Privacy Policy

Introduction

Birthday Wonders (“we,” “us,” “our,” or the “Organization”) is committed to protecting the privacy and personal information of all individuals we interact with, particularly the vulnerable children and families we serve.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in compliance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”), Ontario’s privacy legislation, and other applicable Canadian privacy laws.

Our Privacy Commitment

We are especially committed to protecting the privacy of:

  • Housing-insecure children and youth living in shelters
  • Parents, guardians, and family members of children we serve
  • Shelter staff and employees who work with our organization
  • Volunteers, donors, and supporters

We will never publicly identify or disclose the identity of children, families, or shelter locations we work with without explicit written consent.

Scope of This Policy

This Privacy Policy applies to:

  • Personal information collected through our Website
  • Information collected during in-person interactions and events
  • Information collected through donations, volunteer applications, and other forms
  • Information shared by partner shelters and organizations

Definitions

“Personal Information” means information about an identifiable individual, including name, address, email address, phone number, date of birth, photographs, financial information, and any other identifying information.

“Sensitive Personal Information” includes information about children, housing status, shelter locations, health information, and any information that could identify vulnerable individuals or compromise their safety.

What Personal Information We Collect

  1. Information About Children and Families We Serve

    We collect minimal personal information about children and families, including:

    • First names only (never full names in public-facing materials)
    • Age and/or birth month (for birthday planning purposes)
    • General preferences and interests (for party planning)
    • Shelter affiliation and information (kept strictly confidential)
    • Consent forms and permissions from legal guardians
    • Photographs or recordings (only with explicit written consent)

    We do NOT collect or publicly share:

    • Full names of children or family members
    • Immigration status, health information, or housing history
    • Any information that could identify or locate children or families
  2. Information About Donors
    • Name, address, email, and phone number
    • Donation amount and payment information
    • Communication preferences Tax receipt information
  3. Information About Volunteers
    • Name, address, email, and phone number
    • Volunteer interests and availability
    • Acceptable use and privacy contract
    • Emergency contact information
    • Records of volunteer activities and hours
  4. Information About Website Visitors
    • IP addresses and device information
    • Browser type and operating system
    • Pages visited and time spent on our Website
    • Referral sources
    • Cookies and similar tracking technologies (see Section 13)
  5. Information About Shelter Partners
    • Contact information for shelter staff liaisons
    • Shelter capacity and service information (non-identifying)
    • Communication records and partnership agreements

How We Collect Personal Information

We collect personal information through:

  • Our Website (contact forms, donation forms, newsletter signups)
  • Volunteer applications and registration forms
  • Direct communications (email, phone, mail)
  • Partnership agreements with shelter organizations
  • Birthday request application forms signed by legal guardians
  • In-person interactions at events and birthday parties
  • Third-party payment processors for donations

How We Use Personal Information

  1. Primary Purposes

    We use personal information for the following purposes:

    For Children and Families:

    • Planning and delivering birthday party experiences
    • Ensuring safety and appropriateness of activities
    • Communicating with shelters about upcoming events
    • Creating anonymized success stories and impact reports

    For Donors:

    • Processing donations and issuing tax receipts
    • Acknowledging and thanking donors
    • Providing updates about our programs and impact
    • Complying with Canada Revenue Agency requirements

    For Volunteers:

    • Screening and recruiting volunteers
    • Coordinating volunteer activities and schedules
    • Ensuring child safety through background checks
    • Recognizing and appreciating volunteer contributions

    For Website Visitors:

    • Improving Website functionality and user experience
    • Analyzing Website traffic and usage patterns
    • Providing requested information or services

    For Organizational Purposes:

    • Complying with legal and regulatory requirements
    • Maintaining records for charitable status
    • Program evaluation and improvement
    • Fundraising and awareness campaigns

  2. Secondary Purposes

    We may use anonymized, aggregated data for:

    • Research and statistical analysis
    • Grant applications and reporting to funders
    • Public communications about our impact (e.g., “We served 150 children this year”)

    We will never use personal information for marketing purposes beyond what donors and supporters have consented to.

