1. Purpose

The YMCA BC is committed to respecting the privacy of every individual whose personal information it holds in accordance with applicable privacy legislation. This Policy establishes a framework for the collection, use, disclosure and retention of Personal Information by YMCA BC, reflecting our commitment to compliance and to responsible data stewardship across all programs and services in British Columbia.

This Policy has been developed to be consistent with other related YMCA BC policies and procedures.

2. Definitions

In this Policy, the following terms have the following meanings:

• "Child or Minor” means any individual under the age of 18. For the purposes of the Policy, a Minor may exercise their own privacy rights, including providing consent, where the YMCA BC reasonably determines that the Minor has the capacity to understand the nature and consequences of the collection, use, or disclosure of their Personal Information.
• "Client" means any individual accessing services or programs administered by YMCA BC, including members and program participants of all ages.
• "Donor” means any individual who directly contributes to or financially supports YMCA BC.
• "Personal Information” means any information about an identifiable individual collected, used, disclosed or processed by YMCA BC in connection with its services, operations or administration.
• "Restricted Data” means Personal Information requiring the highest level of protection due to its nature, including health and medical records, government-issued identification numbers, financial account information, and all Personal Information relating to Minors.
• "Service Provider" means any third party engaged by YMCA BC to process, store or handle Personal Information on YMCA BC’s behalf.
• "Staff" means employees, contractors, directors and volunteers of YMCA BC.
  

3. Scope

This Policy applies to all Personal Information of Staff, Clients, Minors and Donors collected, used, disclosed or retained by YMCA BC across all program areas, facilities, digital platforms and administrative functions, including information collected in connection with related government-funded programs and cross-provincial activities.

4. Legislative Privacy Framework

YMCA BC’s privacy practices are governed by the BC Personal Information Protection Act (PIPA). Given the nature of YMCA BC’s operations, YMCA BC may also be subject to other privacy legislation in specific, limited circumstances, including:

• the federal Personal Information Protection and Electronic Documents Act (PIPEDA), where YMCA BC engages in commercial activities that fall within federal jurisdiction, including certain cross-border or cross-provincial activities; and
• the Freedom of Information and Protection of Privacy Act (FOIPPA), where YMCA BC acts as a service provider to, or otherwise processes Personal Information on behalf of, a public body.
  ‍

To the extent PIPEDA, FOIPPA or other privacy legislation applies to YMCA BC, YMCA BC complies with those laws.

5. Data Classification

YMCA BC classifies Personal Information by sensitivity to ensure appropriate levels of protection at every stage of the data lifecycle using an internal data classification framework. Higher sensitivity information, including health and medical records, government-issued identification numbers, financial account information, and all personal information relating to children, is subject to the most rigorous access controls, storage requirements, and handling restrictions. All staff handling YMCA BC data are expected to adhere to the controls applicable to each classification level. Where there is uncertainty about how a particular data set should be treated, staff are directed to escalate to the Privacy Officer.

6. Purposes of Collection

- Clients:

YMCA BC collects, uses, discloses and maintains Personal Information about Clients for legitimate business reasons, including:

• enrolment in and delivery of YMCA BC programs and services across all program areas, including Health, Fitness and Aquatics, Child Care, Camps, and Community programs
• processing and collecting fees and processing referrals
• assessing participant needs and eligibility
• ensuring the safety and security of Clients
• responding to complaints and concerns
• informing Clients of programs or services that may be of interest
• collecting data for statistical or program evaluation purposes, in aggregate unidentifiable form
• complying with YMCA BC’s legal, regulatory and contractual obligations; and
• fulfilling obligations under government-funded program contracts, including but not limited to employment, newcomer and child care programs, where express written consent from participants is required by the funding agreement.

