Privacy Policy

Approved By Executive Management Team
Last Reviewed: November 14, 2017 (next review to be within two years of this date)

Responsible Role: Director, Communications, Marketing & Quality (Chief Privacy Officer)
Responsible Department: Marketing

SECTION 1 – INTRODUCTION
1.1   Purpose
To provide an enterprise-wide privacy policy that outlines JVS Toronto’s commitment to comply with privacy legislation to ensure the protection of personal and confidential information for its employees, clients, and any individual who provides personal and confidential information, unless the personal information is collected, used or disclosed through the JVS Toronto website. This personal information is dealt with in the JVS Toronto Web Site Privacy Statement.

1.2   Scope
The policy applies to all JVS Toronto employees, volunteers including Board and Board Committee members, placement students, contractors or consultants, and anyone working at or acting on behalf of JVS Toronto, and who are privy to personal information.

1.3  Definitions
Chief Privacy Officer
A member of the JVS Toronto senior management team who is appointed with the responsibility for managing the risks and business impacts of privacy laws and policies.

Client Records or Files
All data, information, documentation and reports prepared by JVS Toronto relating to the service of individual clients, whether stored in hard copy or electronically. Client Records contain personal information.

Confidentiality
The obligation of all JVS Toronto employees, or those acting on behalf of JVS Toronto, to keep personal information secret. Confidentiality arises in the course of a relationship in which private information is shared. As the sharing of personal information is essential for accurate assessment, diagnosis, provision of services and/or treatment of JVS Toronto clients, this ethical duty of confidentiality is imposed upon JVS Toronto to ensure that client information obtained in the course of providing services is kept secure and confidential.

Confidential Information
Refers to any information of a sensitive matter that should remain confidential.

Disclosure
When personal or confidential information is shared.

Information Security
The protection of information against threats to its integrity or against inadvertent disclosure. Information System Security Protecting both the information contained in a client information System, as well as the system itself from threats and disruption. Individuals working for or acting on behalf of JVS Toronto This includes every individual working or volunteering at JVS Toronto including, but not limited to, employees, managers, directors, senior management, casual and contract workers, volunteers, students, consultants, Board members, and third party service providers.

Personal Information
Section 2(1) of the Personal Information Protection and Electronic Documents Act (2000, c. 5) (PIPEDA) states that “personal information” means “information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.” For example, personal information may include performance reviews, doctor’s notes, home address and a record of their sick days.

Personnel
This refers to anyone working on behalf of JVS Toronto including fulltime, part-time, casual and other employees, volunteers including Board and Board Committee members, placement students, contractors or consultants. Personnel Records or Files All data, information, documentation and reports prepared by JVS Toronto relating to JVS Toronto personnel, whether stored in hard copy or electronically. Personnel records contain personal information.

Privacy
The right of the individual to control the collection, use and disclosure of information about the individual, limiting it to “that which is necessary”. Privacy includes having the right to determine what information is collected, how it is used, and the ability to access collected information to review its security and accuracy. Privacy means having the right to choose the conditions and extent to which one’s information is shared.

Privacy Breach
An inappropriate access, use or disclosure of personal information; including, without limitation: (1) unauthorized collection: collected coercively or without consent or for purposes not approved by JVS Toronto or the individual; (2) unauthorized use: used for purposes not supported by JVS Toronto (3) unauthorized disclosure: disclosure without consent or legal authority, security breaches or loss of equipment containing personal information such as laptops or loss of paper records or unauthorized or unsecured disposal of personal information (e.g. in a dumpster); and (4) Denial of client rights: such as collection, use or disclosure without consent, denial of access to personal information. Other breach examples include inappropriate access into client information (snooping), independently accessing one’s own personal information or that of a colleague, members of management or other JVS Toronto employees, family members, friends, acquaintances and people featured in the media.

