Privacy and Cookie Policy

Introduction

Kawartha Youth Orchestra, its subsidiaries, and its affiliates (“Kawartha Youth Orchestra”, “KYO”, “we”, “us”, “our”) respect your privacy and are committed to protecting your personal data. This Privacy & Cookie Policy (also referred to as Privacy Policy) describes our data collection and processing activities, including:

what personal data we may collect when you interact with us through our various channels online (such as our website at https://kawarthayouthorchestra.org, https://thekyo.ca, https://upbeat.com and via our apps and social networks) and offline (such as over the telephone, via text, messaging application, in meetings or at events) and what we may do with that personal data;
how we may collect and process information through the use of cookies and related tracking technologies on our online channels; and
your data protection rights, including (where applicable) a right to object to processing and a right to withdraw your consent to processing, and how to exercise them.

When we refer to “personal data” in this Privacy Policy we are referring to any information that falls under the definition of “personal data” in the Personal Information Protection and Electronic Documents Act.

It is important that you read this Privacy & Cookie Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This Privacy & Cookie Policy supplements the other notices and is not intended to override them.

1. Important Information and Who We Are

Kawartha Youth Orchestra is responsible for the processing of your personal data as described in this Privacy Policy. For the purposes of the Personal Information Protection and Electronic Documents Act, in respect of our core service offerings, Kawartha Youth Orchestra acts as the controller, business, and personal information processor, respectively, of such personal data.

The contact details of Kawartha Youth Orchestra’s Data Protection Officer are provided in Section 11 below.

1.1. Updates to this privacy & cookie policy

This Privacy & Cookie Policy may be updated periodically. We will update the date at the top of this Privacy & Cookie Policy accordingly and encourage you to check for changes to this Privacy & Cookie Policy, which will be available on our website. On some occasions, we may also actively advise you of specific data handling activities or significant changes to this Privacy & Cookie Policy, as required by applicable law.

1.2 Third-party links

Our website(s) may include links to or functionality from third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

1.3 Kawartha Youth Orchestra as Data Processor

From time to time, we may process personal data in the role of a processor or, for the purposes of the Personal Information Protection and Electronic Documents Act, a service provider, on behalf of our clients, including where we facilitate the provision of specific output submitted by or derived from our consultants or clients’ engagements with our contractors or consultants, in each case at our clients’ sole request. In these specific circumstances, our clients act as the controller, and each has in place separate privacy and data security practices, which will also apply. Porter’s Management Group will, however, support our clients as necessary to respond to any requests you have in respect of the processing of your personal data. If you require any further information about our clients’ data processing activities, please get in touch using the details in Section 11.

Please note that if you participate in a survey facilitated by Kawartha Youth Orchestra, this survey may either be programmed by Kawartha Youth Orchestra on behalf of our client or programmed by a third party directly on behalf of our client. This Privacy Policy will apply to the processing of your survey responses, where Kawartha Youth Orchestra is the programmer of the survey. Where Kawartha Youth Orchestra does not programme the survey, Kawartha Youth Orchestra will not collect, store, or otherwise process your survey results, and the third party survey programmer and/or our client will have in place separate privacy and data security practices that will apply.

2. What personal data do we collect and how?

“Personal data” means any personally identifiable information belonging to an identifiable natural person, including but not limited to an identifier such as a name, an identification number, location data, an online identifier, or factors specific to the physical, economic, cultural, or social identity of that natural person, and for the avoidance of doubt, includes the term “personal data” as defined in the Personal Information Protection and Electronic Documents Act.

2.1 Categories of Personal Data Collected

We may collect, create, use, store and otherwise process different categories of personal data depending on how you use and interact with our products, services and online channels. We have grouped these categories below as follows:

Identifier Data, including first name, maiden name, last name, job title, and company name.
Contact Data, including your address(es), email address(es), and telephone number(s).
Profile Data, including your CV, professional background, professional headshot, languages spoken, location and country of residence, relevant qualifications, career history and moves, and any additional information, which may include special category personal data and sensitive personal information to the extent it is manifestly made public by you or you voluntarily choose to provide it to Kawartha Youth Orchestra in connection with a particular project or service offering. See Section 4 below for the additional measures we have put in place when processing these special categories of personal data.
Due Diligence Data, including data you make publicly available (e.g., via social media and networking platforms) where required to meet specific anti money laundering, counter terrorism financing, anti-bribery legislation, or other regulatory requirements, or where needed to research, filter, and verify the experience and qualifications of board members, volunteers, employees, consultants, or contractors, or to screen for potential conflicts of interest.
Identity Data, including a copy of your governmental ID and a photo of your face that contains facial scan or “biometric” data. For more information on whether this applies to you, see Section 4.
Financial data, (if we need to pay you), including bank account details.
Payment Data, (if you engage with Kawartha Youth Orchestra as a client, participant, or donor), including your card details and other information to process your payments, including your payment history and billing address.
Transaction Data, including interactions you may have had with us (e.g., parties entering and exiting our conference bridge, duration and time of interactions), and any expert/client feedback.
Marketing and Communications Data, including your preferences for receiving marketing from us and your communication preferences.
Technical Data, including internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website(s) and online services.
Usage Data, including information about how you use our website, social media pages, apps, products, and services, including the URL clickstream to, through, and from our online channels (including date and time), products you viewed or searched for, the content that you view or interact with, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs or acceptance of our Terms of Engagement), and methods used to browse away from the page.

2.2 Circumstances When we May Collect Your Personal Data

We may collect such categories of personal data either directly from you or from third parties and publicly available sources. The table below sets out which categories of personal data are collected in which circumstances. From time to time, we may ask you to confirm the accuracy of the personal data we process about you.

Circumstance	Categories of Personal Data
(i) Where you interact with us directly:
If you are employed by a client of Kawartha Youth Orchestra and your information has been shared with us for the purposes of you using our products and services.	Identifier Data and Contact Data
If you use and interact with our products, services, and online channels, including our website.	Technical Data and Usage Data
If you communicate with us by post, phone, email, surveys, or otherwise.	Identifier Data, Contact Data, Profile Data, Transaction Data and Marketing and Communications Data
If you voluntarily submit certain information to us, for example, during a call with our employees, by filling out a survey, or by uploading information to our platform or one of our approved third party providers.	Information you have provided as part of that request including Identifier Data, Contact Data, Profile Data, Identity Data and Financial Data.
If you sign up for an event or webinar.	Identifier Data, Contact Data and Profile Data
If you request to be paid by Kawartha Youth Orchestra or receive other monetary or non-monetary compensation from Kawartha Youth Orchestra.	Contact Data and Financial Data
If you express an interest in obtaining additional information about our products, services, or employment opportunities, or otherwise use our “Contact Us” page or similar features,.	Identifier Data, Contact Data, Profile Data and Marketing and Communications Data
If you are a supplier, contractor, or service provider to Kawartha Youth Orchestra (or work for a supplier or service provider).	Identifier Data, Contact Data and Financial Data
If you engage with our services as an individual business user in your capacity as a representative of your employer.	Identifier Data, Contact Data, Payment Data, Technical Data and Usage Data
If you engage with our services as a business or as the management or owner of a business.	Identifier Data, Contact Data, Payment Data, Technical Data and Usage Data
(ii) Where we collect information about you from other sources:
If we identify you as a potentially relevant consultants or contractors for a specific client project.	Identifier Data, Contact Data, Profile Data and Due Diligence Data
If we need to conduct any vetting or verification processes in order to contract with you.	Due Diligence Data
If you interact with our products and services.	Technical Data from analytics, technology and hosting providers

2.3 Aggregating Your Personal Data

We aggregate your Usage Data with the information of other website visitors, experts and clients, creating a dataset of information about the usage of our online channels, our apps, products and services, and other general, grouped information about our user base. It provides a valuable insight into the use of our services and we may share it with select third parties. This dataset is aggregated and anonymized, meaning it cannot directly identify you as an individual and is not considered personal data.

2.4 When am I Required to Provide Personal Data?

We may have a legal obligation to collect and process your personal data, or we may require your personal data in order to provide you with specific products and services, including accessing our platform.

If you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you, and/or the quality of the products and services we provide to you might be affected. In these circumstances, we may cancel a service you receive from us or stop proceeding with a contract we are trying to enter into with you, but we will notify you if this is the case at the time.

Please note that this does not apply to the collection of biometric data provided by contractors or consultants in applicable jurisdictions for identity verification purposes. The provision of biometric data is voluntary and will not, in any way, impact our payment obligations to you. However, we may be unable to engage you in any further engagements with Kawartha Youth Orchestra without first completing our identity check.

3. Why we process your personal data and the lawful bases on which we rely

In accordance with the Personal Information Protection and Electronic Documents Act S.C. 2000, c. 5, we rely on a number of lawful bases to process your personal data. Where we rely on legitimate interests and it is legally permissible to do so, we have carried out a balancing test to ensure:

The processing is lawful, proportionate and conducted in accordance with the terms of this Privacy Policy;
We have a legitimate business need to perform the processing;
There is no material likelihood of any adverse impact on your interests, fundamental rights, or freedoms as a result of the processing.

You can obtain information on any of our balancing tests by contacting us using the details in Section 11 below.

We may collect and process your personal data for the following purposes and, where legally permissible, rely on the following lawful bases:

Where we need to perform a contract we are about to enter into or have entered into with you. This includes:
1. Performing our contract with you for the provision of our products and services and sending you service-related communications;
2. Facilitating services or service contracts in respect to which you have agreed to participate or facilitating the creation of other output;
3. Managing our client and user accounts, such as billing, subscription management, providing client support and client relationship management;
4. Determining compensation for Kawartha Youth Orchestra employees, contractors, or other personnel, such as commission, by processing your Transaction Data;
5. Managing payments to the extent the processing of Financial Data is necessary to compensate our experts or pay our suppliers;
Where it is necessary for our legitimate interests and we have assessed that your interests, rights, and freedoms do not override those interests:
1. It is necessary for our legitimate interest in facilitating appropriate and legally compliant engagements between experts and our clients to process your personal data in order to:
  1. research, filter, verify and monitor experts and screen for potential conflicts of interest in order to assess and recommend an expert’s appropriateness for a particular client engagement and to meet applicable legal, regulatory and compliance requirements, including conducting proportionate searches relating to bankruptcy, political affiliation and criminal convictions;
  2. conduct identity verification and other fraud detection activities.
2. It is necessary for our legitimate interest in providing online and offline content, including improving the user experience for our clients, prospective clients, contractors, and other interested parties, to process your personal data in order to:
  1. monitor, maintain, develop and improve the performance of our sites, products and services and customer relationships;
  2. analyse trends, usage and activities in connection with our products and services, optimize our marketing efforts, measure the effectiveness of our advertising campaigns and grow and inform our marketing strategy;
  3. manage our own internal functions, such as keeping our sites secure, (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data), management and corporate reporting, internal research and analytics, and improving business efficacies;
  4. create aggregate and statistical data (which cannot be used to identify you). For example, aggregate data may include data that describes the general demographics, usage, or other characteristics of our site’s users.
3. It is necessary for our legitimate interest in complying with all legal, regulatory, and compliance requirements to process your personal data in order to:
  1. enforce compliance with our policies and procedures;
  2. manage and provide all necessary assistance in respect of any legal claims or other compliance, regulatory, auditing, investigatory, or disciplinary purposes (including disclosure of such information in connection with legal process or litigation).
4. When you have expressly consented to us processing your personal data. This includes, where required under applicable law:
  1. where you ask us to send marketing information via certain mediums, including by email. For more information about how to modify your preferences about marketing communications, please see Section 10.1;
  2. where we record phone calls between clients and experts at the request of clients for compliance purposes;
  3. where we place non-essential cookies or similar technologies on your device;
  4. where, on other occasions, we ask for your consent for the purpose we explain at the time.
  5. Where consent is relied on, you have the right to withdraw it at any time by contacting us. See Section 11 for our contact details.
5. Where we need to comply with a legal or regulatory obligation. This includes:
  1. in response to requests by government or law enforcement authorities conducting an investigation;
  2. to comply with applicable reporting or other legal obligations.

Your personal data may be combined with the different sources identified in Section 2 for the purposes outlined above. We do not conduct any automated decision-making using your personal data.

4. Personal Information and Personally Identifiable Data

In certain situations, we may need to process, or ask third parties to process on our behalf, your special category personal data. Special category personal data means information that can reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data (if used to uniquely identify that person), and information concerning a person’s health, sex life, or sexual orientation. We will also rely on your prior, explicit consent to process:

Profile Data that you voluntarily share with us that falls within the definition of special category personal data, including personal data revealing your racial or ethnic origin and data concerning your health or sexual orientation, for the purposes of facilitating specific projects that fall within that scope;

any facial scan data that is processed by an approved third party on our behalf to verify your identity.

Your consent is entirely voluntary and failure to provide consent will not prevent us from fulfilling our contractual obligations to you.

5. Cookies and Related Technologies

We may be required to share your personal data with the third parties listed below for the purposes described in Section 3 above or otherwise with your consent:

Affiliates: Kawartha Youth Orchestra is a not for profit, charitable business based in Ontario, Canada. The personal data collected by us in accordance with this Privacy & Cookie Policy may be used and shared amongst our group companies (acting on behalf of Kawartha Youth Orchestra) to support the effective functioning of Kawartha Youth Orchestra business and the provision of its products and services.
Service Providers: When we employ a third-party to perform a function on our behalf, for example, to provide software and services that support the operation and delivery of Kawartha Youth Orchestra;s business and its products and services, we provide it with the personal data that it needs to perform its specific function. These companies are contractually authorised to use your personal data only as necessary to provide these products or services to us. We may use service providers for various purposes, including:
1. delivering our products and services;
2. IT, hosting and data security;
3. payments, billing and support services, including the facilitation of compensation (both monetary and non-monetary) to experts;
4. business development, marketing and communications.

We may also share personal data where necessary with our accountants, auditors, lawyers, and other outside professional advisors at Kawartha Youth Orchestra or in furtherance of legitimate business purposes for Kawartha Youth Orchestra, subject to binding contractual obligations of confidentiality.

Clients: We may share Identifier Data, Contact Data, Due Diligence Data, Profile Data and Transaction Data relating to experts with our clients in connection with a particular project as further described in our Compliance Due Diligence Packs, Access Terms and Terms of Engagement.
Experts: We may share Identifier Data relating to our clients with our experts in connection with a particular project as further described in our Compliance Due Diligence Packs and Access Terms.
Legal Requirements: We disclose personal data to government authorities, regulators or other third-parties if required to do so by law or in the good faith belief that such action is necessary to:
1. comply with a subpoena, court order or similar legal obligation;
2. protect and defend our rights or property;
3. act in urgent circumstances to protect the personal safety of users of any website or the public; (d) protect against legal liability;
4. investigate fraud or other unlawful activity; or
5. as otherwise required or permitted by law.
Business Transfers: As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganisation, dissolution, or similar event, including bankruptcy, your personal data may be part of the transferred assets. You will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your personal data, as well as any choices you may have regarding your personal data.
Artificial Intelligence ‘AI’ Technology Partners: Kawartha Youth Orchestra may utilise AI technology to provide you with certain services, including the integration of GPT models into our platform to enhance user experience and functionality. Should you decide to use such technologies, any personal data provided by you (including, but not limited to, search queries) will be shared with the underlying third party AI provider for the purposes of performing its specific function and will be processed in accordance with its terms.

6. Who do we Share Your Personal Data With?

We may be required to share your personal data with the third parties listed below for the purposes described in Section 3 above or otherwise with your consent:

Affiliates: Kawartha Youth Orchestra is a business with global operations, based in Canada. The personal data collected by us in accordance with this Privacy & Cookie Policy may be used and shared amongst our group companies (acting on behalf of Kawartha Youth Orchestra) to support the effective functioning of Kawartha Youth Orchestra’s business and the provision of its products and services.
Service Providers: When we employ a third-party to perform a function on our behalf, for example, to provide software and services that support the operation and delivery of Kawartha Youth Orchestra’s business and its products and services, we provide it with the personal data that it needs to perform its specific function. These companies are contractually authorised to use your personal data only as necessary to provide these products or services to us. We may use service providers for various purposes, including:
1. delivering our products and services;
2. IT, hosting and data security;
3. payments, billing and support services, including the facilitation of compensation (both monetary and non-monetary) to experts;
4. business development, marketing and communications.

Clients: We may share Identifier Data, Contact Data, Due Diligence Data, Profile Data and Transaction Data relating to our consultants with our clients in connection with a particular project as further described in our Compliance Due Diligence Packs, Access Terms and Terms of Engagement.
Contractors and Consultants: We may share Identifier Data relating to our clients with our experts in connection with a particular project, as further described in our Compliance Due Diligence Packs and Access Terms.
Legal Requirements: We disclose personal data to government authorities, regulators, or other third parties if required to do so by law or in the good faith belief that such action is necessary to:
1. comply with a subpoena, court order or similar legal obligation;
2. protect and defend our rights or property;
3. act in urgent circumstances to protect the personal safety of users of any website or the public;
4. protect against legal liability;
5. investigate fraud or other unlawful activity; or
6. as otherwise required or permitted by law.
Business Transfers: As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganisation, dissolution, or similar event, including bankruptcy, your personal data may be part of the transferred assets. You will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your personal data, as well as any choices you may have regarding your personal data.
Artificial Intelligence ‘AI’ Technology Partners: Kawartha Youth Orchestra may utilise AI technology to provide you with certain services, including the integration of GPT models into our platform to enhance user experience and functionality. Should you decide to use such technologies, any personal data provided by you (including, but not limited to, search queries) will be shared with the underlying third party AI provider for the purposes of performing its specific function and will be processed in accordance with its terms.

7. International Transfers of Personal Data

Your personal data may be transferred to and stored by Kawartha Youth Orchestra online using Google infrastructure. Kawartha Youth Orchestra does not control the location of where data is physically stored on Google infrastructure. For information on Google data centre locations, please see https://www.google.com/about/datacenters/locations/. Your personal data may also be used and accessed by members of our group, including those across Canada, the USA, and transferred to the third parties disclosed in Section 6 above who are internationally based. Accordingly, your personal data may be processed outside of your country or jurisdiction.

If we transfer your personal data outside of your country or jurisdiction (within our Group or to third parties), we ensure that the recipient of your personal data has appropriate safeguards in place to protect your personal data.

8. Data Security

We have put in place appropriate organisational, technical and physical security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They should only process your personal data on our instructions and are subject to a duty of confidentiality. We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our website; any transmission is at your own risk. You are also responsible for protecting your password, limiting access to your devices, and signing out of our online channels after your sessions.

9. How Long will You Use my Personal Data For?

We will only retain your personal data for as long as we believe necessary to fulfil the purposes we collected it for (see Section 3 above), including for the purposes of satisfying any legal, accounting, reporting, or audit requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available by contacting us using the details in Section 11 below. Any Identity Data processed on Kawartha Youth Orchestra’s behalf by our third party provider for the purposes of identity verification checks or other legitimate business purposes, will be automatically deleted no later than 50 days after the completion of the legitimate business purpose.

10. Your Rights Relating to Your Personal Data

10.1 Your Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These include the right:

To request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
To request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, although we may need to verify the accuracy of the new data you provide to us.
To request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
To object to processing of your personal data. This is where we are relying on a legitimate interest to process your personal data, and there is something about your particular situation that makes you want to object to that processing. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data that override your objection.
To opt out of direct marketing. You have an absolute right to opt out of direct marketing or profiling we carry out for direct marketing at any time. You can do this by following the instructions in the communication or by contacting us using the details in Section 11 below. Please note that opting out of marketing communications does not opt you out of receiving important business communications related to your current relationship with us, such as communications about your account.
To request restrictions on processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
1. if you want us to establish the data’s accuracy;
2. where our use of the data is unlawful but you do not want us to erase it;
3. where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or
4. you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
To request the transfer of your personal data to you or to a third party. We will provide you, or a third party you have chosen, with your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to electronically held information that you originally provided to Kawartha Youth Orchestra.
To withdraw consent. This occurs at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

All these rights may be limited by exemptions under applicable data privacy laws. We will inform you of any relevant exemptions we rely upon when responding to any request you make.

10.2 How to Exercise Your Rights

To exercise your rights, please contact us using the information in Section 11 below. Your personal data may be processed in order for us to respond to your request.

10.3 No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we can refuse to comply with your request in these circumstances.

10.4 What we May Need From You

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to someone who doesn’t have the right to receive it. We may also contact you to ask you for further information in relation to your request and speed up our response.

10.5 Time Limit to Respond

We try to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

11. How do You Contact us with Privacy or Personal Data Requests?

We hope we can satisfy any queries you may have about the way we process your personal data. If you have any concerns or would like to exercise any of your rights, contact our Data Protection Officer by email at dpo@thekyo.ca.

We are committed to working with you to obtain a fair resolution of any complaint or concern about your privacy.