JABC Alumni Data and Communications Privacy Policy
Section A: Privacy notice
- Accountability
JA British Columbia ("JABC", "we", "our") is committed to protecting the personal information of our alumni community. JABC is accountable for all personal information in our custody or under our control, and we comply with the Personal Information Protection Act of British Columbia ("PIPA"), which governs how private sector organizations, including non-profit organizations, collect, use, disclose, and safeguard personal information. Where we communicate electronically with alumni, JABC also complies with applicable Canadian laws governing electronic communications, including Canada's Anti-Spam Legislation (CASL).
"Personal information" means any information about an identifiable individual, such as name, email address, age, program participation history, and communication preferences. It does not include business contact information used to communicate with a person in their professional capacity.
JABC has designated a Privacy Officer who is responsible for our compliance with PIPA, CASL and with this policy. The Privacy Officer's contact information O.Smirnova@jabc.org
- What We Collect and Why
We collect only the personal information reasonably necessary to deliver alumni programs and services, and we limit collection to the minimum required for the purposes identified below.
Personal information we may collect from alumni includes:
- Name, email address, and (optionally) city/region of residence
- Year of birth (used to apply appropriate consent rules and age-appropriate communications)
- JA program(s) attended, participation year(s), school and/or region of participation
- Education and career milestones voluntarily shared by the alum (such as: post-secondary institution, field of work)
- Communication preferences and consent records
- Event registration and attendance information
- Survey and feedback responses, and stories or testimonials voluntarily contributed
We collect this information for the following purposes:
- To register alumni in the JABC alumni network and manage their membership
- To send communications alumni have consented to receive (such as: newsletters, event invitations, volunteer and mentorship opportunities)
- To plan and deliver alumni events and initiatives, including those of the JABC Alumni Association
- To understand and report on the long-term impact of JA programs
- To share alumni stories and testimonials, with the specific consent of the individual, in JABC reporting, partner communications, and marketing
- To share information about opportunities to support JABC's mission, including fundraising and donation opportunities
We identify our purposes at or before the time of collection. If we wish to use personal information for a new purpose not identified at collection, we will notify the individual and obtain fresh consent before doing so. Personal information collected from students for program delivery is not used for alumni outreach or marketing unless the individual has expressly opted in (through a separate, optional consent at the time of program registration or a purpose-specific consent obtained afterward.)
- Consent
With limited exceptions permitted by PIPA, we collect, use, and disclose personal information only with consent. At or before the time of collection, we tell individuals what we are collecting, why, and who to contact with questions.
- Form of consent
Consent may be given orally, in writing, or electronically. Because our alumni community includes youth, we use express (opt-in) consent for all alumni communications. For each individual, we record what they consented to, when, how, and through which form or channel, along with the version of the consent wording they were shown. Any later changes or withdrawals are recorded the same way.
- Youth consent
PIPA does not set a minimum age of consent; a minor who is capable of understanding what they are consenting to may consent on their own behalf. Consistent with guidance received from the Office of the Information and Privacy Commissioner for BC (OIPC), alumni aged 13 and older may provide their own consent, and the same rules that apply to adults apply to them. Our notices and consent language are written in plain, age-appropriate language.
- No over-requiring of consent
We do not require anyone to consent to collection, use, or disclosure of personal information beyond what is necessary to provide the relevant program or service. Providing your personal information will be limited to that necessary to achieve the purposes outlined in Section 2. Consent to marketing and other communications is separate and optional.
- Withdrawing consent
Alumni may withdraw or change their consent at any time, subject to reasonable notice, by using the unsubscribe link in any communication or by contacting the Privacy Officer. We will explain the likely consequences of withdrawal (for example: no longer receiving event invitations) and will act on the request within ten business days. Withdrawal is recorded and honoured across our systems.
- How We Use and Disclose Personal Information
We use and disclose personal information only for the purposes identified at collection, unless the individual consents to a new purpose or the use or disclosure is otherwise permitted or required by law (for example, in response to a court order or subpoena).
We do not sell, rent, or trade alumni personal information.
Where a service provider processes personal information on our behalf (for example, our constituent relationship management system (SF), survey platforms, or email delivery services), we remain accountable for that information. We require our service providers, by contract, to protect personal information they process on our behalf, and to use it only for authorized purposes.
Volunteers, including members of the ACA executive, are treated as employees for the purposes of PIPA. Volunteer access to alumni personal information is subject to the role-based access, training, and confidentiality safeguards described in Section 7 (Safeguards).