Security
Preventing unauthorized access to personal information through physical, organizational or technological means. In other words, security is the measures taken to ensure the confidentiality, integrity and availability of personal and confidential information.

1.4.   Related Policies
1.4.1    Privacy Policies
Business & Remote Office Privacy and Security Policy
Client Records Collection & Disclosure Policy
JVS Toronto Personnel Records Collection & Disclosure Policy
Privacy Breaches Policy
Privacy Complaint Resolution Policy
Records Retention & Destruction Policy

1.4.2    Additional Policies
Human Rights and Prevention of Harassment in the Workplace Policy
Internet & Email Policy
Mobile Device Policy
Password Policy
Whistleblower Policy

1.5 Legislative Context
Child and Family Services Act
Ontario’s Health Care Consent Act
Personal Health Information Protection Act, (PHIPA) 2004
Privacy and Personal Information Act (PIPA)
Services and Supports to Promote the Social Inclusion of Persons with Developmental Disabilities Act
Social Work and Social Service Work Act
The Mental Health Act

---

SECTION 2 – POLICY

2.1 Policy
JVS Toronto will comply with the Related Policies listed in Section 1.4 of this policy, and privacy legislation, including professional codes of conduct or ethical guidelines that govern the collection, use, disclosure, storage and destruction of personal and/or confidential information of its clients and employees.

---

NOTE: The following section, 3, “RESPONSIBILITY & PROCEDURE” represents best practices as determined by JVS Toronto, and is largely designed to provide guidance to designated JVS Toronto representatives. However, it is understood that, where appropriate, these representatives may adopt modified procedures in response to any given circumstance.

SECTION 3 – RESPONSIBILITY & PROCEDURE

3.1   Ten Principles of Personal information Protection
The following Ten Principles of Personal Information Protection are representative of international best practices for the collection, use, protection and disclosure of personal and confidential information.  These ten principles are the essential elements of JVS Toronto’s privacy compliance program.

These principles apply to all JVS Toronto sites and programs, and all its employees are responsible to adhere to these principles.  Any additional requirements will be set out in the related policies for the specific privacy topic.

JVS Toronto’s commitment to the stated Principles of Personal Information Protection is provided in italics under each Principle.

3.1.1.    Accountability
The organization is responsible for personal and confidential information under its control and will designate an individual or individuals who are accountable for compliance with the following principles.

JVS Toronto has appointed a Chief Privacy Officer.  The Director, Communications, Marketing & Quality has been assigned as the Chief Privacy Officer.  The role and responsibilities for the Chief Privacy Officer, management, employees and volunteers are detailed in this section of this policy.

JVS Toronto will ensure that third party agreements will be detailed in written contracts or Memorandums of Understanding, and that these will contain privacy protection and protocols consistent with JVS Toronto’s privacy policies regarding any JVS Toronto information that the third party maintains or is privy to.

3.1.2.    Identifying Purposes
The purposes for which personal information is collected will be identified by the employee who is collecting the information at or before the time the information is collected as outlined in the Client Records Collection & Disclosure Policy and the JVS Toronto Personnel Records Collection & Disclosure Policy.

When a new purpose or use for personal information is identified after the initial collection of the personal information, consent from the individual is obtained unless the new purpose is required by law.  Where possible, personal information is coded, or pseudonymous data is used to help ensure privacy of data.

3.1.3.    Informed Consent
The knowledge and consent of the individual is required for the collection, use, or disclosure of personal information, except where inappropriate, following the Client Records Collection & Disclosure Policy and the JVS Toronto Personnel Records Collection & Disclosure Policy.

Consent is obtained at or before the time of collection of personal information.  JVS Toronto employees will be sensitive regarding any issues impacting consent such as a client’s language barrier, developmental challenges or age.

Consent from Parents or Guardians is obtained when clients are limited due to age and/or developmental disability.

Individuals are informed that they may withdraw their consent at any time; however this will impact JVS Toronto’s ability to provide services to the client, who will be advised of this impact.

