Privacy & Security

Effective Date: September 2026

Last Updated: June 2024

1. Our Commitment to Privacy

World Vision Canada ("World Vision Canada", "we", "us" or "our") is committed to protecting the privacy, confidentiality and security of the personal information entrusted to us by donors, supporters, sponsors, participants, volunteers, employees, applicants, website users and other stakeholders. World Vision Canada carries out charitable activities, including fundraising, gift catalogue transactions, events and related engagement activities. Some of these activities may involve commercial elements within the meaning of applicable privacy laws. We manage personal information in accordance with applicable privacy legislation, which may include federal and provincial privacy laws depending on the nature of the activity and the location of the individual.

We aim to be open about how we collect, use, disclose, retain and protect personal information, and about how individuals may contact us, ask questions, access their information, request corrections, request portability where available, withdraw consent where applicable, or make a privacy complaint.

2. Who Is Responsible for Personal Information

World Vision Canada is responsible for personal information under its control, including personal information transferred to service providers for processing on our behalf. Our Chief Privacy Officer / Person in Charge of the Protection of Personal Information is responsible for overseeing compliance with this Policy and our privacy governance practices.

Steven Pink, Chief Privacy Officer

World Vision Canada, 1 World Drive, Mississauga, Ontario L5T 2Y4

Email: steven_pink@worldvision.ca⁣

3. Scope of This Policy

This Policy applies to personal information that World Vision Canada collects, uses, discloses, retains or otherwise handles in the course of its activities, including through our website, donation forms, sponsorship and program interactions, gift catalogue purchases, fundraising campaigns, events, surveys, telephone calls, emails and other communications, and volunteer, contractor, applicant and employment-related activities.

This Policy does not apply to information that is not personal information under applicable law, such as certain business contact information or information that has been properly anonymized so that it can no longer be associated with an identifiable individual.

4. What Is Personal Information?

For the purposes of this Policy, "personal information" generally means information about an identifiable individual. Depending on the context, this may include a person's name, home address, personal email address, telephone number, donation history, sponsorship history, payment or banking details, date of birth, communication preferences, opinions, correspondence, website interaction data, event participation information, and other information that can identify the individual directly or indirectly.

Personal information may also include information that is considered sensitive under applicable law, depending on the context, such as financial information, identification information, information about children, or information concerning vulnerable individuals. Sensitive information is handled with a higher level of care and, where required, with express consent.

5. How We Collect Personal Information

We may collect personal information directly from the individual, including when the individual: makes a donation, pledge or purchase; sponsors a child or supports a program; signs up to receive updates, newsletters or appeals; contacts us by phone, email, mail, social media or through our website; volunteers, applies for employment, or participates in an event, campaign or survey; or visits our website or uses our digital services.

We may also collect personal information from third parties where authorized by law or with appropriate consent, including from donation platforms, payment processors such as Stripe and Moneris, event platforms, mailing service providers, affiliated World Vision entities, referral sources, publicly available sources used appropriately, and service providers acting on our behalf.

At or before the time of collection, and in a manner appropriate to the circumstances, we identify the purposes for which personal information is being collected.

6. The Categories of Personal Information We May Collect

Depending on the relationship with the individual and the activity involved, we may collect the following categories of personal information:

contact information, such as name, home address, email address and telephone number;
donation and transaction information, such as donation amount, date, payment method, recurring giving information, event registrations, gift catalogue purchases and tax receipt information;
banking or payment information required to process authorized donations or purchases;
sponsorship, program and engagement information, such as communities, causes or campaigns supported, language preferences, communication preferences and prior interactions with us;
volunteer, applicant, contractor or employee-related information where relevant;
website and digital interaction information, such as IP address, browser or device-related information, cookie data, pages viewed, interactions with emails or website content, and other usage-related data where such collection is used; and
any other information that the individual chooses to provide to us.

We collect only the personal information that is reasonably necessary for the purposes identified in the relevant circumstances, unless otherwise authorized or required by law.

7. Why We Collect, Use and Disclose Personal Information

We collect, use and disclose personal information for the following purposes, as applicable:

Core transactional and service purposes

to process donations, pledges, gift catalogue purchases and event registrations;
to process payments, issue receipts and maintain financial records;
to administer sponsorships, charitable programs and related services; and
to communicate with individuals regarding transactions, receipts, sponsorship updates and requested services.

Fundraising and engagement purposes

to communicate with individuals about charitable appeals, campaigns, programs and events;
to provide updates on impact, stewardship information and donor engagement; and
to respond to inquiries, requests, complaints or feedback.

Optional or enhancement purposes, where permitted by law or with appropriate consent

to understand engagement and improve communications;
to tailor outreach and fundraising efforts;
to analyze website usage and improve user experience; and
to evaluate program effectiveness and organizational performance.