Where we send commercial electronic messages to alumni, we do so in accordance with CASL (see Section 1).
- Retention and Destruction
- We retain alumni records only as long as necessary for the purposes described in this policy or as required for legal or business purposes.
- As alumni engagement is an ongoing purpose, we retain alumni records for as long as an individual remains a member of the network. When an alum withdraws, their record is marked as no longer an active member and deactivated for alumni engagement purposes. Their contact information is added to a do-not-contact (DNC) list to ensure their withdrawal is respected. We retain the underlying record unless the individual specifically requests deletion of their personal information, or unless retention is no longer permitted or required for legal or business purposes.
- If an individual requests deletion of their personal information, we will securely delete or anonymize the information, subject to any legal, regulatory, or legitimate business requirements that require us to retain certain information. A minimal suppression record, such as an email address or other identifier, may be retained as necessary to maintain the DNC list and prevent future contact.
- We periodically review inactive records to confirm that the information remains accurate and that continued retention serves the purposes described in this policy.
- Where information is required to be destroyed, destruction is performed securely through permanent deletion of electronic records or shredding of paper records. Anonymized and aggregated data may be retained indefinitely for impact reporting.
- Accuracy and Correction
We make reasonable efforts to ensure the personal information we hold is accurate and complete for the purposes for which it is used. Alumni may request correction of their personal information at any time by contacting the Privacy Officer. If a correction request is reasonable, we will correct the record and, where the information was disclosed to another organization within the previous year, notify that organization of the correction. If we do not make a requested correction, we will annotate the record with the correction that was requested but not made.
- Safeguards
We protect personal information with safeguards appropriate to its sensitivity. Because our community includes youth, we treat alumni personal information as warranting a high standard of care. Our safeguards include:
- Administrative: privacy training for staff and volunteers who handle personal information; confidentiality agreements and privacy onboarding for volunteers (including the ACA executive) before access is granted; role-based, need-to-know access; documented procedures for collection, use, and disclosure; annual review of this policy and our practices.
- Technological: password-protected systems and unique user accounts; role-based permissions within our CRM so users see only the records and fields their role requires; secure transmission of data; multi factor identification systems; cyber security staff training annual requirement; prompt removal of access when a role ends (including at ACA executive turnover).
- Physical: secure storage of any physical records; restricted office access; secure disposal.
- Privacy breach response. Any suspected privacy breach (unauthorized access, collection, use, disclosure, or disposal of personal information) must be reported immediately to the Privacy Officer, who will contain the breach, evaluate the risks, notify affected individuals and the OIPC where appropriate, and document remediation steps to prevent recurrence. Our response follows JABC's documented Privacy Breach Protocol.
- Access to Personal Information
Individuals have a right to access their own personal information in our custody or control, information about how it has been and is being used, and the names of individuals and organizations to whom it has been disclosed.
Access requests should be made in writing to the Privacy Officer, with sufficient detail to locate the records. We will verify the identity of the requester before releasing information.
- We respond within 30 business days of receiving a request.
- If access is refused in whole or in part (for example, where records contain another person's personal information), we will provide written reasons and information about how to ask the OIPC to review the decision.
- Questions, Complaints, and Contact
Questions, concerns, correction requests, access requests, or complaints about JABC's handling of personal information should be directed to our Privacy Officer:
Privacy Officer: Olga Smirnova, VP Finance and Operations , JA British Columbia
Email: [O.Smirnova@jabc.org] | Phone: [604-688-3887] | Mail: #570 475 West Georgia Street, Vancouver BC V6B 4M9
We will investigate all complaints and respond in a timely manner. If a complainant is not satisfied with our response, they may contact the Office of the Information and Privacy Commissioner for British Columbia at 250-387-5629
- Openness and Policy Review
This policy is available on the JABC website and provided on request. The alumni registration form links directly to it.
This policy is incorporated into staff privacy training and into onboarding for Alumni Association executive volunteers.
Related documented procedures that support our obligations under PIPA, including our Privacy Breach Protocol and our records retention and destruction procedures, are available at here or on request from the Privacy Officer.
The Privacy Officer reviews this policy at least annually, and whenever our practices, systems, or applicable law change, to ensure it reflects current practice.
Version history and review dates are recorded below.
Version 1: August 2026
Initial draft prepared for internal review / A Tynan: Impact & Initiatives) Reviewed by Finance & Operations)
Version 2: October 2026
Revised by A Tynan incorporating feedback from OIPC. Reviewed by Finance & Operations.
Reviewed and approved by the OIPC Policy Analyst, Tess Kim, November 2 2026.