Approved: January 28, 2026

Our Commitment to Privacy

The Community Foundation for Kingston &Area ("the Foundation") is committed to protecting the privacy of the personal information of its donors, employees, volunteers, and all stakeholders. We value the trust of our stakeholders and recognize that maintaining this trust requires discipline, transparency, and accountability.

The Foundation may gather information through various means, including but not limited to our website, email, telephone, and in-person communication. While the Foundation generally does not engage in commercial activities, it aims to balance an individual's right to protect their personal information with our need to collect, use, or disclose personal information for reasonable organizational purposes. Therefore, the Foundation follows the Fair Information Principles outlined in Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”) as well as the requirements of Canada’s Anti-Spam Legislation (“CASL”).

The Foundation does not sell, trade, or share your personal information. We will only disclose your data with your express consent, to fulfill the specific purpose for which it was provided, or as required by law.

Purposes

The Foundation identifies the purposes for which personal information is being collected before or at the time of collection. The purposes will primarily be limited to those related to the Foundation's programs and activities. In the course of our work, we may collect information for:

• Fund Management: To establish, manage, and administer charitable funds in accordance with donor intentions and legal requirements.
• Grant Administration: To process and evaluate grant applications, verify eligibility, notify applicants of funding decisions, and manage the disbursement of funds and program reporting.
• Gift Processing: To process donations, issue official income tax receipts, and maintain accurate financial records as required by the Canada Revenue Agency (CRA).
• Stewardship & Communication: To inform donors and stakeholders about the impact of gifts, the activities of the Foundation, and future opportunities for support.
• Recognition: To acknowledge donor support in annual reports, or other forms of donor recognition, unless the donor has requested to remain anonymous.
• Legal Compliance: To meet regulatory and legal obligations under Ontario and Canadian law.

Accountability

The Foundation is responsible for personal information under its control, including personal information shared with a third party. Third parties must safeguard information entrusted to them in accordance with this Policy. The Foundation has appointed a designated Privacy Officer (the Executive Director, or their delegate) to support compliance with the privacy practices outlined in this Policy.

Consent

The Foundation strives to obtain meaningful consent for the personal information it collects, as required by PIPEDA and/or CASL accordingly.

Express Consent

The Foundation will strive for ExpressConsent(also known as “explicit consent”) as much as possible, which occurs when someone has given valid verbal or written consent to receive electronic communications. To obtain express consent under CASL the recipient must opt-in, the request must contain information on the purpose for consent, identify the sender (name, address/phone number or email) and notify the member that consent can be withdrawn.

Implied Consent

In some cases, the Foundation may rely on Implied Consent (also known as “implicit consent”). Under CASL, the Foundation has an existing non-business relationship—and thus implied consent— with an individual the moment that individual organization has provided the Foundation with a gift, a donation, or volunteer work. This implied consent is time-limited as follows:

• A donation or gift to a registered charity for a two-year period following the donation or gift.
• Volunteer work performed for a registered charity for a two-year period following termination.

For both express consent and implied consent, a person may withdraw consent of any kind by contacting the Foundation.

Collection

The Foundation limits the collection of personal information to the minimum required forthe purposes identified by the organization.

Use, Disclosure, and Retention

The Foundation will use personal information only for the identified purposes for which it was collected. The Foundation may request consent for new purposes that differ from those initially provided at the time of collection.

Personal information will not be rented or sold to any third party. The Foundation will disclose information to third parties only when there is an agreement that requires the third party to comply with the terms of this Policy. The Foundation will retain personal information for as long as the identified purpose for which the Foundation originally collected it remains in effect or as required by law. The Foundation maintains a separate Document Retention Policy which governs the retention, storage, and privacy of our records.

Accuracy

The Foundation strives to ensure that the personal information it holds is accurate and up to date. Individuals who wish to request corrections to personal information may notify the Foundation in writing.

Protection

The Foundation protects individuals' personal information by implementing reasonable security measures to mitigate risks such as unauthorized access, collection, use, disclosure, or disposal. Security measures have been integrated into day-to-day practices through coordination with the Foundation's IT Services Provider and regular engagement with staff. Access to documents on the central electronic file system is segregated, with access granted only when necessary.

Employees, Board, and Committee members will annually sign a commitment to abide by this and other key policies and procedures.