‍

- Minors:

YMCA BC is the province’s largest child care provider and operates programs serving Minors across a wide range of settings, including licensed child care, day camps, aquatics, before-and-after-school programs and youth leadership programs. YMCA BC collects, uses and maintains Personal Information about Minors for purposes that include:

• registration and enrolment in YMCA BC programs and services
• health, medical, dietary and physical restriction information required to ensure participant safety
• emergency contact information for parents or guardians
• tracking attendance, program participation and progress
• communicating with parents and guardians, where appropriate, about program delivery, incidents and updates
• photographs and video for internal documentation, program records or, with specific consent, for YMCA BC communications and marketing
• administering licensed child care, including collecting information reasonably needed to create records required to be collected under the BC Child Care Licensing Regulation
• determining eligibility for subsidized programming
• fulfilling mandatory reporting obligations under the BC Child, Family and Community Service Act; and
• complying with YMCA BC’s legal, regulatory and contractual obligations and YMCA Canada’s national child safety standards.

‍

- Donors:

YMCA BC collects, uses, discloses and maintains Personal Information about Donors for legitimate business reasons, including:

• accepting and processing gifts and issuing tax receipts
• communicating about current and planned YMCA BC programs and activities; and
• complying with YMCA BC’s legal, regulatory and contractual obligations.

YMCA BC respects Donors’ wishes to remain anonymous, excepting where disclosure is required by law.

‍

- Staff:

YMCA BC collects, uses, discloses, processes and maintains Personal Information about Staff for legitimate business reasons, including:

• for the purposes of establishing, managing and ending the employment relationship
• recruiting and hiring, including verification of qualifications and background checks
• staffing, scheduling, payroll and benefits administration
• performance evaluation, promotion, demotion and discipline
• training and development programs
• investigating incidents, complaints or alleged policy violations
• workplace safety, accommodation and pandemic response
• monitoring compliance with YMCA BC policies and applicable laws
• business, program and service delivery purposes
• communicating with Staff on operational matters; and
• complying with YMCA BC’s legal, regulatory and contractual obligations.

7. Types Of Personal Information Collected

YMCA BC limits the collection of Personal Information to what is reasonable and necessary in the circumstances.

The Personal Information that YMCA BC may collect includes:

• name, contact information, social insurance number and emergency contact information
• employment history, education, qualifications and background check information, including criminal, credit or citizenship information
• financial and banking information for payroll, benefits or gift administration
• workplace performance, conduct and incident information
• photos, images, videos, and activities captured through surveillance systems
• medical, dietary or physical restrictions or health information for accommodation, benefits or pandemic response purposes
• for Minors: parent or guardian contact information, health and medical restrictions, attendance records, program progress, and photographs or video with specific consent
• for participants in government-funded programs: program participation data, employment history, housing status, immigration status and other information required by the funding agreement; and
• digital and technical information collected through YMCA BC’s website and digital platforms, as described in Section 11.

8. Consent

YMCA BC collects, uses and discloses Personal Information with the knowledge and consent of individuals, except in circumstances where PIPA permits or requires collection without consent.

Consent may be implied or express depending on the sensitivity of the information. Consent may be given in writing, verbally or by electronic means.

Consent may be withdrawn at any time on reasonable notice, subject to legal or contractual restrictions. YMCA BC will inform individuals of the implications of withdrawal, including where certain services may become unavailable as a result, in accordance with PIPA or other applicable legislation.

9. Children's Privacy

YMCA BC is committed to maintaining high standards of child privacy protection, consistent with YMCA Canada’s national child safety standards and applicable BC law. All Personal Information related to Minors will be subject to security safeguards commensurate with the sensitivity of the information in question.

Moreover, Artificial intelligence (AI) tools must not be used to create content about Minors without human review and approval, and Personal Information of Minors must never be entered into any AI tool.

• For Minors who are not considered to be “mature minors” for the purpose of privacy legislation, YMCA BC will obtain consent from a parent or legal guardian before collecting, using or disclosing Personal Information about the Child.
• For Minors who are considered to be “mature minors” for the purpose of privacy legislation, YMCA BC will obtain consent from the individual directly, with parental or guardian involvement where appropriate and compliant with applicable privacy laws.
• Subject to the YMCA BC’s determination that a Child is mature enough to exercise their own rights under applicable privacy legislation:
  
  • Any photographs, video and other media featuring Minors (excepting images and video collected through YMCA BC’s surveillance system), may only be collected and used with the specific express consent of the Child’s parent or guardian, obtained at the time of enrolment or as circumstances require.
  • Personal Information of Minors will not be used for marketing or promotional purposes without explicit parental consent.
• A parent or guardian may request access to their Child’s Personal Information held by YMCA BC, or request its correction or deletion, by contacting the Privacy Officer.

