Skip to main content

Guiding Policies Privacy Protection

Purpose

The purpose of this Privacy Policy (the “Policy) is to establish a framework for the collection, use, disclosure and retention of Personal Information by the YMCA of British Columbia (the “YMCA”). The YMCA respects and is committed to protecting the Personal Information that it collects and uses about its Staff, Clients and Donors as required under applicable privacy legislation, including the British Columbia Personal Information Protection Act (“PIPA”). 

Definitions 

In this Policy, the following terms have the following meanings:

“Client” means any individual that accesses services or programs administered by the YMCA, including members of the YMCA and participants in YMCA programming. 

“Donor” – means any individual who directly contributes to or directly supports the YMCA such as by leaving a gift in their will; donating appreciated stocks, bonds or mutual funds units; or by donating money. 

“Personal Information” refers to any information about an identifiable individual that is collected, used, disclosed or processed by the YMCA in connection with its services, operations or administration. 

“Staff” means employees, contractors, directors and volunteers of the YMCA.

Other terms not specifically defined in this section will have the meanings given to them elsewhere in this Policy or as otherwise defined. 

Scope

This Policy applies to the Personal Information of Staff, Donors and Clients.

Purposes of Collection 

Staff 

The YMCA collects, uses, discloses, processes, and maintains Personal Information about Staff for legitimate business reasons, for the purposes of establishing, managing and ending the employment relationship and for other purposes permitted under PIPA, including for: 

  • recruiting and hiring, including for purposes of verification of qualifications and conducting reference and background checks as reasonably required
  • improving and evaluating the YMCA’s programs and services, including by establishing training and development programs
  • staffing, scheduling and to administer vacations and other leaves
  • business, program and service delivery purposes
  • performance evaluation and monitoring
  • promotion, demotion and discipline
  • investigating specific incidents involving Staff
  • monitoring compliance with policies and addressing security and internal control issues
  • payroll and benefits administration
  • ensuring safety in the workplace, including but not limited to preventing the spread of viruses and communicable diseases
  • determining and implementing workplace accommodations
  • communicating with Staff, such as with respect to important upcoming dates, changes to benefits, health and safety-related alerts and new program rollout information; and
  • complying with the YMCA’s legal, regulatory and contractual obligations.

Clients

The YMCA collects, uses, discloses and maintains Personal Information about Clients for legitimate business reasons and for other purposes permitted under PIPA, including for:  

  • accessing, improving and evaluating the YMCA’s programs and services
  • enrolment of individuals in YMCA programming
  • maintaining and processing referrals
  • delivery of the YMCA’s programs and services
  • processing and collecting fees
  • identifying Client preferences
  • the safety and security of Clients
  • responding to Client complaints and concerns
  • providing requested product, program, opportunities or service information
  • for statistical purposes, and only in aggregate, unidentifiable form
  • determining Client eligibility for the YMCA’s programs and services
  • informing Clients of new products, programs or services that may interest them
  • complying with the YMCA’s legal, regulatory and contractual obligations.

Donors

The YMCA collects, uses, discloses and maintains Personal Information about Donors for legitimate business reasons and for other purposes permitted under PIPA, including for: 

  • accepting and processing gifts
  • issuing tax receipts; and
  • complying with the YMCA’s legal, regulatory and contractual obligations.

The YMCA respects Donors’ wishes to remain anonymous, excepting situations where the YMCA is required by law to disclose certain information. 

Types Of Personal Information Collected About Staff, Clients and Donors 

The information that the YMCA may collect for the above purposes includes information such as:

  • an individual’s name, contact information, social insurance number (SIN), and emergency contact information
  • information about an individual’s employment history, education and qualifications
  • background check information, including criminal, credit, income or citizenship information
  • an individual’s financial and banking information needed for payroll and benefits administration or gift-giving administration purposes
  • information about an individual’s workplace performance and conduct
  • information to investigate workplace incidents
  • photos, images and activities collected through the YMCA’s surveillance systems
  • medical, dietary or physical restrictions or preferences
  • health information for the purposes of accommodation and benefits administration; and
  • health information for the purposes of coordinating a response to a pandemic, epidemic or workplace illness.

