Purpose and Goals
This policy is designed to:
- Provide policies and procedures for the Commerce Undergraduate Society ("CUS," "we," "us," or "our") to comply with the Personal Information Protection Act of British Columbia ("PIPA").
- Align the CUS's privacy practices with those of our parent organization, the Alma Mater Society of the University of British Columbia ("AMS"), as a Constituency of the AMS.
Applicability
This Policy applies to the collection, use, and disclosure of personal information by the CUS and its committees, departments, services, clubs, events, and businesses (collectively, the "Subsidiaries"). Some of those bodies may have supplementary privacy policies relating to their specific activities.
It also applies to access to personal information under the control of the CUS and its Subsidiaries.
As a Constituency of the AMS, the CUS operates in accordance with, and in support of, the AMS's own Privacy Policy (PIPA compliance policy), and this Policy should be read alongside that document.
Exclusions
This Policy does not impose any limits on the collection, use, or disclosure of the following information:
- business contact information;
- certain publicly available information; and
- such other information as PIPA allows us to collect, use, and disclose without notice or consent.
Definitions
For the purposes of this policy:
Subsidiaries shall mean the committees, departments, services, clubs, events, teams, and businesses of the CUS.
Parent Organization shall mean the AMS, of which the CUS is a Constituency.
Policy
Accountability and General Provisions
- The CUS is committed to complying with PIPA.
- In accordance with PIPA, we will inform our executives, volunteers, members, employees, sponsors, and customers of why and how we collect, use, and disclose their personal information, obtain their consent where required, and handle the personal information in a manner that a reasonable person would consider appropriate in the circumstances.
- We will make our best efforts to ensure the accuracy, confidentiality, and security of the personal information we receive from our executives, volunteers, members, employees, sponsors, and customers, and will allow them to request access to, and correction of, their personal information.
- We will communicate the purposes for which personal information is being collected, either orally or in writing, before or at the time of collection, and will only use or disclose personal information where necessary to fulfill the purposes identified at the time of collection.
Types of Information Collected
We may collect, use, and disclose various types of personal information, but only for the purposes stated at the time of collection, such purposes to be reasonable ones relating to the operations, programs, and services of the CUS and its Subsidiaries. The types include:
- Contact information (personal email addresses, personal phone numbers, residential addresses).
- Identifying information (student numbers, CWL's, information about age, and information about a student's year, program, or specialization).
- The names of CUS clubs, teams, or other Subsidiaries that you belong to or participate in.
- Surveys or feedback forms you take part in.
- Employment- or volunteer-related information (resumes, applications, payroll information).
- Purchase-related information for tickets, merchandise, or services purchased through the CUS (e.g., credit card numbers, processed via a third-party payment processor).
- Information provided in connection with CUS events, competitions, case teams, or student services.
- Demographic information.
Purposes for Collecting, Using, and Disclosing Information
The purposes for which we may collect, use, and disclose personal information include:
- to provide and administer the services, resources, programs, events, and products of the CUS and its Subsidiaries, and to disclose the information for any purpose related to those activities;
- to plan and deliver the programs, products, and services of the CUS and its Subsidiaries, and to evaluate and monitor those programs, products, and services;
- to implement and enforce the bylaws, policies, procedures, agreements, and decisions of the CUS and its Subsidiaries, and to comply with legal and regulatory requirements;
- to monitor compliance with the bylaws and policies of the CUS and its Subsidiaries and with any agreements entered into by the CUS and its Subsidiaries;
- to authenticate the identity of students, members, employees, etc.;
- to maintain accurate member and club records;
- to provide information to anyone working with or for the CUS or its Subsidiaries as needed for the provision of requested programs, products, or services;
- to process payments by credit card;
- to bill accounts and maintain payment records;
- to provide and administer the website(s) and social media outlets of the CUS and its Subsidiaries;
- to communicate with users of the programs, services, products, website(s), or social media outlets of the CUS and its Subsidiaries and to respond to inquiries from those users;
- to communicate with members of the CUS by newsletters and other means;
- to conduct elections to the governing bodies of the CUS and its Subsidiaries;
- to conduct surveys;
- to administer club, team, and event activities;
- to provide personal information to third-party suppliers of products and services (e.g., sponsors, payment processors);
- to protect against fraud and error and to safeguard the business interests of the CUS and its Subsidiaries;
- to document and address any service issues or complaints;
- to assist in law enforcement, where required;
- to process contests, sweepstakes, or other promotions and fulfill any related awards or discounts; and
- to distribute personal information to third parties, including financial institutions, payment processors, and lawyers, for any of the above purposes.