Consent

  1. When We Obtain Consent

    We obtain consent before or at the time we collect personal information. Consent may be express (written or verbal) or implied (by your actions, such as providing information voluntarily).

  2. Express Consent Required For
    • Collecting information about children and families who benefit from the programme
    • Using photographs or images of children who benefit from the programme (stock photos may be used)
    • Sharing information with third parties (beyond necessary service providers)
    • Using information for purposes beyond what was originally stated
  3. Withdrawing Consent

    You may withdraw your consent at any time by contacting us at privacy@birthdaywonders.ca. However, withdrawing consent may limit our ability to provide certain services or fulfill certain purposes (e.g., we cannot issue a tax receipt if you withdraw consent to use your donation information).

  4. Special Protections for Children

    We obtain consent from parents or legal guardians before:

    • Collecting any personal information about children
    • Photographing or recording children
    • Using any images or stories about children
    • Sharing any information about children with third parties

    We anonymize all public-facing information about children to protect their identities.

How We Protect Personal Information

  1. Security Measures

    We implement appropriate physical, technical, and administrative safeguards to protect personal information from unauthorized access, disclosure, copying, use, or modification. These measures include:

    Physical Security:

    • Locked filing cabinets for physical records
    • Restricted access to offices and storage areas
    • Secure disposal of documents containing personal information (shredding)

    Technical Security when using third-party cloud storage providers such as Google Drive, Dropbox, or Microsoft OneDrive, we rely on their enterprise-grade security measures, which include:

    • Encrypted data transmission using SSL/TLS protocols
    • AES-256 encryption for data stored on their servers
    • Multi-factor authentication requirements for staff access
    • Regular security updates and monitoring by the service provider
    • Access controls limiting which staff members can view specific files

    Administrative Security:

    • Mandatory background checks for anyone working with children
    • Confidentiality agreements for staff, volunteers, and partners
    • Clear policies and procedures for handling personal information
    • Limited access to personal information on a need-to-know basis
  2. Special Protections for Vulnerable Populations

    For children, families, and shelter-related information, we implement enhanced protections:

    • No public disclosure of shelter locations or identifying information
    • Strict protocols for photography and media use
    • Immediate breach notification procedures (i.e. notification to this group within 24 hours of us becoming aware of the breach)
  3. Third-Party Service Providers

    We carefully vet all third-party service providers who may have access to personal information and require them to:

    • Sign confidentiality agreements, when appropriate
    • Implement appropriate security measures
    • Use information only for specified purposes
    • Comply with Canadian privacy laws

How We Disclose Personal Information

  1. Limited Disclosure

    We do not sell, rent, or trade personal information. We only disclose personal information in the following limited circumstances:

    With Consent:

    • When you have provided explicit consent to share your information

    Service Providers:

    • Payment processors for donation processing
    • Website hosting and IT service providers
    • Email and communication platforms
    • Background check providers for volunteer screening

    Partner Shelters:

    • We share minimal information with shelter staff to coordinate birthday parties
    • We never disclose to shelters the identity of specific donors or volunteers without consent

    Legal Requirements:

    • When required by law, court order, or legal process
    • To protect the rights, property, or safety of our organization, children, or others
    • To comply with Canada Revenue Agency requirements for charitable receipts

    Emergency Situations:

    • If we believe disclosure is necessary to prevent harm to a child or individual

  2. Cross-Border Transfers

    We store and process all personal information within our website server that is located in India. In order to best protect information transferred outside of Canada we consider the following:

    • When using certain third-party services (e.g., cloud hosting) that may store data in secure facilities outside Canada
    • With your explicit consent
    • When required by law

    If we use service providers outside Canada, we ensure they provide comparable privacy protection through contractual agreements.