The YMCA seeks to limit the scope of the Personal Information that it collects, uses and discloses about Staff, Clients and Donors to what is reasonable and necessary in the circumstances. 

Consent

The YMCA collects, uses and discloses Personal Information with the knowledge and consent of Staff, Donors and Clients, except in circumstances in which PIPA permits or requires the YMCA to collect, use and disclose Personal Information without consent.  

If the YMCA seeks to use Personal Information for other purposes that are not identified in this Policy, the YMCA will ask for consent before doing so, unless otherwise permitted under PIPA. Where required, individual consent will be obtained either in person, in writing, or by electronic means.  

Consent may be implied in some situations while express consent is required for the collection, use, and sharing of sensitive Personal Information. “Implied consent” exists when an individual is “deemed” to consent to collection, use, or disclosure of Personal Information if the individual voluntarily provides it for a purpose that would, at the time, be considered obvious to a reasonable person. “Express consent” signifies that an individual, knowing what Personal Information is being collected and for what purposes, willingly agrees to the information being collected, used, and disclosed as notified. It may be given in writing or verbally. 

Consent may be withdrawn at any time, on reasonable notice, subject to legal or contractual restrictions. The YMCA will inform individuals of the implications of withdrawal of consent, including where certain services or benefits may become unavailable as a result of the withdrawal.

How and when the YMCA shares personal information

The YMCA shares Personal Information internally only on a need-to-know basis and information shared between Staff must be limited only to that which is necessary for the purposes of fulfilling applicable job duties. The YMCA may also share Personal Information externally with, for example, its service providers, professional advisors (including but not limited to legal counsel, auditors, accountants and insurers), employment and taxing authorities, or law enforcement officials as necessary for the purposes set out in this Policy.  

The YMCA also shares the Personal Information of Donors with the YMCA Foundation of British Columbia for the purposes of gift administration, solicitation of donations, and communications related to current and planned YMCA programming and activities. 

The YMCA uses web-based third-party service providers to perform specialized services on its behalf such as data processing, payroll and benefits administration, and human resource management. Sometimes the YMCA’s service providers come into contact with Personal Information. The YMCA only provides service providers with limited access to the information that is necessary for the applicable service to be performed. Some of these service providers may be located outside of Canada and may, from other jurisdictions, collect, use, disclose, store, process or access the Personal Information of Staff, Donors or Clients. The YMCA takes steps to require service providers to keep Personal Information confidential and expects service providers to protect Personal Information in a manner that is consistent with this Policy, PIPA and the YMCA’s security practices.  

Protection Of Personal Information

 The YMCA implements security safeguards to protect Personal Information against risks such as loss or theft, as well as unauthorized access, disclosure, copying, use, storage or modification. These security safeguards will vary depending on the sensitivity of the information as well as the format in which the information is held and may include: 

  • Physical security measures such as locked filing cabinets and restricted access
  • Organizational measures such as security clearances, access only on a “need to know” basis, processing of and imposing internal limits on data to restrict access and disclosure, and Staff training
  • Technological measures such as the use of passwords, multi-factor authentication, firewalls, data disconnection from the internet, and regular backups
  • Contractual measures such as taking reasonable steps to ensure that a comparable level of protection is implemented by service providers used by the YMCA; and
  • Investigatory measures such as investigating non-compliance with this Policy and
  • PIPA where the YMCA has reasonable grounds to believe that there has been an actual or suspected privacy breach or where Personal Information is otherwise being inappropriately collected, used, stored or disclosed.

Accountability

The YMCA is responsible for the Personal Information under its control. The YMCA has a designated Privacy Officer who is accountable for the YMCA’s compliance with this Policy and with PIPA. The YMCA’s Privacy Officer can be contacted at:   

Privacy Officer
#10 - 620 Royal Avenue, New Westminster, BC V3M 1J2
Email: privacy@bc.ymca.ca