Privacy Policy

1. Introduction

The Ontario Integration Initiative (“OII”, “we”, “our”, “us”) is committed to protecting the privacy, dignity, and confidentiality of the individuals and communities we serve across Ontario and internationally.

This Privacy & Data Protection Policy explains:

• What personal information we collect
• Why we collect it
• How we use, store, and protect it
• When we may share it
• Your rights over your personal information
• How to contact us with questions or concerns

We follow all applicable Canadian privacy laws, including:

• PIPEDA (Personal Information Protection and Electronic Documents Act)
• Ontario’s privacy and human rights legislation
• Accessibility for Ontarians with Disabilities Act (AODA)
• Canada Not-for-Profit Corporations Act (CNCA)
• CRA requirements for registered charities

We also align with our internal policies such as the Governance Manual, HR Manual, and ALPS Monitoring & Learning Framework.

2. Scope of This Policy

This policy applies to:

• Program participants
• Volunteers, peer navigators, youth advisors
• Event attendees and registrants
• Staff, consultants, and contractors
• Donors, partners, and supporters
• Website visitors and online service users
• Individuals completing surveys, forms, evaluations, or MEL tools

It covers all personal information collected by OII in Ontario and internationally through:

• Our website (ontariointegration.ca)
• Digital forms (Google Forms, MEL tools, evaluation surveys)
• Program registration systems and QR code systems
• Event ticketing and attendance systems
• Emails, SMS, or WhatsApp communications
• Donor and fundraising platforms
• HR and recruitment systems
• Community consultations and advisory activities

3. What Personal Information We Collect

Depending on your interaction with OII, we may collect:

3.1 Basic Contact Information

• Name
• Email address
• Phone number
• Mailing address

3.2 Program & Service Information

• Attendance records
• Session registration details
• Emergency contacts
• Demographic information (optional and anonymized whenever possible)
• Accessibility needs

3.3 Evaluation & Learning (ALPS/MEL Data)

• Survey responses
• Feedback forms
• Case notes or support logs (for wellness or navigation services)
• Stories of impact (with consent)
• Demographic disaggregation (voluntary)

3.4 Sensitive Information (Collected Only When Necessary)

• Immigration or newcomer status (voluntary)
• Mental health or wellness information (for support programs)
• Equity-related identity markers (optional; stored securely)
• Vulnerable sector screening for staff or volunteers
• Emergency or crisis disclosures

Sensitive data is handled with elevated protections and only accessed by authorized staff.

3.5 Website & Technical Information

• IP address
• Browser type and device information
• Website usage analytics
• Cookies (see Section 10)

3.6 Human Resources (HR) Information

For staff, consultants, and volunteers:

• Employment records
• Background checks
• Payroll and tax information
• Performance evaluations
• Benefits and pension information
• Training records

4. How We Use Personal Information

We use personal information to:

4.1 Deliver Programs & Services

• Register participants
• Facilitate workshops, events, and support groups
• Provide referrals and navigation support
• Communicate updates, reminders, and resources

4.2 Ensure Safety & Duty of Care

• Manage emergencies
• Maintain appropriate safeguarding practices
• Conduct crisis follow-ups (as required)
• Ensure compliance with Youth Safety and Vulnerable Sector guidelines

4.3 Evaluation, Learning & Accountability

Consistent with our ALPS and MEL frameworks, we use data to:

• Track participation and outcomes
• Evaluate program effectiveness
• Improve services
• Report anonymously to funders and stakeholders

We NEVER publish or share named participant data without written consent.

