Privacy & Cookie Policy
Last updated: October 26, 2023
Kawartha Youth Orchestra, its subsidiaries, and its affiliates (“Kawartha Youth Orchestra”, “KYO”, “we”, “us”, “our”) respect your privacy and are committed to protecting your personal data. This Privacy & Cookie Policy (also referred to as Privacy Policy) describes our data collection and processing activities, including:
- what personal data we may collect when you interact with us through our various channels online (such as our website at https://kawarthayouthorchestra.org, https://thekyo.ca and via our apps and social networks) and offline (such as over the telephone, via text, messaging application, in meetings or at events) and what we may do with that personal data;
- how we may collect and process information through the use of cookies and related tracking technologies on our online channels; and
- your data protection rights, including (where applicable) a right to object to processing and a right to withdraw your consent to processing, and how to exercise them.
When we refer to “personal data” in this Privacy Policy we are referring to any information that falls under the definition of “personal data” in the Personal Information Protection and Electronic Documents Act.
It is important that you read this Privacy & Cookie Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This Privacy & Cookie Policy supplements the other notices and is not intended to override them.
Kawartha Youth Orchestra is responsible for the processing of your personal data as described in this Privacy Policy. For the purposes of the Personal Information Protection and Electronic Documents Act, in respect of our core service offerings, Kawartha Youth Orchestra acts as the controller, business, and personal information processor, respectively, of such personal data.
The contact details of Kawartha Youth Orchestra’s Data Protection Officer are provided in Section 11 below.
1.1. Updates to this privacy & cookie policy
This Privacy & Cookie Policy may be updated periodically. We will update the date at the top of this Privacy & Cookie Policy accordingly and encourage you to check for changes to this Privacy & Cookie Policy, which will be available on our website. On some occasions, we may also actively advise you of specific data handling activities or significant changes to this Privacy & Cookie Policy, as required by applicable law.
1.2 Third-party links
Our website(s) may include links to or functionality from third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.
1.3 Kawartha Youth Orchestra as Data Processor
From time to time, Kawartha Youth Orchestra may process personal data in the role of a service provider on behalf of partner organizations, funders, or program collaborators. For example, this may occur where we facilitate surveys, grant reporting, program evaluations, or other forms of data collection requested by a partner. In these cases, the partner organization acts as the data controller and maintains its own privacy and data security practices, which will also apply. Kawartha Youth Orchestra will, however, support our partners as necessary to respond to any requests you may have regarding the processing of your personal data. If you require further information about a partner’s data processing activities, please contact us using the details in Section 11.
Please note that if you participate in a survey facilitated by Kawartha Youth Orchestra, this survey may either be administered by us on behalf of a partner or programmed by a third party directly on behalf of that partner. This Privacy Policy will apply to the processing of your survey responses where Kawartha Youth Orchestra administers the survey. Where the survey is administered by a third party, Kawartha Youth Orchestra will not collect, store, or otherwise process your survey results, and the third party and/or partner organization will have in place separate privacy and data security practices that apply.
“Personal data” means any personally identifiable information belonging to an identifiable natural person, including but not limited to an identifier such as a name, an identification number, location data, an online identifier, or factors specific to the physical, economic, cultural, or social identity of that natural person, and for the avoidance of doubt, includes the term “personal data” as defined in the Personal Information Protection and Electronic Documents Act.
2.1 Categories of Personal Data Collected
We may collect, create, use, store and otherwise process different categories of personal data depending on how you use and interact with our products, services and online channels. We have grouped these categories below as follows:
- Identifier Data, including first name, maiden name, last name, job title, and company name.
- Contact Data, including your address(es), email address(es), and telephone number(s).
- Profile Data, including your CV, professional background, professional headshot, languages spoken, location and country of residence, relevant qualifications, career history and moves, and any additional information, which may include special category personal data and sensitive personal information to the extent it is manifestly made public by you or you voluntarily choose to provide it to Kawartha Youth Orchestra in connection with a particular project or service offering.
- Due Diligence Data, including data you make publicly available (e.g., via social media and networking platforms) where required to meet specific anti money laundering, counter terrorism financing, anti-bribery legislation, or other regulatory requirements, or where needed to research, filter, and verify the experience and qualifications of board members, volunteers, employees, consultants, or contractors, or to screen for potential conflicts of interest.
- Identity Data, including a copy of your governmental ID and a photo of your face that contains facial scan or “biometric” data.
- Financial data, (if we need to pay you), including bank account details.
- Payment Data, (if you engage with Kawartha Youth Orchestra as a client, participant, or donor), including your card details and other information to process your payments, including your payment history and billing address.
- Transaction Data, including interactions you may have had with us (e.g., parties entering and exiting our conference bridge, duration and time of interactions), and any expert/client feedback.
- Marketing and Communications Data, including your preferences for receiving marketing from us and your communication preferences.
- Technical Data, including internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website(s) and online services.
- Usage Data, including information about how you use our website, social media pages, apps, products, and services, including the URL clickstream to, through, and from our online channels (including date and time), products you viewed or searched for, the content that you view or interact with, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs or acceptance of our Terms of Engagement), and methods used to browse away from the page.