10. Electronic Communications

YMCA BC complies with Canada’s Anti-Spam Legislation (CASL) and only sends commercial electronic messages in compliance with this legislation.

All marketing and promotional electronic communications will clearly identify YMCA BC as the sender and include a clear, functional unsubscribe mechanism.

YMCA BC will take steps to honour unsubscribe requests within 10 business days. Once an individual has unsubscribed and the request processed, YMCA BC will not send further commercial electronic messages unless new consent is obtained.

Implied consent applies in situations such as where an individual has an existing relationship with YMCA BC and has not unsubscribed. Express consent is required for new contacts and for sensitive or targeted communications.

Transactional and relationship messages, such as program confirmations, payment receipts, safety alerts and service updates, do not constitute commercial electronic messages under CASL.

11. Website, Digital Channels and Cookies

YMCA BC operates a range of digital platforms through which Personal Information is collected such as the YMCA BC public website, the YMCA at Home/Y@HOME+ virtual wellness platform, the LEARN online learning platform, ActiveNet, Traction Rec, and other program registration and member and participant management systems, and associated mobile applications. Each platform collects information such as that described below:

Information Collected Through Digital Channels

YMCA BC may collect, use or disclose Personal Information about Minors, Clients, Staff and Donors and other individuals with whom we interact in the course of our operations through digitals platforms, including the YMCA BC website. The YMCA BC website allows individuals to browse and download information, register for events and communicate with the organization. Across YMCA BC’s digital platforms, information collected (some of which is automatically collected) may include:

• name, contact information and account credentials provided during registration
• program enrolment selections, attendance records and participation history
• health and fitness data voluntarily entered through Y@HOME+ or program registration forms
• learning progress and assessment data within the LEARN platform
• IP address, browser and device type, operating system and session duration
• pages visited, features accessed and referral sources; and
• payment information submitted through secure third-party payment processors.

Information collected automatically is used for purposes such as administering the website, assessing system performance, improving web services, workforce planning and website security and management. YMCA BC does not collect or use this information in identifiable form, and YMCA BC does not attempt to identify individual users from this data.

Third Party Sites

Visitors should be aware that the YMCA BC website may include links to websites operated by other agencies, organizations and businesses. When visitors link to such third party sites, this Policy will not apply. YMCA BC is not responsible for the privacy practices or content of external third party websites.

Payment Security

YMCA BC does not directly collect or store credit card or financial account numbers. Payment processing is handled by approved third-party payment processors that maintain Payment Card Industry Data Security Standard (PCI DSS) compliance. When individuals make payments through YMCA BC’s digital platforms, they are directed to or interact with the processor’s secure environment. Use of third-party payment services is governed by the processor’s own terms and privacy policy.

Cookies and Tracking Technologies

Like many websites, YMCA BC uses cookies and similar technologies on its website and digital platforms. Cookies are small data files stored on a user’s device that help recognize returning visitors, maintain session information and analyze traffic patterns. The types of cookies YMCA BC may use include:

• Essential cookies: required for core platform functionality, including login sessions and access to member portals. These cannot be disabled.
• Analytics cookies: used to understand how visitors interact with YMCA BC’s platforms, which pages are visited most frequently and where users encounter difficulties.
• Functional cookies: used to remember user preferences, such as language settings and accessibility options.
• Marketing cookies: used on the public website to measure the effectiveness of outreach campaigns. These are only placed with consent.

Users may adjust their browser settings to decline non-essential cookies. Declining cookies may affect the functionality of some features on YMCA BC’s platforms. You can find more detailed information about cookies, how they work and how you can modify your computer's settings to block or filter cookies at aboutcookies.org/. A full cookie notice, including a table of cookies by name, category, purpose and duration, is available at ymca.bc.ca/privacy-policy.

