCD is not responsible for the privacy, security, content or information-management practices of websites that it does not operate or control.

Visitors are encouraged to review the privacy policies of external websites before submitting personal information.

19. Email and Electronic Communications

CDCD may communicate with individuals electronically regarding services, programs, appointments, events, donations, community information or other organizational activities.

Where required, promotional or fundraising electronic communications will be sent in accordance with applicable Canadian anti-spam requirements. Individuals may use an unsubscribe option where provided or contact CDCD to update communication preferences.

Email and other electronic communications may carry privacy and security risks. Individuals should avoid sending highly sensitive information through ordinary email unless specifically instructed to do so using an approved secure method.

20. Research, Evaluation and Community Data

As part of its community-development, planning and service mandate, CDCD may conduct or participate in research, surveys, program evaluation, community consultations and data-analysis activities.

Where personal information is collected for these activities, CDCD will use appropriate consent, confidentiality, data-minimization and information-security practices according to the nature of the project and applicable requirements.

Whenever reasonably possible, research findings and community data intended for public reporting will be presented in an aggregated, anonymized or otherwise non-identifying form.

21. Privacy Incidents and Breaches

If CDCD becomes aware of an actual or suspected loss, unauthorized access, disclosure or other privacy incident involving personal information, the organization will assess the circumstances and take appropriate steps in accordance with applicable law and CDCD procedures.

This may include containing the incident, investigating what occurred, taking corrective action, documenting the incident and, where legally required or otherwise appropriate, notifying affected individuals, funders, regulators or other authorities.

22. Questions, Concerns and Complaints

CDCD welcomes questions and concerns regarding privacy and confidentiality.

Individuals who believe that their personal information has been handled improperly, who wish to request access or correction, or who have questions about CDCD’s privacy practices are encouraged to contact CDCD.

Privacy concerns will be reviewed as fairly, respectfully and confidentially as reasonably possible.

23. Changes to This Privacy Policy

CDCD may update this Privacy Policy from time to time to reflect changes in legislation, programs, technology, organizational practices or privacy requirements.

The most current version will be posted on CDCD’s website. The date of the most recent update will appear near the beginning of this policy.