4.4 Recruitment, HR & Workplace Operations

• Hiring and onboarding
• Payroll administration
• Benefits and pensions
• Performance management

4.5 Donations & Fundraising

• Issuing tax receipts
• Maintaining donor records
• Sending stewardship updates (opt-out available)

4.6 Legal and Regulatory Compliance

• CRA charity requirements
• Audit readiness
• Risk and safeguarding compliance

5. Legal Basis for Collecting Personal Information

We collect and process information under the following lawful bases:

• Consent (program registration, surveys, contact forms)
• Contractual necessity (employment, consultancy agreements)
• Legal obligation (CRA, funder reporting, safeguarding)
• Legitimate interest (program evaluation, service improvement)
• Vital interest (emergency health/safety situations)

Consent is always revocable unless information must be retained for legal or audit purposes.

6. How We Store and Protect Your Information

We take strong steps to safeguard personal information, including:

6.1 Administrative Safeguards

• Privacy training for all staff
• Role-based access control (only authorized staff see necessary data)
• Confidentiality agreements for staff, volunteers, and contractors

6.2 Technical Safeguards

• Encrypted cloud storage (Google Workspace, password-protected)
• Multi-factor authentication (MFA)
• Secure data transfer protocols
• Limited retention periods
• Regular backups and audit logs

6.3 Physical Safeguards

• Locked filing cabinets for paper documents
• Controlled office access
• Shredding of physical materials containing personal data

7. When We Share Personal Information

OII does not sell or trade personal information.

We only share information when necessary and appropriate:

7.1 With Your Consent

• Sharing information with partner agencies
• Using photos, audio, or stories
• Referrals to external services

7.2 With Funders

We share aggregated and anonymized data ONLY, unless a funder requires identifiable data and we obtain explicit consent.

7.3 With Service Providers

These include:

• Google Workspace
• Payroll and HR platforms
• Survey tools (e.g., SurveyMonkey)
• Event platforms (if used)

Vendors are required to meet Canadian or comparable privacy standards.

7.4 For Legal or Safety Reasons

We may share personal information if:

• Required by law
• Needed to protect someone’s vital safety
• Required by CRA, auditors, or legal authorities

8. How Long We Keep Information

We retain personal information only as long as necessary:

• Program records: 5 years (standard nonprofit/funder requirement)
• HR and payroll records: 7 years
• MEL data: 5–7 years, anonymized when possible
• Donor records: 7 years
• Safety or incident reports: 10 years or as required by law

After the retention period, data is securely deleted or shredded.

9. Your Rights

You have the right to:

• Access your personal information
• Request corrections or updates
• Withdraw consent
• Request deletion (unless legally required to retain)
• Ask how your data is being used
• File a complaint

We respond within 30 days.

10. Cookies & Website Tracking

Our website uses cookies to:

• Improve user experience
• Analyze website traffic
• Customize content

You may disable cookies in your browser, though some features may not function fully.

We do not track individual users or use invasive advertising technologies.

11. Children’s & Youth Privacy

Given that OII works with youth, we take additional precautions:

• Parental/guardian consent where legally required
• Trauma-informed and culturally safe practices
• Strict confidentiality except in safety concerns
• No data shared publicly without written permission

12. International Operations & Data Transfers

OII may work with international partners.
Any cross-border data sharing:

• Requires explicit consent
• Must follow Canadian privacy standards
• Uses secure, encrypted systems

We do not transfer identifying participant information outside Canada without explicit permission.

13. Data Breach Response Plan

If a data breach occurs, OII will:

1. Contain and assess the breach
2. Notify affected individuals as required
3. Notify the OII Board and relevant authorities
4. Provide guidance and support
5. Document the incident under our Risk & Safeguarding protocols
6. Make system improvements to prevent future breaches

14. Changes to This Policy

This policy is reviewed every 24 months or sooner if:

• Laws or regulations change
• OII policies change
• New technologies or program models require updates

Any major revisions will be posted on our website.

15. Contact Us

Ontario Integration Initiative (OII)
60 Dixon Road
Etobicoke, ON
M9P 2L5
Canada

Email: info@ontariointegration.ca
Phone: +1 416 900 9131

If you have questions or concerns about privacy, please contact:
Director of Finance & Administration (Privacy Officer)
privacy@ontariointegration.ca