JVS Toronto does not consent to the collection, use or disclosure of personal information for secondary purposes, such as marketing or solicitation, as a condition of supplying JVS Toronto services.  Individuals are informed that they can withdraw their consent for secondary purposes at any time.

3.1.4.    Limiting Collection
The collection of personal information will be limited to that which is necessary for the purposes identified by JVS Toronto. Information will be collected by fair and lawful means.

JVS Toronto will describe the type of personal information that it is required to collect and how it will be used or disclosed.

3.1.5.    Limiting Use, Disclosure and Retention
Personal information will not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.

The retention periods are outlined in the Records Retention & Destruction Policy.

3.1.6.    Accuracy
Personal information will be as accurate, complete and up-to-date as is necessary for the purpose for which it is used.  Employees will ensure that client personal information such as address, phone number, is kept current while the client is active.

3.1.7.    Safeguards
Personal and confidential information will be protected by security safeguards appropriate to the sensitivity of the information.

JVS  Toronto has implemented safeguards to ensure the privacy and protection of personal and confidential information and these safeguards are fully outlined in the individual privacy policies listed in 1.4.1 Related Privacy Policies.

3.1.8.    Openness
JVS Toronto will make readily available to individuals specific information about its policies and practices relating to the management of personal information.

JVS Toronto will provide the above information to individuals in a format that is understandable to the audience.

3.1.9.    Individual Access
Upon request, an individual will be informed of the existence, use, and disclosure of his or her personal information, and will be given access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

JVS Toronto will authenticate an individual’s identity when a request for access to personal information is received.

3.1.10.    Challenging Compliance
An individual will be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for JVS Toronto’s compliance.

Failure to comply with privacy legislation could result in public complaints, prosecution, litigation, high insurance costs and non-monetary and monetary damage to JVS Toronto’s morale and reputation.

A Privacy Complaint Policy has been developed by JVS Toronto to ensure that any concerns or complaints are addressed in a timely, effective, and sensitive manner.

The Ten Principles of Personal Information Protection have established the basic principles for the protection of personal information and form the basis of most privacy legislation throughout the world, including Canadian privacy legislation.

By building in these ten principles, JVS Toronto’s privacy compliance programs will align with privacy protection legislation in Ontario where JVS Toronto operates.

3.2    JVS Toronto & a Privacy Culture
All employees are to practice a privacy culture which is based on the full, complete and ongoing adherence to privacy principles, and the awareness and sensitivity to the personal and confidential nature of information that is collected, how the information is stored and maintained, and destroyed.  To affirm their commitment to the privacy culture, each employee is required to complete a “JVS Toronto Personnel Privacy & Confidentiality Agreement”.

3.3    JVS Toronto’s Responsibility
Ensure that policies, procedures, and guidelines are developed and are updated according to relevant legislation, regulatory standards, and best practices.  JVS Toronto Executive Management is to approve JVS Toronto’s privacy policies and procedures, disseminate those policies and procedures to ensure their proper and full adherence by employees.

