Intent:

Habitat for Humanity GO is committed to protecting the privacy of the personal information of its donors, employees, volunteers and other stakeholders.  We value the trust of those we deal with and of the public, and recognize that maintaining this trust requires that we be transparent and accountable in how we treat the information that our constituents choose to share with us.

Policy:

Policies and procedures have been developed to meet the 10 principles as outlined in the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Accountability

We are accountable for all personal information in our possession.

All employees, volunteers, agents and authorized service providers of Habitat for Humanity GO are required to protect the confidentiality of personal information.  Every precaution is always made to ensure confidentiality of all personal information.

Where we chose to have certain services, such as data processing, provided by third party providers, we select the service provider carefully.  We take all reasonable precautions to ensure that the service provider protects personal information.  These service providers enter into confidentiality agreements, do not keep any personal information on file beyond the life of their contract with us and are prohibited from selling any personal information accessed through our organization.

2. Identifying Purposes

We collect, use and disclose personal information only for certain purposes that we identify.

We collect, use or disclose personal information only to:

  • Help us in our fundraising activities
  • Process and receipt donations
  • Provide our constituents with information about our activities including newsletters and build notices.
  • Respond to constituent requests for information.
  • Process applications for partnering for a Habitat home
  • Keep appropriate personnel records on volunteers and employees

Personal information collected will be limited to that required for the purpose identified by us.

3. Consent

We collect, use or disclose personal information only with expressed permission. Permission may be expressed in writing or be implied, and may be given verbally or electronically.

Permission may be withdrawn to collect, use and disclose personal information at any time, subject to legal and contractual restrictions and reasonable notice.  We will obtain consent before making information available to third parties; accept in the case where it is required by legal order.

4. Limiting Collection

We will only collect personal information related to a specified purpose and only what is needed for that purpose.

5. Limiting Use, Disclosure and Retention

We do not sell personal information. (See notes regarding Direct Mail and Workplace Donors).

We will keep personal information only as long as it is necessary to satisfy the purposes for which it is obtained, or as required by law.  When we destroy personal information, we will use safeguards to prevent unauthorized parties from gaining access to that information during the process.

6. Accuracy

People whose personal information has been collected by HFH GO are entitled to seek correction of their personal information if they believe that the information in our possession is not correct.

7. Safeguards

We protect personal information against loss, theft, as well as unauthorized access, disclosure, copying, use or modification.  The level of security is appropriate to the sensitivity of the information.

Access to personal information is restricted to Habitat for Humanity GO staff, agents and authorized volunteers and service providers.  Access is granted on a need to know basis and monitored by the organization’s Privacy Officer.  All Habitat for Humanity staff and volunteers who have access to personal information have received training on the importance and proper handling of personal information.

Personal information is stored in locked cabinets and/or password protected databases.

8. Openness

Habitat for Humanity GO will make readily available to any interested party specific information about our policies and practices relating to the management of personal information.

9. Individual Access

We will allow individual access to a constituent’s personal information, recognizing they have the right to know if we hold any personal information about them, how it was collected, if it is accurate, and how we are using it.  We require up to 24 hours notice to enable access  without compromising the privacy of our other staff, volunteers and donors.

10. Challenging Compliance

Anyone whose information is held by HFH-GO may register a privacy-related complaint by contacting Habitat for Humanity’s Privacy Officer.  The Privacy Officer will explain the procedure for filing a complaint and the process of its investigation. If an objection is found to have merit we will take appropriate steps to repair the situation, including changing our policies and practices if necessary.

Procedure:

  1. All staff and volunteers who handle personal information on behalf of HFH GO will be required to annually review and sign a Professional Standards Agreement, and a Confidentiality Agreement.
  2. The reason for the collection of personal information must be clearly stated verbally or in writing at the time of the collection of private information.  The information collected must be used only for the reason stated at the time of collection.  Permission must be sought to use the information for any other purpose.  The ability to “opt out” of the multiple use of information must always be made available at the time of collection.
  3. If a staff, volunteer, donor or other key stakeholder expresses a desire to “opt out” of any particular use of their personal information; adjustments must be made to all records to reflect this wish as soon as possible.
  4. All personal information will be kept in locked files and password protected computer environments.  All reasonable attempts must be made to keep records taken from these sites (i.e. for the purposes of meetings) secure.
  5. Personal information will not be kept indefinitely.  Records will be shredded once the utility of the information has expired or in accordance with legal requirements or HFH GO Board policies.
  6. Staff, volunteers, partner families, donors and key stakeholders may request a viewing of the information held by Habitat for Humanity GO, with up to 24 hours notice. The records will be made available by the Chief Executive Officer or Privacy Officer in a timely fashion and assure that access does not breach the confidentiality of other private information stored in the same environment.
  7. The Chief Executive Officer or Privacy Officer may refuse access to a record containing personal information in cases involving the courts, or where the security of the organization is compromised. Any refusal to access personal information will be reported to the Privacy Commissioner in accordance with the Personal Information Privacy Electronics Documents Act (PIPEDA).
  8. Staff, volunteers, partner families, donors and key stakeholders have the right to file a complaint about the handling of their private information.  The Privacy Officer will provide a complaint form to anyone wishing to file a complaint with Habitat for Humanity GO.  A record of the outgoing complaint form will be made.  The complaint must be filed within two weeks of requesting the form for a timely review. Once the complaint is received the Privacy Officer will review it; a remedy will be sought, approved by the Chief Executive Officer and proposed to the complainant.  If this remedy is acceptable it will be executed and the case will be considered resolved. A copy of the complaint and resolution will be filed with the Privacy Commissioner.  If the remedy is not considered acceptable by the complainant they will be asked to provide the terms of what they would like to see happen to resolve the complaint. This will be taken to the Chief Executive Officer for review.  If the terms are not acceptable it will be forwarded to the HFH-GO Board and subsequently the Privacy Commissioner if a resolution cannot be reached internally.