Privacy policies

“PIPP” means the PERSONAL INFORMATION PROTECTION POLICY

“Responsible Person” means the Executive Director

OPEN NORTH is committed to processing personal information in accordance with its responsibilities under its PIPP.

The PIPP assures that all personal information is processed lawfully, fairly and in a transparent manner in relation to individuals;

a) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;

b) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

c) kept in a form which permits identification of an individual person for no longer than is necessary for the purposes for which the information is received, collected or processed; information may be stored for longer periods insofar as the information will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organizational measures required by its PIPP in order to safeguard the rights and freedoms of individuals; and

d) processed in a manner that ensures appropriate security of the information, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

a) This policy applies to all personal information processed by OPEN NORTH. 

b) The Responsible Person shall take responsibility for OPEN NORTH’s ongoing compliance with this policy.

a) All information processed by OPEN NORTH must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests.

b) Where access to information is based on consent, the option to revoke consent can be made available on a case-by-case basis.

a) OPEN NORTH ensures that personal information stored is relevant and limited to what is necessary in relation to the purposes for which they are being collected.

a) To ensure that information is kept for no longer than necessary, OPEN NORTH shall put in place a Personal Information Retention Policy for each area in which information is processed and review this process annually.

b) Archiving is based on consideration of what information should/must be retained, for how long, and why.

a) OPEN NORTH ensures that personal information is stored securely using modern, reliable, third-party applications using up-to-date technology.

b) Access to personal information is limited to personnel who need access and appropriate security should be in place to avoid unauthorized sharing of information.

c) Personal information is deleted safely in such a way that the information is irrecoverable.

d) Appropriate back-up and disaster recovery solutions are in place.

a) Complaints, comments or concerns regarding OPEN NORTH’s PIPP or the handling of personal information can be directed to Merlin Chatwin at info@opennorth.ca.

Any omission from this policy will revert and default to Tri-Council Policy Statement.

END OF POLICY.

This policy covers all personal information collected by OPEN NORTH and stored on OPEN NORTH owned or leased systems and media, regardless of location. It applies to both personal information collected and held electronically and personal information that is collected and held as hard copy or paper files. The need to retain certain information may be mandated by federal or local law, federal regulations and legitimate business purposes.

OPEN NORTH retains only that personal information that is necessary to effectively conduct its program activities, fulfill its mission and comply with applicable laws and regulations.

Reasons for personal information retention include:

• Providing an ongoing service (e.g. sending a newsletter, publication or ongoing program updates to an individual, ongoing training or participation in OPEN NORTH’s programs, processing of employee payroll and other benefits)
• Compliance with applicable laws and regulations associated with financial and programmatic reporting by OPEN NORTH to its funding agencies and other donors
• Compliance with applicable labour, tax and immigration laws
• Other regulatory requirements
• Security incident or other investigation
• Intellectual property preservation
• Litigation

OPEN NORTH seeks to avoid duplication in personal information storage whenever possible, though there may be instances in which for programmatic or other business reasons it is necessary for personal information to be held in more than one place. This policy applies to all personal information in OPEN NORTH’s possession, including duplicate copies of personal information.

OPEN NORTH has set the following guidelines for retaining all personal information as defined in OPEN NORTH’S Personal Information Privacy Policy.

• Website visitor personal information will be retained as long as necessary to provide the service requested/initiated through the OPEN NORTH website.
• Contributor’s personal information will be retained for the year in which the individual has contributed and then for up to 7 years after the date of the last contribution.
• Event participant personal information will be retained for the period of the event, including any follow up activities, such as the distribution of reports, plus a period of up to 7 years.
• Personal information of subgrantees, subcontractors and vendors will be kept for 7 years after the contract or agreement.
• Employee personal information will be held for the duration of employment and then for 7 years after the last day of employment.
• Personal information associated with employee wages, leave and pension shall be held for the period of employment plus 10 years.
• Recruitment personal information, including interview notes of unsuccessful applicants, will be held for 7 years after the closing of the position recruitment process.
• Consultant (both paid and pro bono) personal information will be held for the duration of the consulting contract plus 7 years after the end of the consultancy.
• Board member personal information will be held for the duration of service on the Board plus for 7 years after the end of the member’s term.
• Personal information associated with tax payments (including payroll and corporate business filings) will be held for 7 years.
• Operational personal information related to program proposals, reporting and program management will be held for the period required by the OPEN NORTH donor, but not more than 10 years.

Personal information destruction ensures that OPEN NORTH manages the personal information it controls and processes it in an efficient and responsible manner.

When the retention period for the personal information as outlined above expires, OPEN NORTH will actively destroy the personal information covered by this policy.

If an individual believes that there exists a legitimate business reason why certain personal information should not be destroyed at the end of a retention period, he or she should identify this personal information to his/her supervisor and provide information as to why the personal information should not be destroyed. Any exceptions to this personal information retention policy must be approved by OPEN NORTH’s personal information protection officer.

Any omission from this policy will revert and default to Tri-Council Policy Statement.

END OF POLICY.