Associated Hebrew Schools Privacy Policy

1. Purpose and Scope

This Privacy Policy explains how Associated Hebrew Schools (“Associated,” “we,” “us,” or “our”) collects, uses, discloses, protects, retains, and disposes of personal information through our public website, databases, forms, school administration, fundraising and development activities, and other school operations. It applies to personal information stored in Associated’s databases and systems and accessed by Associated staff.

Associated is committed to protecting the privacy, confidentiality, and security of personal information belonging to students, parents and guardians, alumni, donors, employees, volunteers, applicants, and website visitors.

Associated is committed to handling personal information in a manner consistent with the principles of the Personal Information Protection and Electronic Documents Act (PIPEDA). Because Associated is an independent school, the specific privacy and regulatory requirements that apply may vary with the activity involved; where PIPEDA or other applicable federal or provincial requirements apply to a given activity, Associated follows them. PIPEDA is referenced in this Policy where it applies to Associated’s activities.

2. What Is Personal Information?

For purposes of this Policy, personal information means information about an identifiable individual, subject to applicable legal definitions and exceptions. It may include names, home and email addresses, telephone numbers, dates of birth, student and family information, financial or donation information, photographs, identification numbers, communications, and information about an individual’s interactions with Associated.

3. Collection and Use of Personal Information

Associated serves children, and much of the personal information it handles concerns students who are minors. Associated treats student personal information as sensitive and applies heightened care in how such information is collected, used, disclosed, retained, and safeguarded. Where consent is required in respect of a student, Associated obtains it from a parent, guardian, or other authorized representative.

Associated collects personal information only for identified, reasonable, and legitimate educational, administrative, operational, safety, fundraising, and community purposes, including to:

• Manage student applications, enrollment, academic records, educational programs, and school services.
• Communicate with current and prospective parents and guardians regarding school operations, schedules, events, emergency information, and other school matters.
• Process tuition, school fees, donations, payments, and administrative requests.
• Maintain appropriate records concerning students, families, alumni, employees, volunteers, and donors.
• Plan, administer, and communicate about school events, community activities, fundraising, and development initiatives, subject to applicable consent and marketing requirements.
• Meet legal, regulatory, insurance, accounting, audit, safety, and other legitimate obligations.
• Operate, secure, and improve Associated’s website, systems, and digital services.

Associated uses personal information for the purpose for which it was collected, or for a purpose that a reasonable person would consider consistent with that purpose. Associated will limit collection to information that is reasonably necessary for the identified purpose. Where required by law, Associated will obtain meaningful consent before collecting, using, or disclosing personal information.

4. Email, Fundraising, and Marketing Communications

Emails submitted to Associated are used to respond to inquiries and address administrative, educational, operational, fundraising, or community matters for which the communication is reasonably related to the individual’s relationship with Associated.

Promotional or commercial electronic messages will be sent in accordance with applicable law, including Canada’s Anti-Spam Legislation (CASL), where applicable. Where express consent is required, Associated will obtain it before sending such messages and will provide the required unsubscribe mechanism.

Associated does not rent or sell personal information. Associated will not disclose or trade personal information for another organization’s marketing purposes without appropriate consent or other legal authority.

5. Consent and Withdrawal of Consent

Where consent is the legal basis for a collection, use, or disclosure, Associated will seek consent in a manner appropriate to the circumstances and will identify the purposes for which the information will be used or disclosed.

Individuals may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent does not affect processing that has already occurred or processing that Associated is otherwise authorized or required to undertake by law.

For students or other individuals who may not be able to provide legally effective consent themselves, Associated will obtain consent from an authorized parent, guardian, or other authorized representative where required.

6. Disclosure and Third-Party Sharing

Personal information is accessible within Associated only to authorized personnel and service providers who require it for legitimate school purposes and who are subject to appropriate confidentiality and privacy obligations.

Associated does not disclose personal information outside the school except with appropriate consent or where disclosure is required or permitted by law.

Staff Handling of Contact Information

Associated staff may not share students’ or parents’ email addresses — whether individually or as a group or distribution list — with anyone outside the Associated domain, or for any purpose beyond authorized school communications, without express permission and consent.

Parents Association and Community Sharing

Associated will not provide family contact lists or similar personal information to the Parents Association, other families, or community groups for social purposes — such as Bar or Bat Mitzvah invitations — unless the affected parent or guardian has provided prior, specific, informed consent, where consent is required.

Consent should identify the information to be shared, the recipient or category of recipients, and the purpose of the disclosure. Parents may also consult the current Associated parent manual for further information about the limited circumstances in which personal information may be shared.