3.3.1    Chief Privacy Officer’s Responsibilities:

1. Act as an expert resource to JVS Toronto on privacy matters.
2. Promote compliance throughout JVS Toronto with privacy policy and all associated privacy policies and procedures.
3. Ensure that JVS Toronto establishes and maintains appropriate privacy and information practices.
4. Act as a consultant and provide advice to sites regarding access requests, privacy-related inquiries and complaints, and investigations by the provincial privacy commissioner; as related to complaints JVS Toronto receives as a provincial or municipal funder service provider.
5. Review and approves final resolutions to any privacy-related complaints, or investigations.
6. Act as an advisor and facilitator to assist JVS Toronto in implementing privacy principles.
7. Establish, manage and monitor privacy policies in JVS Toronto.
8. Ensure that privacy principles are applied in JVS Toronto.
9. Establish requirements and standards for privacy in corporate information systems and business processes.
10. Collaborate with site leadership to ensure that JVS Toronto employees are informed of their legal duties regarding privacy.
11. Investigate and address privacy-related complaints and breaches and recommend improvements; and/or assigns a member of the senior management team to conduct investigations and support the Chief Privacy Officer on any related activities.
12. Promote privacy to internal and external stakeholders, including the provision of privacy training and awareness programs.
13. Review organizational practices to ensure privacy policies are implemented and followed.
14. Investigate privacy breaches and incidents and determine corrective action.
15. Respond as expeditiously as possible to requests from employees for advice, consults or provides permission to take any action under the privacy policies or privacy procedures.
16. Develop and improve privacy procedures including access, correction, inquiry and complaints procedures.
17. Develop and make available a written statement that describes JVS Toronto’s information practices, the Chief Privacy Officer’s contact information and JVS Toronto access, correction, inquiry and complaints procedures.

3.3.2    Director’s Responsibilities

1. Comply with the privacy policies and all associated privacy procedures.
2. Conduct privacy compliance training to employees, and any individuals acting or working on behalf of JVS Toronto.
3. Modify program operations, when required, to ensure compliance with all privacy policies is possible at all times.
4. Provide oversight and support to the Manager with regard to privacy compliance matters at the program level.

3.3.3   Managers’ Responsibilities

1. Comply with the privacy policies and all associated privacy policies and procedures.
2. Work with the Chief Privacy Officer, or designate assigned by the Chief Privacy Officer, to manage the privacy function in their respective locations.
3. Implement privacy training and awareness programs as disseminated by the Chief Privacy Officer.
4. Promote compliance throughout their programs’ operations with the privacy policy and all associated privacy policies and procedures.
5. Assist front line staff to comply with the privacy policies and all associated privacy procedures.
6. Respond to access requests, privacy related inquiries and complaints, and investigations at the site level when requested.
7. Ensure that privacy principles are applied in their respective locations.
8. Assist the Chief Privacy Officer or designate assigned by the Chief Privacy Officer, as requested, to investigate and address privacy-related complaints, breaches and incidents and identify improvement opportunities.
9. Promote privacy practices to clients and service users. Ensure that privacy training is conducted in respective locations.
10. Respond to requests from employees for advice, consults or permission to take any action under the privacy policy and all associated privacy policies and procedures.

3.3.4      Frontline Staff Responsibilities

1. Comply with the privacy policies and all associated privacy policies and procedures.
2. Ensure that clients and co-workers, and other employees they come in contact with are aware of their rights, responsibilities and obligations as outlined in the privacy policies and all associated privacy policy and procedures.
3. Ensure that the privacy rights of co-workers are respected by adhering to JVS Toronto’s privacy policies, principles and practices.

3.3.5    Volunteer’s Responsibilities
Volunteers include members of the Board of Directors, Board committee members and Placement Students.

1. Comply with the privacy policies and all associated privacy procedures.
2. Ensure that clients are aware of their rights, responsibilities and obligations as outlined in the privacy policies and all associated privacy procedures.

3.4    Supporting Documentation
Name: JVS Toronto Personnel Privacy & Confidentiality Agreement
Location: JVS Insider
Document Type: PDF

Name: All privacy policies
Location: JVS Insider, www.jvstoronto.org/privacypolicy/
Document Type: PDF

Name: Website Privacy Statement
Location: JVS Insider, www.jvstoronto.org/privacypolicy/
Document Type: PDF

---

SECTION 4 – GOVERNANCE

4.1   Policy Owner
Director, Communications, Marketing & Quality (Chief Privacy Officer)

4.2   Version Control And Change History
Version Number: 7
Approval Date: n/a
Approved By: n/a
Amendment: This policy was edited on November 14, 2017 to change the position responsible for the Chief Privacy Officer.