Legal, operational and safeguarding purposes

to comply with legal, regulatory, accounting, audit and reporting obligations;
to maintain records and ensure accountability;
to prevent fraud, abuse or misuse of services;
to protect the security and integrity of our people, systems, website and operations; and
to support safeguarding and protection of vulnerable populations.

We do not use personal information for a new purpose that has not been identified unless we are permitted or required by law to do so or we obtain any required consent.

8. Consent

We seek consent in a manner that is appropriate to the sensitivity of the personal information and the reasonable expectations of the individual. We aim to ensure individuals understand what personal information is being collected, the purposes for which it will be used, the types of third parties with whom it may be shared, and any significant consequences of the collection, use or disclosure.

Implied consent may be used for obvious, necessary purposes, such as processing a donation, sponsorship payment, event registration or gift catalogue purchase requested by the individual. Express consent will be obtained where required by law, including where the information is sensitive, the use is not obvious or not necessary to provide the requested service, or the activity involves marketing, profiling or analytics with a meaningful privacy impact.

Where personal information is used for purposes that are not required to provide a service, individuals will be provided with a clear choice, including the ability to opt out where required.

Individuals may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. We will explain any consequences of withdrawal, which may include inability to continue processing recurring donations, inability to maintain sponsorship arrangements, or limitations on the services we can provide. To withdraw consent or change communication preferences, individuals may contact Customer Service at 1.866.595.5550 or use any unsubscribe or preference-management tool we make available.

Electronic communications are sent in accordance with applicable anti-spam legislation. Where required, our commercial electronic messages include a mechanism to unsubscribe or manage communication preferences.

If an individual chooses not to provide personal information that is necessary for a requested service or transaction, we may be unable to process donations, issue tax receipts, administer sponsorships, register event participation, complete gift catalogue transactions, respond to requests or otherwise provide the requested service.

9. Children and Vulnerable Individuals

We are committed to protecting the privacy of children and vulnerable individuals whose information may be collected in the course of our work. Where required by law, we obtain consent from a parent, tutor, guardian or other authorized representative for the collection, use or disclosure of personal information relating to minors or persons who cannot meaningfully consent for themselves.

We also apply additional care to the handling of information and images relating to children and vulnerable beneficiaries, taking into account safeguarding, dignity, confidentiality and the purposes for which the information is used or published.

10. Disclosure of Personal Information

We do not sell personal information. We may disclose personal information only as reasonably necessary for the purposes described in this Policy, with consent where required, or as otherwise permitted or required by law.

Depending on the circumstances, personal information may be disclosed to:

payment processors and financial institutions and other donation processing providers;
third-party platforms used for events, fundraising campaigns, digital engagement or gift catalogue transactions;
mailing houses, communications vendors, CRM and database providers, analytics providers, IT and cloud service providers and other service providers acting on our behalf;
affiliated World Vision entities and trusted partners where necessary to administer programs, sponsorships, donor relations, safeguarding or operational support;
professional advisors, auditors and insurers; and
regulators, courts, law enforcement agencies or other parties where disclosure is authorized or required by law.

Where we transfer personal information to a third party for processing, we require by contract or other appropriate means that the third party protect the information and use it only for the services it provides to us.

11. Personal Information Processed Outside Canada

Some of our service providers, affiliates or partners may process or store personal information outside the province or country in which it was collected, including elsewhere in Canada and in the United States. At the date of this Policy, personal information is primarily stored and processed in Canada and the United States using secure service providers and cloud infrastructure.

When this occurs, personal information may be accessible to courts, law enforcement or national security authorities in those jurisdictions in accordance with applicable laws. We take reasonable steps to ensure that personal information transferred outside the individual's jurisdiction receives a level of protection appropriate to its sensitivity and to the risks involved. Where required by applicable law, including for disclosures of personal information outside Quebec, we conduct an assessment of privacy risks before the transfer and use contractual, technical and organizational measures designed to provide appropriate protection.

Where personal information is handled by service providers or partners outside a province or outside Canada, we require written agreements or other appropriate safeguards that address confidentiality, security, permitted uses, retention, destruction, incident reporting and other privacy obligations appropriate to the circumstances.

12. Website, Cookies and Other Technological Means

When individuals use our website, donation pages, event pages, email communications or other digital services, we collect technical and usage information as part of our ordinary digital practices. This may include IP address, browser type, device identifiers, pages visited, referring URLs, approximate location derived from technical information, interactions with emails or website content, donation or event form activity, cookie data and similar usage-related information, where such collection is used.

We use cookies, pixels, tags, web beacons, analytics tools, email engagement tracking, preference-management tools and similar technologies, as applicable, to support website functionality, security, accessibility, language preferences, donation and event processing, fraud prevention, analytics, communications effectiveness, fundraising campaign measurement and improvement of our digital services. These tools may be provided by us or by service providers acting on our behalf.