2.2 Circumstances When we May Collect Your Personal Data
We may collect such categories of personal data either directly from you or from third parties and publicly available sources. We may ask you to confirm the accuracy of the personal data we process about you.
2.3 Aggregating Your Personal Data
We aggregate your Usage Data with the information of other website visitors, experts and clients, creating a dataset of information about the usage of our online channels, our apps, products and services, and other general, grouped information about our user base. It provides a valuable insight into the use of our services and we may share it with select third parties. This dataset is aggregated and anonymized, meaning it cannot directly identify you as an individual and is not considered personal data.
2.4 When am I Required to Provide Personal Data?
We may have a legal obligation to collect and process your personal data, or we may require your personal data in order to provide you with specific products and services, including accessing our platform.
If you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you, and/or the quality of the products and services we provide to you might be affected. In these circumstances, we may cancel a service you receive from us or stop proceeding with a contract we are trying to enter into with you, but we will notify you if this is the case at the time.
Please note that this does not apply to the collection of biometric data provided by contractors or consultants in applicable jurisdictions for identity verification purposes. The provision of biometric data is voluntary and will not, in any way, impact our payment obligations to you. However, we may be unable to engage you in any further engagements with Kawartha Youth Orchestra without first completing our identity check.
In accordance with the Personal Information Protection and Electronic Documents Act S.C. 2000, c. 5, we rely on a number of lawful bases to process your personal data.
In certain situations, we may need to process, or ask third parties to process on our behalf, your special category personal data. Special category personal data means information that can reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data (if used to uniquely identify that person), and information concerning a person’s health, sex life, or sexual orientation. We will also rely on your prior, explicit consent to process:
Profile Data that you voluntarily share with us that falls within the definition of special category personal data, including personal data revealing your racial or ethnic origin and data concerning your health or sexual orientation, for the purposes of facilitating specific projects that fall within that scope;
any facial scan data that is processed by an approved third party on our behalf to verify your identity.
Your consent is entirely voluntary and failure to provide consent will not prevent us from fulfilling our contractual obligations to you.
Our website uses cookies to enhance functionality and analyze site traffic. Cookies are small text files stored on your device. You can control cookie preferences through your browser settings. Disabling cookies may affect your experience on our site.
We may be required to share your personal data with the third parties listed below for the purposes described in Section 3 above or otherwise with your consent:
- Affiliated Charitable Programs and Partners: Kawartha Youth Orchestra is a Canadian registered charity that works in collaboration with community partners and funders. Personal data collected by us in accordance with this Privacy Policy may be used and shared with affiliated organizations and partner charities to support the effective delivery of programs, services, and outreach.
- Service Providers: When we engage third-party organizations or individuals to perform services on our behalf (such as IT support, cloud hosting, payment processing, or survey administration), we provide them with only the personal data necessary to perform their specific function. These providers are contractually authorised to use your personal data only as required to deliver services to us.
- Volunteers, Instructors, and Program Staff: In limited circumstances, we may share contact or participation data with individuals engaged in delivering our programs (such as music instructors, accompanists, or volunteers) to ensure safe and effective program administration.
- Funders and Grantmakers: We may share de-identified or aggregate data with funders, foundations, and government agencies for purposes of program evaluation and grant reporting. Identifiable personal data is shared only when required and with your consent.
- Legal Requirements: We may disclose personal data to government authorities, regulators, or other third parties if required to do so by law.
- Organizational Changes: In the unlikely event of a merger, dissolution, or transfer of programs to another charitable organization, relevant personal data may be included as part of the transition to ensure continuity of services.
- Technology Partners: Kawartha Youth Orchestra may use digital platforms, including tools that incorporate artificial intelligence (AI), to provide you with certain services such as online communications or survey analysis. Should you choose to use these technologies, any personal data provided by you may be shared with the underlying third-party technology provider in accordance with their privacy practices.
Your personal data may be transferred to and stored by Kawartha Youth Orchestra online using Google infrastructure. Your personal data may also be used and accessed by members of our group, including those across Canada, the USA, and transferred to the third parties disclosed in Section 6 above who are internationally based. Accordingly, your personal data may be processed outside of your country or jurisdiction. If we transfer your personal data outside of your country or jurisdiction, we ensure that the recipient of your personal data has appropriate safeguards in place to protect your personal data.
We have put in place appropriate organisational, technical and physical security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
We will only retain your personal data for as long as we believe necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, reporting, or audit requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
10.1 Your Rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right to request access, correction, erasure, object to processing, opt out of direct marketing, request restrictions on processing, request the transfer of your data, and withdraw consent.
10.2 How to Exercise Your Rights
To exercise your rights, please contact us using the information in Section 11 below.
10.3 No Fee Usually Required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.
10.4 What we May Need From You
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data.
10.5 Time Limit to Respond
We try to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests.
We hope we can satisfy any queries you may have about the way we process your personal data. If you have any concerns or would like to exercise any of your rights, contact our Data Protection Officer by email at dpo@thekyo.ca. We are committed to working with you to obtain a fair resolution of any complaint or concern about your privacy.