The Foundation is bound by the requirements of all relevant Provincial and Federal legislation, including but not limited to the Personal Information Protection and Electronic Documents Act, ("PIPEDA"), Canadian Anti-Spam Legislation (CASL) or such other legislation as may apply from time-to-time. The Foundation will comply with all associated Guidelines established by the Canada Revenue Agency ("CRA") as amended and/or updated from time-to-time.

The Foundation will determine which federal, provincial or territorial privacy law applies to each activity. PIPEDA generally applies to personal information handled in the course of commercial activity and to certain interprovincial or international transfers; it does not automatically govern every charitable or fundraising activity.

The Foundation will comply with CASL where a communication is a commercial electronic message or CASL otherwise applies. It will document the consent, existing relationship, statutory exclusion or exemption relied upon and include prescribed sender information and an unsubscribe mechanism where required.

The Foundation shall immediately honor any request from a recipient to be removed from its circulation or mailing list.

Queries or Complaints

The Foundation will make readily available specific information about our policies and practices relating to the electronic communications and will respond to complaints and/or breaches as per all guidelines established in legislation.

Complaints relating to treatment of personal information or any related matter may be made by contacting the Foundation's Chief Executive Officer ("CEO") or designate. The CEO or designate will explain the Foundation's procedure and inform the complainant about other complaint procedures available. The Foundation will investigate all complaints. If in the Board's opinion an objection is justified, we will take all appropriate steps to repair the situation including changing our policies and practices if necessary.

Contact Information

Questions, concerns or complaints relating to this policy on the treatment of personal information should be directed to:

Chief Executive Officer

Privacy and security contact: [Insert role, monitored email address and telephone number].

Further information go to Canada's Anti-Spam Legislation

Canadian Law and Regulatory Compliance

CASL applies to commercial electronic messages and related conduct; not every message sent by a charity is commercial and express consent is not the only possible legal basis. Before sending a message, the Foundation will document whether CASL applies and the consent, existing relationship, statutory exclusion or exemption relied upon. Where required, messages will identify the sender, provide contact information and include a functional unsubscribe mechanism processed within the statutory period.

The Foundation will use multi-factor authentication, least-privilege access, encryption appropriate to risk, supported software, tested backups, secure configuration, vendor due diligence, phishing controls and a written incident-response process. Access will be removed promptly when a person changes role or leaves.

Personal information and confidential records will be transmitted and stored only through approved systems. Suspected fraud, unauthorized access, ransomware, loss of a device or disclosure of personal information must be reported immediately to the designated incident lead and escalated under the privacy, insurance and legal-notification procedures.

Application note: This template must be read with the Foundation's articles, bylaws, gift terms and the federal, provincial or territorial laws that apply to its incorporation, activities and operating jurisdictions. Organization-specific facts and provincial requirements require lawyer confirmation before adoption.

Monitoring: This policy will be reviewed every three years or when legislation changes.

Board Acceptance: This policy was approved/reaffirmed at the ___________Board meeting.