YMCA BC also uses Google Analytics, a web analytics service provided by Google Inc. (Google). The information collected by Google Analytics is used by Google on YMCA BC’s behalf for evaluating the use of the YMCA BC website and to provide YMCA BC with reports on the website activity and usage. Individuals can block or delete these cookies by changing their browser setting. To learn how Google uses data obtained from sites and apps see: www.google.com/policies/privacy/partners/.

Third-Party Analytics and Advertising

YMCA BC may use third-party analytics tools, including Google Analytics, to analyze platform usage. These providers may collect information about users’ online activity through cookies and similar technologies. Users may opt out of Google Analytics data collection using the Google Analytics opt-out browser add-on. YMCA BC does not sell visitor or member data to advertisers and does not permit advertisers to target YMCA BC platform users based on their platform activity.

YMCA at Home

YMCA at Home is YMCA BC’s free virtual wellness platform, providing the public with access to live and on-demand fitness content. This platform includes the Y@HOME+ paid membership, which provides access to exclusive workouts, monthly fitness challenges and healthy eating meal plans to help members reach their goals. In addition to standard account and usage data, YMCA at Home may collect fitness preferences and activity history to personalize content recommendations. Members may review and update their YMCA at Home data through their account settings or by contacting the Privacy Officer.

LEARN

LEARN is YMCA BC’s online learning platform, used for Staff training, volunteer orientation and participant programming. LEARN collects course completion records, assessment results and engagement data for the purpose of managing training compliance and supporting Staff development. This data is handled in accordance with YMCA BC's data classification framework and is accessible only to authorized staff.

12. How and When YMCA BC Shares Personal Information

YMCA BC shares Personal Information internally only on a need-to-know basis, limited to what is necessary to fulfill applicable job duties. For example, YMCA BC may share Personal Information externally with:

• Service Providers performing specialized functions on YMCA BC’s behalf (see Section 13)
• professional advisors including legal counsel, auditors, accountants and insurers
• employment, government and taxing authorities
• law enforcement officials as required or permitted by law
• government funders where required by the terms of a funding agreement; and
• the YMCA BC Foundation for gift administration, solicitation and program communications.

13. Service Providers and Third Parties

YMCA BC conducts due diligence on all Service Providers and third parties who will be collecting, processing, storing, or using Personal Information on YMCA BC’s behalf. Some of these Service Providers or third parties may be located outside of Canada or an individual’s home province and may, from other jurisdictions, collect, use, disclose, store, process or access Personal Information. YMCA BC takes steps to require Service Providers and third parties to keep Personal Information confidential and expects Service Providers and third parties to protect Personal Information in a manner that is consistent with this Policy, applicable privacy legislation and the YMCA’s security practices.
‍

14. Government-Funded Programs

Where YMCA BC administers programs funded by municipal, provincial or federal government bodies, including but not limited to employment services, newcomer programs and licensed child care, Personal Information collected in connection with those programs may be subject to additional obligations such as:

• FOIPPA-compatible data handling where required by the funding body or by law;
• mandatory reporting of participant data to funders in accordance with program agreements or as authorized or required by law; and
• express written consent requirements where mandated by contract or law.

YMCA BC will ensure that participants in government-funded programs are clearly informed of these obligations at the time their Personal Information is collected.

15. Cross-Border Transfers

Some YMCA BC Service Providers process or store Personal Information outside of Canada, including in the United States. This means that sometimes Personal Information may be subject to the laws of jurisdictions outside of Canada or outside of an individual's home province, some of which may permit access by foreign courts, governments or law enforcement. Where this occurs, YMCA BC will take steps to ensure appropriate contractual protections are in place.

16. Artificial Intelligence

YMCA BC is committed to the safe and ethical use of AI. AI tools are used only in accordance with applicable privacy legislation, with meaningful human oversight, and never to make automated decisions about employment, program eligibility, child care placements, or participant assessments. All AI-generated outputs are reviewed by a human before use. More details about YMCA BC's AI use are set out in the YMCA BC AI Policy.

