Privacy Policy
South Shore Youth Organization
As of: May 2026
1) Who We Are
South Shore Youth Organization (“SSYO”) is a Montréal‑based charity that provides programs in basketball/athletics, education, community outreach, and mental‑health development. Our privacy practices follow Québec’s Act Respecting the Protection of Personal Information in the Private Sector (P‑39.1) and its modernization under Law 25, including obligations related to consent, transparency, security measures, confidentiality incident reporting, and data portability.
2) Consent
SSYO obtains consent that is clear, free, informed, specific, granular, and expressed in plain language, in accordance with Québec’s Law 25 consent requirements. When consent is obtained in writing, it is presented separately from other content. Opt‑in consent is required for sensitive personal information and most secondary uses, such as marketing or promotions.
3) Minors Under 14
In Québec, SSYO must obtain verified parental or guardian consent before collecting personal information from a child under 14 years old, unless the collection is clearly for the direct benefit of the minor (such as urgent health or safety needs). SSYO uses age‑verification steps and parent‑directed communication channels to ensure compliance with this legal requirement.
4) Your Rights
Under Québec’s Private Sector Act and Law 25, individuals have the right to:
- Access their personal information
- Request corrections of inaccurate or incomplete data
- Withdraw consent for ongoing or secondary uses
- Request data portability, allowing computerized personal information to be provided in a structured and commonly used format or transmitted to a third party (in force since September 22, 2024) [blg.com]
SSYO responds to all privacy requests within the statutory timelines established by the Private Sector Act. [legisquebe…gouv.qc.ca]
5) Contact Information
To exercise your privacy rights or ask questions, you may contact:
Email: ssyouthorg@gmail.com
If you are not satisfied with SSYO’s response, you may contact Québec’s regulator, the Commission d’accès à l’information (CAI).
6) Email & Text Communications (CASL)
For any commercial electronic message (CEM)—for example, sponsorship promotions, event ticket sales, or fundraising appeals—SSYO will:
- Obtain prior consent (express or, where permitted, implied).
- Identify the sender and provide valid contact information in each message.
- Include a working unsubscribe in each message and honour requests within 10 business days.
Registered charities may rely on a limited exemption where a message’s primary purpose is to raise funds, but sender identification and unsubscribe still apply. Nonprofits are not blanket‑exempt from CASL.
7) When We Share Information
We do not sell personal information. We may share information with:
- Service providers (e.g., registration/CRM, payment processors, email/SMS, background screening, secure cloud hosting) under written contracts that restrict use to SSYO’s mandate, require confidentiality and deletion/return at the end of the mandate (required by Law 25).
- Program partners for joint initiatives (only with consent or as authorized by law).
- Health/safety or legal recipients where necessary (e.g., emergencies; lawful disclosures).
Cross‑border transfers: Before transferring data outside Québec, we conduct a legal/technical assessment and ensure comparable protection and appropriate safeguards; where PIPEDA applies (e.g., cross‑border commercial activities), its cross‑border principles also guide our practice.
8) How We Protect Information
We implement administrative, technical, and physical safeguards proportionate to sensitivity, purpose, volume/distribution, and medium, as required by Québec law (e.g., access controls, encryption where appropriate, MFA, secure disposal, vendor due diligence, staff/volunteer training). Organizations must take reasonable security measures under Law 25.
9) Confidentiality Incidents (Breaches)
A confidentiality incident includes unauthorized access/use/disclosure, loss, or any breach of protection. If an incident poses a risk of serious injury, we will reduce the risk, prevent recurrence, and promptly notify the CAI (Québec regulator) and affected individuals; we also maintain a breach register as required by regulation.
10) Privacy by Default, PIAs & Automated Decisions
- Privacy by default: We configure services so that only necessary data is collected/used/disclosed by default (Law 25).
- Privacy Impact Assessments (PIAs/EFVP): We conduct PIAs for higher‑risk projects, certain research disclosures without consent, and cross‑border transfers, following the CAI’s guide/template.
- Automated decisions: If a decision is made exclusively through automated processing, we will inform you and explain the decision factors and your rights. (Law 25 imposes transparency obligations.)
11) Retention & Destruction
We retain personal information only as long as necessary for stated purposes and legal/accounting obligations, after which we anonymize (per Law 25) or securely destroy it in accordance with Québec’s Private Sector Act (which addresses destruction or anonymization). [legisquebe…gouv.qc.ca]
12) Your Rights (recap)
As summarized earlier, you may access, correct, withdraw consent, and request data portability of computerized personal information; SSYO responds within statutory timelines (Québec law; portability effective Sept 22, 2024).
13) Donors & Sponsors
We keep donation records as required for acknowledgments and audit; we respect anonymous giving requests. Fundraising or sponsor‑related emails/texts comply with CASL (consent/ID/unsubscribe). [crtc.gc.ca]
14) Accountability & Governance
- Privacy Officer: SSYO designates a Person in Charge of the Protection of Personal Information to oversee compliance (Law 25 requirement, in force since Sept 22, 2022).
- Policies & training: We maintain internal privacy/security policies, staff/volunteer training, vendor management, and audit practices aligned with Québec’s regime.
- Interplay with federal law: Québec’s private‑sector law is recognized as substantially similar to PIPEDA; however, PIPEDA may still apply for cross‑border activities and certain contexts. [laws-lois….tice.gc.ca]
- Enforcement: The CAI can impose administrative penalties up to C$10M or 2% and penal fines up to C$25M or 4% for serious violations; punitive damages may be available.
15) International & Cross‑Provincial Transfers
Before transferring personal information outside Québec, we evaluate sensitivity, purpose, safeguards, and the foreign legal environment, and implement contractual/technical/organizational protections to ensure comparable protection (Law 25). Where applicable, PIPEDA also governs cross‑border handling.[priv.gc.ca]
16) How to Exercise Your Rights
Email: ssyouthorg@gmail.com
If you are unsatisfied with our response, you may contact the Commission d’accès à l’information (CAI).[legisquebe…gouv.qc.ca]
17) Changes to this Policy
We may update this Privacy Policy to reflect changes in practices or law. We will post the revised version with an updated date, and—when changes are material—provide clear notice (e.g., email, website banner, or at point of collection). (Openness/transparency are core fair‑information principles under Canadian privacy law.)
Appendix A — Examples of Typical Program Uses
- Basketball/Athletics: registration, team placement, facility access, injury reporting. (Purpose limitation/minimization under Québec law.) [legisquebe…gouv.qc.ca]
- Education: tutor scheduling, workshop sign‑ins, scholarship eligibility (prefer de‑identified data for evaluation). [legisquebe…gouv.qc.ca]
- Community Outreach: event RSVPs, volunteer matching, neighbourhood engagement preferences. [legisquebe…gouv.qc.ca]
- Mental Health Development: workshop enrollments, referral coordination metadata (clinical records handled by licensed providers under their professional/legal rules).[legisquebe…gouv.qc.ca]