The CUS and its Subsidiaries will not collect personal information indiscriminately, but will limit collection of personal information to what is reasonable and necessary or as authorized by law.
Consent
- We will obtain consent to collect, use, or disclose personal information except where authorized or permitted to collect information without consent, such as where collection is required by law, or when obtaining consent would compromise an investigation.
- Consent can be express, implied, or given through an authorized representative.
- Consent may be provided orally, in writing, electronically, or through inaction (such as when an individual fails to opt out of a stated purpose after receiving notice of it).
- An individual may withdraw consent at any time, subject to legal, contractual, and other restrictions, provided that they give reasonable notice of their withdrawal of consent. If consent is withdrawn, the CUS or its Subsidiaries will inform the person withdrawing their consent of the likely consequences of that withdrawal, which may include an inability to provide certain services.
Limits on Use and Disclosure
- When collecting personal information, the CUS and its Subsidiaries will make clear what purpose the information will be used for, and will not use it for any other purpose unless first obtaining consent to use it for that other purpose.
- When making a decision based on personal information, the CUS and its Subsidiaries will retain that information for at least one year after using it to make the decision so that the individual affected by the decision can consult that information.
- The CUS and its Subsidiaries will destroy, erase, or make anonymous documents or other records containing personal information as soon as it is reasonable to assume that the original purpose is no longer being served by retaining the information and retention is no longer necessary for a legal or business purpose.
- The CUS and its Subsidiaries will take due care when destroying personal information so as to prevent unauthorized access to the information.
Service Providers
The CUS and its Subsidiaries may retain agents, subcontractors, or service providers from time to time in relation to our operations or the programs, products, or services that we provide. If we require a service provider to deal with your personal information, we will take reasonable steps to ensure that the service provider adheres to privacy procedures and will keep your personal information confidential. We will not provide more information than is necessary to the service provider and will ensure that the information is returned or destroyed once the purpose for which it was given is fulfilled.
Our service providers may be located outside of British Columbia or Canada, and personal information may be processed and stored in foreign jurisdictions with different (and perhaps weaker) privacy laws, and the governments, courts, or law enforcement or regulatory agencies in those jurisdictions may be able to obtain disclosure of that personal information through the laws of the foreign jurisdiction.
Accuracy
- We will make a reasonable effort to ensure that personal information we are using or disclosing is accurate and complete.
- If you demonstrate the inaccuracy or incompleteness of personal information, we will amend the information as required. If appropriate, we will send the amended information to third parties to whom the information has been disclosed.
- When a challenge regarding the accuracy of personal information is not resolved to your satisfaction, we will annotate the personal information under our control with a note that the correction was requested but not made.
Safeguarding Personal Information
- We protect the personal information in our custody or control by making reasonable physical, organizational, and electronic security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks.
- We will take reasonable measures, through contractual or other reasonable means, to ensure that a comparable level of protection is implemented by the suppliers and agents who assist in providing services.
- Note that confidentiality and security are not assured when information is transmitted through e-mail or other wireless communication.
Providing Access
- You have a right to access your personal information held by us.
- Upon your written request and our authentication of your identity, we will provide you your personal information under our control. We will also give you information about the ways in which that information is being used and a description of the individuals and organizations to whom that information has been disclosed. We may charge you a reasonable fee for doing so.
- We will generally make the information available within 30 days of receiving a written request, or we will provide written notice where additional time is required to fulfil the request.
- In some situations, we may not be able to provide access to certain personal information (e.g., if disclosure would reveal personal information about another individual, the information is protected by solicitor/client privilege, the information was collected for the purposes of an investigation, or disclosure would reveal confidential commercial information that could harm our position). We may also be prevented by law from providing access to certain personal information.
- If we refuse an access request, we will notify you in writing and document the reasons for refusal.
Complaints
- We will, on request, provide information regarding our complaint procedure.
- Any inquiries, complaints, or questions regarding this Policy should be directed in writing to our President at president@cus.ca.
Related Policies and Legislation