17. Protection of Personal Information

YMCA BC implements security safeguards calibrated to the classification level of the information:

• Physical: locked facilities and filing systems, restricted access areas
• Organizational: role-based access control (RBAC), least-privilege access, mandatory privacy training for all Staff, and security clearances where required
• Technological: passwords, multi-factor authentication, firewalls, encryption in transit and at rest, regular backups and audit logging for Restricted Data
• Contractual: taking reasonable steps to ensure that a comparable level of protection is implemented by Service Providers used by the YMCA BC; and
• Investigatory: investigation of non-compliance with this Policy and applicable legislation where there are reasonable grounds to believe a breach or unauthorized activity has occurred.

Staff who fail to protect Personal Information or who engage in unauthorized collection, access, use, modification or disclosure of Personal Information may be subject to discipline up to and including termination.

18. Technology Use

YMCA BC may make available to Staff, for work purposes, information technology resources including data systems, network facilities, business applications, computers, mobile devices, email platforms, electronic storage media, telephone systems and supporting infrastructure (collectively, IT Resources).

While YMCA BC does not engage in ongoing or continuous monitoring of Staff use of IT Resources, monitoring may occur for legitimate purposes including troubleshooting, network security, system maintenance and policy compliance. IT Resources and all information stored within them may be accessed by YMCA BC to:

• asess, protect and preserve the integrity, security or functionality of IT Resources
• evaluate Staff performance or customer service
• manage Staff transitions following departure, termination or leave
• investigate incidents or alleged misconduct
• measure resource allocation and optimize technical management; and
• ensure compliance with applicable laws, this Policy and other YMCA BC policies.

Staff should not expect absolute privacy when using YMCA BC’s IT Resources. Any monitoring will be conducted in accordance with PIPA and other applicable legislation.

19. Privacy Breaches

YMCA BC treats any privacy breach as a serious matter. Response is coordinated across IT, Data and Analytics and the Privacy Officer in the following sequence:

1. Detection and Reporting: Any Staff member who becomes aware of an actual or suspected breach must immediately notify their manager and YMCA BC's IT department. Staff must not attempt to investigate or contain a breach independently. Suspected breaches include lost or stolen devices, unauthorized system access, misdirected communications containing Personal Information, and any situation where Personal Information may have been accessed, used or disclosed without authorization.
2. Initial Assessment and Triage (IT and Data and Analytics): IT and Data and Analytics will contain the breach and conduct an initial assessment to determine its nature, cause, the categories and volume of Personal Information involved, the data classification level, and whether the breach is ongoing. Based on this assessment, IT will assign a severity tier.
   Where the breach is physical or verbal in nature and has no digital component, the Privacy Officer will lead the initial assessment directly, with People Services involved where Staff conduct is implicated. The tier determination and all subsequent steps remain the same regardless of breach type.
   
   Tier 1 (Minor):The breach is self-contained, the information involved is not Restricted Data, the number of individuals affected is small, and a significant risk of harm can be reasonably ruled out. Examples include a misdirected internal email containing non-sensitive information, or a lost device that has been remotely wiped with no evidence of access. IT and Data and Analytics may manage Tier 1 incidents without escalating to the Privacy Officer, but must log all incidents in the breach record.
   Tier 2 (Significant): The breach involves Restricted Data, a Minor’s Personal Information, a large number of individuals, a Service Provider, or a suspected criminal act, or significant risk of harm cannot be ruled out. All Tier 2 breaches escalate immediately to Step 3.
   
   Where the breach is physical or verbal in nature and has no digital component, the Privacy Officer will lead the initial assessment directly, with People Services involved where Staff conduct is implicated. The tier determination and all subsequent steps remain the same regardless of breach type.