Third-Party Service Providers

Associated uses third-party providers to support school administration, communications, information technology, payments, donations, and other services. These include, without limitation, cloud productivity and email platforms (such as Google Workspace) and payment and fundraising platforms (such as Veracross).

Associated takes reasonable steps to select providers capable of protecting personal information and, where appropriate, uses contractual or other safeguards governing confidentiality, security, permitted uses, retention, and disposal.

Information submitted through a third-party platform may also be subject to that provider’s own privacy terms in addition to this Policy. A current list of third-party platforms is published in the Annual Data Notice (Appendix A).

7. Website Cookies and Analytics

The Associated website may use cookies and similar technologies to support website functionality, security, navigation, and analytics. These technologies may collect technical information such as browser type, operating system, device information, approximate location, pages visited, and IP address.

Associated will use such information for identified purposes and will not use cookies or analytics to create an identifiable personal profile except where permitted by law and as appropriately disclosed.

Cookies are generally stored on a visitor’s device or browser, rather than on Associated’s servers. Retention periods vary by cookie or technology and by purpose. Where practical, Associated will provide information about the categories and purposes of cookies used on its website.

Visitors can manage or disable cookies through browser settings, although some website functions may be affected.

8. Data Security and Safeguards

Associated protects personal information using physical, organizational, and technological safeguards appropriate to the sensitivity of the information and the risks involved. Safeguards may include access controls, authentication, encryption where appropriate, secure systems, restricted-access databases, staff privacy training, confidentiality obligations, monitoring, backups, and secure disposal procedures.

Associated maintains the following technical safeguards to protect personal data:

• Google Workspace for Education with an Ontario-compliant data processing agreement.
• Monthly automated OAuth token audit across all staff and student accounts.
• Two-factor authentication required for all staff accounts.
• Automated removal of external sharing links and public Drive permissions.
• Suspended account ownership transfer to secure archive accounts.
• Regular review of third-party app authorizations.

No method of transmission or storage can be guaranteed to be completely secure. Associated will maintain reasonable safeguards and respond to suspected privacy incidents in accordance with its internal incident-response procedures and applicable law.

9. Privacy Breaches

If Associated experiences a privacy breach or unauthorized access, use, disclosure, loss, or destruction of personal information, Associated will assess the incident, take reasonable steps to contain and remediate it, and document the incident as appropriate.

Where applicable law requires notification, Associated will notify affected individuals, regulators, law enforcement, or other parties within the required timeframe and in the manner required by law.

Where PIPEDA applies, Associated will report a breach of security safeguards to the Office of the Privacy Commissioner of Canada when it determines that the breach creates a real risk of significant harm, and will notify affected individuals as required.

Where PIPEDA applies, Associated will also maintain a record of every breach of security safeguards, retain those records for at least 24 months, and provide them to the Office of the Privacy Commissioner of Canada on request.

10. Retention and Disposal

Associated retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, to meet legal, regulatory, accounting, educational, insurance, tax, or other legitimate requirements, or to establish, exercise, or defend legal claims.

Retention periods may differ by record type. Associated will maintain appropriate retention schedules and will securely destroy, delete, or anonymize personal information when it is no longer required, subject to applicable legal holds or other obligations.

11. Video Surveillance and Security Cameras

AHS buildings have clear signage indicating that surveillance cameras are in use. This signage is in place to inform the community of the purpose of the surveillance. Anyone in the community is free to contact the school for more information.

School administrators and designated personnel are permitted to review footage when there is a legitimate need, such as investigating an incident involving a student. Parents do not need to be notified prior to this review.

Unused footage is typically deleted over time. If footage is accessed or disclosed (for example, for an investigation), it must be retained for at least one year, unless the school has a shorter policy in place.

12. Access, Correction, and Privacy Inquiries

Subject to applicable law and reasonable limitations, individuals may request access to personal information held by Associated and may request correction of information that is inaccurate or incomplete.

Updates to student or family contact information may be submitted directly to School Office staff through Associated’s established administrative process.

Formal access requests, correction requests, privacy inquiries, complaints, or concerns about Associated’s handling of personal information should be directed to the Privacy Officer.

Where PIPEDA applies and an individual is not satisfied with Associated’s response to a privacy concern, the individual may also contact the Office of the Privacy Commissioner of Canada.

13. Privacy Officer

Questions, requests, and complaints regarding this Policy may be directed to:

14. Policy Review

Associated will review this Privacy Policy periodically and update it when necessary to reflect changes in its practices, technology, services, or applicable legal requirements.

The current version will be made available through the Associated website or other appropriate school communication channels.