At CAHSMUN, we are committed to providing you with an exceptional conference experience. As providing this service may involve the collection, use, and disclosure of some personal information, protecting your information is one of our highest priorities.

In British Columbia, the Personal Information Protection Act (PIPA) sets out how non-profit organizations may collect, use, and disclose personal information. We will inform you of why and how we collect, use, and disclose your personal information, obtain your consent where required, and only handle your personal information in a manner that a reasonable person would consider appropriate in the circumstances.

In compliance with PIPA, this Privacy Policy outlines the principles and practices we will follow in protecting your personal information. Our privacy commitment includes ensuring the accuracy, confidentiality, and security of your personal information and allowing you to request access to and/or correct your personal information.

Policy Scope

This Privacy Policy applies to CAHSMUN and the events we operate, including without limitation, CAHSMUN, Horizons, and miniEnterprize. Personal information is information about an identifiable individual, such as your name, gender, and school.

Section 1: Collecting Personal Information

1.1  Unless the purposes for collecting personal information are obvious and you voluntarily provide your personal information for those purposes, we will communicate the purposes for which personal information is being collected, either orally or in writing, before or at the time of collection.

1.2  We will only collect the minimum amount of information that is necessary to register you for a CAHSMUN event, provide necessary services in connection with the CAHSMUN event, and meet regulatory requirements.

Section 2: Consent

2.1  We will obtain your consent to collect, use, or disclose personal information, except where, as noted below, we are authorized to do so without consent.

2.2  Consent can be provided in writing or it can be implied where the purpose for collecting, using, or disclosing the personal information is considered obvious and you voluntarily provide personal information for that purpose.

2.3  Consent may also be implied when you are given notice and a reasonable opportunity to opt out and you do not opt out.

2.4  You can withhold or withdraw your consent for us to use your personal information in certain ways, subject to limited exceptions, including without limitation, if the personal information is necessary to provide the service or the withdrawal of consent would interfere with a legal obligation.

2.5  Your decision to withhold or withdraw your consent to certain uses of personal information may restrict our ability to provide a particular service or product. If so, we will explain the potential impacts to assist you in making the decision.

2.6  As set out in s. 12, 15, and 18 of PIPA, we may collect, use, or disclose personal information without your knowledge or consent in limited circumstances. These circumstances include without limitation:

• When the collection, use or disclosure of personal information is authorized or required by law;

• In an emergency that threatens an individual's life, health, or personal security; or

• To investigate an anticipated breach of an agreement or a contravention of law.

Section 3: Using and Disclosing Personal Information

3.1  We will only use or disclose your personal information where necessary to fulfill the purposes identified at the time of collection or for a purpose reasonably related to those purposes.

3.2  We will not use or disclose your personal information for any additional purpose unless we obtain your consent to do so.

3.3  We will not sell personal information to other parties unless we obtain your consent to do so.

Section 4: Retaining Personal Information

4.1  If we use your personal information to make a decision that directly affects you, we will retain that personal information for at least one year so that you have a reasonable opportunity to request access to it.

4.2  Subject to policy 4.1, we will retain your personal information only as long as necessary to fulfill the identified purposes or a legal or business purpose.

Section 5: Ensuring Accuracy of Personal Information

5.1  We will make reasonable efforts to ensure that your personal information is accurate and complete where it may be used to make a decision about you or disclosed to another organization.

5.2  You may request correction to your personal information in order to ensure its accuracy and completeness. A request to correct personal information must be made in writing and provide sufficient detail to identify the personal information and the correction being sought.

5.3  If the personal information is demonstrated to be inaccurate or incomplete, we will correct the information as required and send the corrected information to any organization to which we disclosed the personal information in the previous year. If the correction is not made, we will note your correction request in our records.

Section 6: Securing Personal Information

6.1  We are committed to ensuring the security of your personal information in order to protect it from unauthorized access, collection, use, disclosure, copying, modification, or disposal or similar risks.

6.2  We will use appropriate security measures to ensure that your personal information is appropriately protected, which includes using individual user IDs, passwords, two-factor authentication, and encryption, restricting access to personal information, and requiring our service providers to provide comparable security measures.

6.3  We will use appropriate security measures when destroying your personal information, such as regularly and securely deleting electronically stored information.

6.4  We will continually review and update our security policies and controls as technology changes to ensure ongoing personal information security.

Section 7: Your Access to Personal Information

7.1  You have a right to access your personal information, subject to limited exceptions defined in s. 23 of PIPA. These exceptions include without limitation:

• The disclosure would reveal personal information about another individual;

• The information was collected without consent for the purposes of an investigation and the investigation has not been completed; or

• The information is protected by solicitor-client privilege

7.2  A request to access personal information must be made in writing and provide sufficient detail to identify the personal information being sought.

7.3  Upon request, we will also tell you how we use your personal information and to whom it has been disclosed if applicable.

7.4  We will make the requested information available within 30 business days or provide written notice of an extension where additional time is required to fulfill the request.

7.5  A nominal administrative fee may be charged for providing access to personal information. Where a fee may apply, we will inform you of the cost and request further direction from you on whether we should proceed with the request.

7.6  If a request is refused in full or in part, we will notify you in writing, providing the reasons for refusal and the recourse available to you.

Section 8: Questions and Complaints

8.1  The Director of Legal Affairs is designated as CAHSMUN’s Privacy Officer responsible for ensuring our compliance with this Policy and our obligations under PIPA.

8.2  If you have any questions with respect to the handling of your personal information or if you wish to request access/correction of your personal information, please contact our Privacy Officer:

Douglas Wong
dwong@cahsmun.org

8.3  If you are dissatisfied with our handling of your personal information, we invite you to contact our Privacy Officer to discuss your concerns. If you remain dissatisfied, you may wish to contact the Office of the Information and Privacy Commissioner.