Where required by law, we will provide clear notice of these technologies, obtain consent where required and provide options to manage preferences, unsubscribe, withdraw consent or limit certain types of tracking or analytics. Where we use technologies that allow an individual to be identified, located or profiled, we will provide the notices required by applicable law, explain how those functions may be activated where applicable and describe the means available to manage preferences or limit those functions.

We may use analytics or segmentation tools to better understand donor interests, communication preferences and engagement patterns and to improve the relevance of communications and fundraising outreach. We do not make decisions that have significant legal or similarly significant effects on individuals based exclusively on automated processing. If we were to use personal information to make such a decision, we would provide any legally required notice, explanation and opportunity for review.

13. Retention, Destruction and Anonymization

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to satisfy legal, accounting, tax, audit, safeguarding or reporting requirements, or as otherwise permitted or required by law. We apply retention periods based on the nature of the information and the operational and legal needs associated with it.

When personal information is no longer required, we securely destroy it, erase it or anonymize it in accordance with our records management and privacy governance practices.

14. Accuracy

We take reasonable steps to ensure that personal information we use or disclose is accurate, complete and up to date as necessary for the purposes for which it is to be used. We encourage individuals to notify us of changes to their contact information or other personal information.

15. Safeguards

We protect personal information using administrative, technical and physical safeguards appropriate to the sensitivity of the information. These may include role-based access controls, confidentiality obligations, staff training, secure document handling, contractual protections, encryption or secure transmission tools where appropriate, and measures designed to protect against unauthorized access, use, disclosure, alteration or loss.

No method of transmission over the internet or electronic storage is completely secure. However, we take reasonable measures to reduce risk and to respond appropriately to privacy and security incidents. Where required by law, we will notify affected individuals and regulators of a confidentiality or privacy incident.

16. Access, Correction, Portability and Other Rights

Subject to legal limitations and exceptions, individuals have the right to request access to personal information that we hold about them, request correction of inaccurate or incomplete personal information, withdraw consent to certain uses of personal information where applicable, request information about how their personal information is handled, and request information about the categories of persons who have access to their information, applicable retention periods and, where applicable, the source from which personal information was collected.

To the extent required or permitted by applicable law, individuals may also have the right to request that certain computerized personal information they have provided to us be communicated to them in a structured, commonly used and technological format and/or be transmitted to another organization or person authorized by them, where technically feasible. This right applies only in specific circumstances and may be subject to legal, operational or technical limitations. We will inform individuals if portability cannot be provided and explain the reasons where required.

Individuals located in Quebec may have additional rights under applicable law, including the right to request that we cease disseminating certain personal information, de-index or re-index a hyperlink attached to their name in certain circumstances, and receive information about any decision based exclusively on automated processing where such a decision has a significant effect on them. Where applicable, individuals may also submit observations and request that such a decision be reviewed by a member of our personnel who is in a position to review it.

Requests for access, correction, portability, cessation of dissemination, de-indexation, re-indexation or information about automated processing should be submitted in writing to the Chief Privacy Officer using the contact information in Section 2. We may require sufficient information to verify identity before responding to a request. We generally respond to privacy requests within 30 days, subject to extensions or different timelines permitted or required by applicable law, and we will assist individuals, where possible, in understanding the scope and availability of their rights.

17. Complaints and Questions

Questions, concerns or complaints about this Policy or our privacy practices may be directed to our Chief Privacy Officer. We maintain procedures for receiving, reviewing and responding to privacy-related questions and complaints.

If an individual is not satisfied with our response, the individual may have the right to contact the applicable privacy regulator, including, depending on the circumstances, the Office of the Privacy Commissioner of Canada⁣, the Commission d'accès à l'information du Québec⁣, the Office of the Information and Privacy Commissioner of Alberta⁣, the Office of the Information or the Privacy Commissioner for British Columbia⁣.

18. Additional Information About Our Privacy Governance Practices

World Vision Canada maintains privacy governance policies and practices designed to protect personal information throughout its lifecycle, from collection to destruction or anonymization. These governance practices address roles and responsibilities, safeguards, retention and destruction, incident management, complaint handling, privacy impact assessments where required, and oversight of service providers. Additional information about these practices may be made available on request or by other appropriate means.

This Policy is intended to accurately reflect World Vision Canada's operational privacy practices. The Chief Privacy Officer works with relevant business, fundraising, digital, technology, human resources, finance, sponsorship, program and vendor-management teams, as appropriate, to confirm that the categories of personal information, purposes, technologies, service providers, cross-border processing, retention practices and individual-rights processes described in this Policy remain accurate.

Before publishing material updates to this Policy, and periodically as practices change, we review the Policy against our current operations and applicable legal requirements so that public-facing privacy disclosures remain clear, current and consistent with how personal information is actually handled.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes in our activities, technology, service providers, legal requirements or privacy practices. The most current version will be posted on our website, together with the effective date and last updated date at the top of the Policy. Where required by law, we will take additional steps to notify individuals of material changes or obtain consent to new practices.