1. Risk Assessment and Escalation: For Tier 2 breaches, IT and Data and Analytics will brief the Privacy Officer on their findings. Together they will assess whether the breach creates a significant risk of harm to individuals. Where the breach is of sufficient severity, the Privacy Officer will escalate to the CEO.
2. Record Keeping: YMCA BC will maintain a secured record of all breach incidents regardless of severity, including a description of the breach, data affected, response taken, notification decisions and remediation steps. Records will be retained in accordance with applicable legislative requirements, including a minimum of 24 months for PIPEDA-reportable breaches.
3. Notification: The Privacy Officer is responsible for determining and fulfilling all notification obligations under applicable legislation and contracts, including notification to affected individuals and privacy regulators as required under applicable law, and to relevant Service Providers or funders where required by contract. Where applicable, the Privacy Officer will prepare all notifications, ensure they are delivered within required timeframes, and retain copies of all correspondence.
4. Remediation and Post-Incident Review (Tier 2 only): For Tier 2 breaches, IT and Data and Analytics will implement remediation measures to address the root cause and prevent recurrence. Within a reasonable period of time after resolution, the Privacy Officer, IT Governance Lead and relevant Data Lead will conduct a post-incident review and report findings to the YMCA BC’s Data Governance Council.

20. Accuracy and Correction of Personal Information

YMCA BC makes reasonable efforts to ensure that Personal Information is accurate, complete and current as required for the purposes for which it was collected, consistent with PIPA and other applicable legislation. Individuals are expected to inform YMCA BC of updates to their Personal Information as soon as reasonably possible.

Individuals may challenge the accuracy or completeness of their Personal Information by contacting the Privacy Officer. If YMCA BC is satisfied that a correction is warranted, the information will be amended. If not, the record will be annotated to note that a correction was requested but not made.

21. Retention

YMCA BC retains Personal Information for a duration reasonably required for operational, administrative, legal, regulatory or statutory purposes. Personal Information used to make a decision about an individual will be retained for at least one year after the decision was made, as required under PIPA. Other retention obligations may apply under PIPEDA, FOIPPA or applicable contractual requirements. Staff are expected to adhere to the YMCA BC’s established retention schedules. Once Personal Information is no longer required, it will be securely destroyed, erased or de-identified.

22. Right of Access

Staff, Donors and Clients have the right to request access to their Personal Information held by YMCA BC, in accordance with PIPA, and, where applicable, PIPEDA. This right is subject to certain legal restrictions, including where:

• information is subject to legal priviledge
• disclosure would reveal the Personal Information of a third party; or
• records contain YMCA BC’s confidential commercial information.

Access requests should be directed in writing to the Privacy Officer. YMCA BC will verify the individual's identity before providing access and will respond in a manner consistent with applicable legislation.

23. Accountability

YMCA BC is responsible for the Personal Information under its control. The designated Privacy Officer is accountable for YMCA BC's compliance with this Policy and with all applicable privacy legislation. The designated Privacy Officer may be contacted at:

Future revisions will be recorded in this table at the time of approval. The current version of this Policy is always the version published on YMCA BC's public website.

Privacy Officer
#10 - 620 Royal Avenue,
New Westminster, BC V3M 1J2
Email: privacy@bc.ymca.ca

24. Openness

This Policy is maintained under version control. The table below records all versions, a brief description of material changes, and the approving authority.

This Policy is publicly available on YMCA BC’s website. Staff, Clients and Donors with questions about YMCA BC’s privacy practices may contact the Privacy Officer.

25. Challenging Compliance

YMCA BC will investigate and respond to all complaints or inquiries relating to its compliance with PIPA or this Policy. Complaints must be submitted in writing to the Privacy Officer, who will make efforts to investigate and respond within the timeframe required under PIPA.

Individuals who are not satisfied with the Privacy Officer’s response may file a complaint with the Office of the Information and Privacy Commissioner for British Columbia:

Office of the Information and Privacy Commissioner for British Columbia
PO Box 9038, Stn. Prov. Govt.,
Victoria, BC V8W 9A4
Phone: (250) 387-5629 | Fax: (250) 387-1696
Email: info@oipc.bc.cahttps://www.oipc.bc.ca/for-the-public/how-do-i-make-a-complaint

26. Changes to this Policy

YMCA BC reserves the right to make changes to this Policy at any time. The current version will be published on YMCA BC’s public website and posted in the internal policy repository. The effective date and version number will be updated with each revision. Staff, Clients and Donors are encouraged to review this Policy periodically.

27. Version Control

This Policy is maintained under version control. The table below records all versions, a brief description of material changes, and the approving authority.

Future revisions will be recorded in this table at the time of approval. The current version of this Policy is always the version published on YMCA BC's public website.