Version Number: 6
Approval Date: n/a
Approved By: n/a
Amendment: This policy was reviewed on December 22, 2016 and minor wording changes were made to reflect staffing changes and currently used internal terms.

Version Number: 5
Approval Date: n/a
Approved By: n/a
Amendment: This policy was reviewed and edited on March 20, 2014 during the Imagine Canada accreditation process.

Version Number: 4
Approval Date: n/a
Approved By: n/a
Amendment: This policy was reviewed and edited for wording consistency on June 26, 2013.

Version Number: 3
Approval Date: September 20, 2011
Approved By: EMT
Amendment: This policy has been developed as part of a full agency policy review.

Version Number: 2
Approval Date: April 2011
Approved By:
Amendment:

Version Number: 1
Approval Date: December 2007
Approved By:
Amendment:

---

Download JVS Toronto Enterprise Privacy Policy (pdf)

Download Business and Remote Office Privacy and Security Policy (pdf)

Download Records Retention and Destruction Policy (pdf)

Download Personnel Records Collection and Disclosure Policy (pdf)

Download Client Records Collection and Disclosure Policy (pdf)

Download Privacy Breach Policy (pdf)

Download Privacy Complaint Resolution Policy (pdf)

Approved By President & CEO
Last Reviewed: DRAFT (next review to be within two years of this date)
Statement Owner: Director, Communications, Marketing & Quality

PURPOSE
JVS Toronto is committed to comply with privacy legislation to ensure the protection of personal and confidential information for its employees, clients, and any individual who provides personal and confidential information, including those using its website.

In addition to JVS Toronto’s privacy policies, this privacy statement outlines how Personally Identifiable Information (PII) is used in JVS website, www.jvstoronto.org.

PII is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.

This statement outlines how JVS Toronto collects, uses, protects or otherwise handles your Personally Identifiable Information (PII) in accordance with our website.

Please see JVS Toronto’s privacy policies, located on our website at www.jvstoronto.org/privacy-policy/ for more information on our practices of collecting, using, disclosing and storing of personal information.

---

RESPONSIBILITY & PROCEDURE

Collection and Use of Personal Information
JVS Toronto’s website includes features such as a blog, newsletter, resume clinic and forms.

Personal information is collected only when a website user registers for a newsletter, resume clinic or completes a form. For registration purposes, you may be asked to enter your name, email address, mailing address, phone number or other details.

The information we collect from you when you through a registration feature, such as a newsletter, resume clinic, or form, navigate through the website, or use other site features in the following ways:

• To administer a contest, promotion, survey or other site feature.
• To quickly process your transactions.
• To send periodic emails regarding your order or other products and services.
• To follow up with you after correspondence (live chat, email or phone inquiries)

Protection of Personal Information on Website
Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible using regular Malware Scanning.

Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.

We implement a variety of security measures when a user enters, submits, or accesses their information to maintain the safety of your personal information.

All registration or form submissions are processed through a gateway provider and are not stored or processed on our servers.

Use of Cookies
We do not use cookies for tracking purposes. You can choose to have your computer warn you each time a cookie is being sent. You can also choose to turn off all cookies by changing your browser settings.

By turning off cookies, some of our website features may not function properly during your use of our website.

Disclosing Personal Information to Third-Parties
JVS Toronto does not sell, trade, or otherwise transfer any personal information to outside parties such as your name, address, city, town, or online contact identifier such as email or name of chat account, or phone number.

Information collect using program registration forms include a consent option outlining that personal information is use for the purposes of providing a service. JVS Toronto doesn’t disclose any personal information of individuals who are either registering for or a program or service, or are a register participant in a program or service, to any third-party without obtaining consent.

Please see JVS Toronto’s privacy policies, located on our website at www.jvstoronto.org/privacy-policy/ for more information on our practices of collecting, using, disclosing and storing of personal information.

Links to Third-Party Websites
Occasionally, at our discretion, we may include links to third-party services on our website. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites by submitting an email to services@jvstoronto.org.