Retention of Personal Information

  1. Retention Periods

    We retain personal information only as long as necessary to fulfill the purposes for which it was collected and to comply with legal requirements. Records are reviewed at least annually to determine whether they continue to be required for operational or legal purposes.

  2. Secure Destruction

    When personal information is no longer needed, we securely destroy it by:

    • Shredding physical documents
    • Permanently deleting electronic files
    • Wiping or physically destroying storage media

Your Privacy Rights

  1. Access to Your Information

    You have the right to request access to the personal information we hold about you. To make a request:

    1. Contact us in writing at privacy@birthdaywonders.ca
    2. Provide sufficient information to identify yourself
    3. Specify what information you wish to access

    We will respond within 30 days and provide the requested information, subject to limited exceptions under PIPEDA.

  2. Correction of Information

    If you believe personal information that we hold about you is inaccurate or incomplete, you may request that we correct it. We will make the requested corrections or note your disagreement if we decline to make changes.

  3. Withdrawal of Consent

    You may withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Contact us to withdraw consent.

  4. Complaints

    If you have concerns about our privacy practices, you may:

    1. Contact us via email at privacy@birthdaywonders.ca
    2. We will investigate and respond to your complaint within 30 days
    3. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada

Cookies and Tracking Technologies

  1. What Are Cookies

    Cookies are small text files placed on your device when you visit our Website. We use cookies to improve your experience and analyze Website usage.

  2. Types of Cookies We Use

    • Essential Cookies: Required for Website functionality (e.g., secure donation processing)
    • Analytics Cookies: Help us understand how visitors use our Website (e.g., Google Analytics)
    • Preference Cookies: Remember your settings and preferences

  3. Managing Cookies

    You can control cookies through your browser settings. However, disabling cookies may affect Website functionality. We do not use cookies to collect personal information without consent.

  4. Do Not Track

    Our Website does not respond to “Do Not Track” browser signals, but we do not track individuals across third-party websites.

Children's Privacy

  1. No Direct Collection from Children

    We do not knowingly collect personal information directly from children under 18 without parental or guardian consent. All information about children we serve is collected through:

    • Legal guardians
    • Shelter staff acting with guardian authorization
    • Consent forms signed by guardians

  2. Protection Measures

    We take extra care to protect children’s privacy by:

    • Never publicly identifying children by full name
    • Not disclosing shelter locations or identifying details
    • Anonymizing all stories and testimonials
    • Obtaining explicit photo/media consent for each use
    • Training all staff and volunteers on child privacy protection

Photography and Media

  1. Consent for Photography

    We only photograph or record children with explicit written consent from their legal guardian. Consent forms specify:

    • What will be photographed/recorded
    • How images will be used (e.g., website, social media, print materials)
    • Duration of consent

  2. Right to Revoke

    Guardians may revoke consent for use of images at any time. We will remove images from future materials but cannot recall materials already distributed.

    Anonymization Practices

  3. When sharing impact stories without individual photo consent, we:

    • Use stock photos or illustrations
    • Blur or obscure faces in group photos
    • Change names and identifying details
    • Aggregate information (e.g., “children aged 5-7” rather than “Sarah, age 6”)

Third-Party Websites and Services

Our Website may contain links to third-party websites (e.g., social media platforms, donation processors). We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies before providing personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on our Website with a new “Last Updated” date. Material changes will be communicated through:

  • Prominent notice on our Website
  • Email notification to donors and volunteers
  • Notice to partner shelters

Continued use of our Website or services after changes are posted constitutes acceptance of the updated Privacy Policy.

Contact Us

  1. Contact Email

    For questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

    Birthday Wonders

    Email: privacy@birthdaywonders.ca

  2. Office of the Privacy Commissioner

    If you are not satisfied with our response to your privacy concern, you may contact:

    Office of the Privacy Commissioner of Canada

    30 Victoria Street

    Gatineau, Quebec K1A 1H3

    Toll-free: 1-800-282-1376

    Website: www.priv.gc.ca

Acknowledgment

By using our Website or services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy and our Terms of Use.