Openness

The Foundation will make this Policy and its privacy procedures readily available. The Foundation will strive to ensure that the Policy is straightforward and has minimal ambiguity.

Access to Information

Anyone may request confirmation of the existence, use, and disclosure of their personal information and shall be given access to that information. The Foundation encourages individuals to request corrections and updates to their information to ensure accuracy and completeness.

The Foundation's designated Privacy Officer is available to answer questions, handle complaints, and address inquiries related to this Policy or an individual's personal information. For valid complaints, the Foundation will take appropriate steps to correct the issue and ensure compliance with the practices outlined in this Policy.

Contact the Privacy Officer

Address inquiries, complaints, or access requests to:
Privacy Officer,Community Foundation for Kingston &Area
Mail: 100 – 275 Ontario Street, Kingston, ON K7K 2X5
Email: privacy@cfka.org

Appendix A: Questions on Privacy and this Policy

What is Personal Information?

Personal information is any information about an identifiable individual. Types of personal information collected and held by the Foundation may include an individual's name, address, email address, telephone number, and financial information.

Why does the Foundation need to collect personal information?

The Foundation collects, uses, and discloses personal information from stakeholders for various purposes, including to:

• if you are a registered user of a Foundation account, to establish and maintain your Foundation account and to provide the ongoing services that you request
• respond to questions, comments, requests, or complaints that you submit to the Foundation
• process your donations
• provide income tax receipts, where applicable
• process grant applications
• invest and administer Foundation funds
• process your registration for events
• to provide you with the electronic communications you request
• to track communications with you
• to improve your experience of our websites
• to analyze the use of our websites
• to report to the public the names of all the Foundation’s funds where donors have not requested anonymity
• to fulfill a purpose that we disclose to you when we request your personal information; and
• to meet legal and regulatory requirements.

A note on donations to our funds

When donors contribute to a Fund at the Foundation, unless donor anonymity is requested, the Foundation may disclose donation-related information to the Fund Advisor, enabling them to steward gifts and thank donors appropriately. All donors have the right to request anonymity and can do so before confirming their donation online or noting their request for anonymity when mailing or delivering a donation to the office. Fund Advisors agree that personal information received will be used solely to acknowledge donors and steward donations and that it will not be shared or used for any other purpose.

What types of personal information does the Foundation collect?

Examples of information collected:

• To compile valuable data on the performance of our website and other electronic communications, we may collect non-identifying information related to IP Addresses, browsers, and operating systems.
• Information such as an individual's email address, name, or telephone number may be collected through various means, including correspondence, meetings, donations, surveys, or event registrations.
• While the Foundation may collect credit card information to process a transaction, this information is not stored and is securely destroyed once the transaction is completed. For recurring donations, our third-party payment processor securely stores credit card details and makes them inaccessible to the Foundation once entered.
• Information from public sources (e.g., telephone directories, public registers) may be collected unless the individual has explicitly noted their desire not to have their data collected.

How does the Foundation obtain consent?

Depending on the situation and the sensitivity of the information, the Foundation obtains consent through various means. It may be expressed in writing or provided to us verbally or electronically. Examples of consent:

• Electronic: An individual signs up to receive regular updates through the Foundation's website form
• Verbal: An individual agrees to disclose personal information to a representative of the
• Foundation. The purposes of this collection should be identified at the time of collection.
• Written: An individual may sign an agreement that acknowledges the collection, use, and processing of their personal information for identified purposes.

How does the Foundation ensure that it properly collects, uses, and
protects personal information?

The Foundations’Document Retention Policy governs the retention, storage, and privacy of our records.

You can ask us about the Foundation's privacy practices at any time. Upon written request and with reasonable notice, you can access your own personal information, challenge its completeness and accuracy, and seek to have it amended.

You can also challenge our privacy policies and practices with the Foundation's Privacy Officer, who will respond in writing and may take appropriate action, including amending your information or revising our privacy practices. See contact information on Page 3 of this Policy.

Other Websites

Our websites may contain links to other websites or Internet resources. When you click on one of those links, you are contacting another website or Internet resource that may collect information about you voluntarily or through cookies or other technologies. The Foundation has no responsibility or liability for or control over those other websites or Internet resources or their collection, use, and disclosure of your personal information.