Use of Google Products
Google’s advertising practices are outlined in Google’s Advertising Principles. They are put in place to provide a positive experience for users. For more information please visit https://support.google.com/adwordspolicy/answer/1316548?hl=en.

JVS Toronto uses Google AdSense Advertising on our website. Google, a third-party vendor, uses cookies to serve ads on our website site. Google’s use of the Dynamic Advertising Reporting & Targeting (DART) cookie enables Google to serve ads to our website users based on previous visits to our site and other sites on the Internet. Users may opt-out of the use of the DART cookie through the Google Privacy & Terms located at https://www.google.com/policies/technologies/ads/.
JVS Toronto has implemented the following features on its Google AdSense Advertising:

• Demographics and Interests Reporting

We, along with third-party vendors such as Google, use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as DART cookies), or other third-party identifiers together. We use them to compile data regarding user interactions.

Opting Out to Seeing Personalized Ads
Users can opt out of seeing personalized ads when accessing by visiting Google Ads Help at https://support.google.com/ads/answer/2662922?hl=en

Alternatively, you can opt out by visiting the Network Advertising Initiative Opt Out at https://www.networkadvertising.org/understanding-online-advertising/what-are-my-options

Do Not Track signals
JVS Toronto honours Do Not Track signals and Do Not Track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place.

Third-Party Behavioral Tracking
JVS Toronto does not allow third-party behavioral tracking on its website.

Children Online Privacy Protection Act
We do not specifically market to children under the age of 13 years old.

Fair Information Practices
JVS Toronto’s privacy policies and website follow the Fair Information Practices Principles as outlined in the Personal Information Protection and Electronic Documents Act (PIPEDA).

JVS Toronto has a Privacy Breach Policy and Privacy Complaint Policy that would be referenced when dealing with a breach of privacy through our website.

Please see JVS Toronto’s privacy policies, located on our website at www.jvstoronto.org/privacy-policy/ for more information on our practices of collecting, using, disclosing and storing of personal information.

Should a data breach occur, notification to users effected that can be contacted via email will be informed within one (1) business day, and to general users through announcements within one (1) business day.

Anti-Spam Legislation
JVS Toronto follows practices as outlined in the Canadian Anti-Spam Legislation (CASL) on our website. In accordance with CASL, JVS Toronto has:

• Clear opt-in processes for individuals to be contacted by JVS Toronto such as our newsletter subscription, and Resume Clinic and program online registration process.
• Clear opt-out or unsubscribe process for individuals who have subscribed to features such as our newsletter or Resume Clinic using an electronic link.
• Identification of JVS Toronto on all communication including our head office address and telephone number.
• Uses personal information provided through the opt-in process to respond to inquiries and provide additional information such as for services, blog articles and upcoming workshops and events.
• Communication with individuals either upon request through an opt-in process or after an original service transaction has taken place.

JVS Toronto does not use any false or misleading subjects or email addresses in its communications; identifies messages with advertisements in a reasonable way; monitors third-party email marketing services, when used, for compliance; honours opt-out or opt-out requests quickly; and allow users to unsubscribe at any time by using the link at the bottom of each email.

Website Privacy Questions
Any questions about this Website Privacy Statement can be directed to:

Sharon Cardie
Chief Privacy Officer
JVS Toronto
74 Tycos Drive
Toronto, Ontario M6B 1V9
Canada
Email: privacyofficer@jvstoronto.org
Phone: 416-787-1725

---

GOVERNANCE

Policy Owner
Director, Communications, Marketing & Quality.

Version Control and Change History
Version Number: 2
Approval Date: To be added
Approved By: To be added
Amendment: This document was reviewed and substantially edited to provide additional details about JVS Toronto’s Website Privacy practices.

Version Number: 1
Approval Date: March 2015
Approved By: President & CEO
Amendment: