Effective: January 26, 2026
ARTICLE 1 GENERAL
1.1 Definitions – The following terms have these meanings in this Policy:
a) Acts – PIPA – Personal Information Protection Act; PIPEDA – Personal Information Protection and Electronic Documents Act.
b) Employee Personal Information – personal information about an individual that is collected, used, or disclosed solely for the purposes reasonably required to establish, manage, or terminate an employment relationship between the organization and that individual, but does not include personal information that is not about an individual’s employment.
c) Organization – includes an association, a partnership, a person, an unincorporated
association, a trust, a not-for-profit organization, a trade union, and a corporation.
d) Personal Health Information – any health information about an identifiable individual.
e) Personal Information – any information about an identifiable individual.
f) CRC – Calgary Rowing Club.
g) Representatives – Prospective members and all categories of membership defined in the CRC Bylaws, as well as all individuals employed by, or engaged in activities with CRC including, but not limited to, athletes, coaches, coordinators, judges, officials, volunteers, managers, administrators, committee members, and directors and officers.
1.2 Purpose – The purpose of this Policy is to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of Representatives with respect to their personal information and the need of the Calgary Rowing Club (“CRC”) to collect, use or disclose personal information.
1.3 Application –This Policy applies to all Representatives in connection with personal information that is collected, used, or disclosed by CRC.
1.4 Additional Obligations – In addition to fulfilling all requirements of the Acts, CRC will also fulfill the additional requirements of this Policy. CRC and CRC Representatives will not:
a) Disclose personal information without free prior and informed consent.
b) Knowingly place itself in a position where they are under obligation to any organization to disclose personal information.
c) Share personal information to family members, friends, colleagues, or to organizations outside official duties.
d) Derive personal benefit from personal information that they have acquired during the
course of fulfilling their duties with CRC, and
e) Accept any gift or favor that could be construed as being given in anticipation of, or in recognition for, the disclosure of personal information.
1.5 Interpretation – Except as provided in the Act, the Board of Directors of CRC will have the
authority to interpret any provision of this Policy that is contradictory, ambiguous, or unclear.
ARTICLE 2 ACCOUNTABILITY
2.1 Privacy Officer – The Privacy Officer is responsible for the implementation of this Policy,
monitoring information collection and data security,and handling personal information access requests and complaints.
The Privacy Officer is identified as the Club Manager, and may be contacted at the following address:
office@calgaryrowing.com
(403) 249-2880
2.2 Duties – The Privacy Officer will:
a) Implement procedures to protect personal information
b) Establish procedures for complaints and inquiries
c) Maintain records of individuals with access to personal information.
d) Ensure any third-party providers abide by this policy
e) Provide ongoing privacy training for staff and volunteers.
f) promptly forward any complaints to the CRC President and Secretary (moved from 2.1)
ARTICLE 3 IDENTIFYING PURPOSES
3.1 Purpose – CRC collects personal information for purposes that include, but are not limited to:
Communications
a) Sending communications in the form of e-news or a newsletter with content related to CRC programs, events, fundraising, activities, discipline, appeals, and other information.
b) Publishing articles, postings on CRC website, displays or posters, and social media
c) Award nominations, biographies, and media relations
d) Communication within and between Representatives
Registration and Monitoring
e) Registration of programs, events, and activities
f) Database entry at the Coaching Association of Canada and to determine level of coaching certification, coaching qualifications, and coach selection
g) Checking residency status
h) Determination of eligibility, age group and appropriate level of play/competition
i) Athlete registration, outfitting, and various components of athlete and team selection
j) Technical monitoring, officials training, educational purposes, sport promotion, and media publications
k) Discipline results and long-term suspension list
l) Database entry at the Alberta Rowing Association to determine membership levels for funding
Sales and Promotions
m) Purchasing equipment
n) Promotion and sale of merchandise
General
o) Travel arrangement and administration
p) Implementation of CRC screening program (a pre-employment coach intake form)
q) Medical emergency, emergency contacts or reports relating to medical or emergency issues
r) Determination of membership demographics and program wants and needs
s) Managing insurance claims and insurance investigations
t) Payroll, honorariums, company insurance
Photography and Video
u) Video recording and photography for personal use by spectators,
v) parents, and friends
w) Video recording and photography for promotional use, marketing and advertising by CRC (with consent) Digital Practices (see Article 9)
x) Website analytics
y) Cookies
z) Social media integrations
ARTICLE 4 CONSENT
4.1 Implied Consent – By providing Personal Information to CRC, Representatives and prospective Representatives are implying their consent to the use of that Personal Information for the purposes identified in Article 3 of this Policy.
4.2 Consent for disclosure (subject to sections 4.7, 4.8 & 4.9) – At the time of the collection of Personal Information and prior to the use or disclosure of the Personal Information, CRC will
obtain explicit consent from Representatives.
4.3 CRC may collect, use, or disclose information without consent where permitted by law (e.g., awards, public events, legal requirements).
4.4 Representatives may consent to the collection and specified use of Personal Information in the following ways:
a) Completing and/or signing a membership application form
b) Checking a check box, or selecting an option (such as ‘Yes’ or ‘I agree’)
c) Providing written consent either physically or electronically
d) Consenting orally in person
e) Consenting orally over the phone
4.5 Requirement – CRC will not, as a condition of a product or service, require Representatives to consent to the collection, use or disclosure of Personal Information beyond that required to fulfill the specified purpose.
4.6 Withdrawal – A Representative may withdraw consent in writing, at any time, subject to legal
or contractual restrictions. CRC will inform the Representative of the implications of
withdrawing consent (ie, limited participation in some programs).
4.7 Legal Guardians – Consent may not be obtained from Representatives who are minors,
seriously ill, or mentally incapacitated and therefore will be obtained from a parent, legal
guardian or person having power of attorney.
4.8 Deemed Consent – A Representative is deemed to consent to the collection, use, disclosure of personal information for the purpose of his or her enrollment and coverage under an
insurance or similar plan if they are beneficiary or has an interest as an
insured under the plan.
4.9 Exception for Collection, Use or Disclosure – CRC may collect, use, or disclose personal
information, without consent, for specified purposes if:
a) CRC provides the Representative with notice that it intends to collect, use, or disclose the Representative’s personal information for specified purposes.
b) CRC gives the Representative a reasonable opportunity to decline the collection, use or
disclosure of their personal information and the Representative does not decline.
c) The personal information is collected by observation at a performance, sports meet or
similar event at which the Representative voluntarily appears and that is open to the public.
d) The collection is necessary to determine the Representative’s suitability to receive an
honor, award or to be selected for an athletic or artistic purpose.
e) The information is collected from or on behalf of another organization without consent of the Representative to whom the information relates if:
i. The Representative consented to the use of the personal information by the
other organization, and
ii. The personal information is used by CRC solely for the purposes for which the
Information was previously collected and assists that organization to carry out
work on behalf of the other organization.
f) If otherwise required by law.
4.10 Employee Information Exception – CRC may use, collect, or disclose employee personal
information if it is reasonable for the purposes of establishing, managing, or terminating an
employment relationship between CRC and the employee.
4.11 Employee Notification – CRC must notify an employee if their employee information is being
collected, used, or disclosed before the third-party organization can collect, use, or disclose the
employee personal information without the consent of the employee.
ARTICLE 5 CONSENT
5.1 Accuracy – Personal Information will be accurate, complete, and as up to date as is necessary for the purposes for which it will be used.
5.2 Retention Schedule:
a) Membership records – 2 years after expiry.
b) Financial records – 7 years.
c) Employment records – 7 years after termination.
d) Historical records (e.g., competition results, board minutes, club artifacts) – retained indefinitely unless requested otherwise.
5.3 Secure destruction methods (shredding, secure digital deletion including deletion from cloud) will be used when retention periods expire.
5.4 Security Safeguards- Personal Information will be protected against loss or theft, unauthorized access, disclosure, copying, use, or modification by security safeguards appropriate to the sensitivity of the Personal Information, including encryption, password protection, role-based access, and secure cloud storage.
5.5 CRC will maintain breach response procedures, including notification of affected individuals and regulators as required by law. Representatives will be notified of a data breach of personal information within 48 hours of discovery.
5.6 Decisions – Personal Information that has been used to make a decision about a Representative will be maintained for a minimum of one year in order to allow the Representative the opportunity to access the Personal Information after the decision has been made.
ARTICLE 6 OPENNESS
6.1 Information – CRC will make available:
a) The name or title, and the address, of the person who is accountable for CRC’s privacy
policies and practices and to whom complaints or inquiries can be forwarded.
B) The means of gaining access to personal information held by CRC.
c) A description of the types of personal information held by CRC, including a general account of its use.
d) Copies of CRC’s policies, standards, or codes; and
e) Third parties in which personal information is made available.
ARTICLE 7 ACCESS
7.1 Access – Upon written request, and with assistance from CRC, a Representative may be
informed of the existence, use and disclosure of his or her Personal Information and will be
given access to that information. As well, a Representative is entitled to be informed of the
source of the Personal Information along with an account of third parties to whom the
information has been disclosed.
7.2 Amendment – A Representative may challenge the accuracy and completeness of the Personal Information and have it amended as appropriate.
7.3 Response – Requested information will be disclosed to the Representative within 30 days of
receipt of the written request at no cost to the Representative unless there are reasonable grounds to extend the time limit.
7.4 Costs – Costs may only be levied if a Representative is informed in writing in advance of the
approximate cost and has agreed to proceed with the request.
7.5 Denial – A Representative may be denied access to his or her Personal Information if:
a) This information is prohibitively costly to provide.
b) The information contains references to other individuals or Representatives.
c) The information cannot be disclosed for legal, security or commercial proprietary purposes.
d) The information is subject to solicitor-client privilege.
7.6 Reasons – Upon refusal, CRC will inform the Representative of the reasons for the refusal and the associated provisions of the Acts.
7.7 Identity – Identity verification will be required prior to providing any Representative an account of the existence, use, and disclosure of their Personal Information.
ARTICLE 8 COMPLIANCE and COMPLAINTS
8.1 Challenges – A Representative will be able to challenge compliance with this Policy and the Acts to the designated individual accountable for compliance.
8.2 Procedures – Upon receipt of a complaint, CRC will:
a) Record the date the complaint is received
b) Notify the President who will serve, or designate an appropriate person to serve, in a neutral, unbiased capacity to resolve the complaint.
c) Acknowledge receipt of the complaint and clarify the nature of the complaint within seven days of receipt of the complaint.
d) Appoint an investigator using CRC’s personnel or an independent investigator, who will
have the skills necessary to conduct a fair and impartial investigation and will have unfettered access to all file and personnel
e) Within thirty days of receipt of the complaint, and upon completion of the investigation, the
investigator will submit a written report to CRC
f) Notify the complainant the outcome of the investigation and any relevant steps taken to
rectify the complaint, including any amendments to policies and procedures
ARTICLE 9 DIGITAL PRIVACY PRACTICES
9.1 CRC’s website and third-party services may use cookies and analytic tools to improve services.
9.2 CRC will disclose use of third-party services (ie, Google Analytics, MailChimp, Communal CRM, iCrew)
9.3 Representatives may opt out of marketing communications at any time by notifying the Club Manager in writing, or via unsubscribe links in emails or on the member portal.
9.4 CRC will not sell or trade personal information to third parties
9.5 Social media content will respect consent, especially for minors.
ARTICLE 10 REVIEW and AMENDMENTS
10.1 The CRC Privacy Policy will be reviewed annually in January by the CRC Board , with updates approved by the Board and documented in the minutes.
10.2 Any updates to the policy will be communicated to members via email