Specifically, NAMIC is committed to protecting the confidentiality of its clients’ and supplier confidential and private matters.
Please note that the collection, use and disclosure of employee personal information submitted to NAMIC does not fall within the scope of personal information regulated by PIPEDA.
NAMIC requires that its employees, agents, officers and other authorized persons take all reasonable steps to protect client or third party personal information under its control. NAMIC has appointed a Privacy Committee who is accountable for its compliance with its obligations at law. The NAMIC Privacy Committee may designate the responsibility for the day-to-day collection and processing of personal information to other NAMIC employees as appropriate.
If there are any matters that have not been expressly addressed in this Policy, or (i) if an individual requires clarification as to how to implement or interpret this Policy, (ii) if an individual would like to request access to his or her personal information or to amend such information, or (iii) an individual would like to file a complaint under this Policy, such concerns should be brought to the attention of the Privacy Committee immediately.
The Privacy Committee can be contacted as follows:
This policy will be made available to any customers or third parties whose personal information is collected, used, disclosed or retained pursuant to this policy on NAMIC’s website.
(a) “collection” means the gathering, acquiring, recording, or obtaining of personal information from any source, including from third parties, whether written or verbal;
(b) “consent” means voluntary agreement for the collection, use and disclosure of personal information for defined purposes. Consent can be either express or implied and can be provided directly by the individual or by an authorized representative. Express consent can be given orally, electronically or in writing, but is always unequivocal and does not require any inference on the part of NAMIC. Implied consent is consent that can reasonably be inferred from an individual’s action or inaction;
(c) “commercial activity” means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists;
(d) “disclosure” means the release of personal information;
(e) “personal information” means information about an identifiable individual, but does not include the name, title or business address, business telephone number, business facsimile number or business email address of an employee of an organization;
(f) “record” includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microfilm, sound recording, video-tape, machine-readable record and any other documentary material, regardless of physical form or characteristics, and any copy of any of those things; and
(g) “third party” means an individual or organization outside of NAMIC.
2.5 Should NAMIC transfer personal information to a third party for processing or other permitted transactions, it shall use contractual or other means to provide a comparable level of protection which the information is being processed by a third party.
III. Access to Personal Information
3.1 Upon request, NAMIC shall afford customers a reasonable opportunity to review the personal information in the individual’s file. Personal information shall be provided in understandable form within a reasonable time and at a minimal or no cost to the individual.
3.2 Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information, subject to certain exceptions specified by law. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
3.3 In certain situations, NAMIC may not be able to provide access to all of the personal information it holds about a customer. NAMIC Inc. shall provide the reasons for denying access upon request. For example:
if doing so would likely reveal personal information about a third party or could reasonably be expected to threaten the life or security of another individual;
if disclosure would reveal confidential commercial information;
if the information is protected by solicitor-client privilege;
if the information was generated in the course of a formal dispute resolution process;
if the information was collected in relation to the investigation of a breach of an agreement or a contravention of a federal or provincial law; or
if the information is prohibitively costly to provide.
3.4 All requests for access or amendment to personal information by the person who is the subject of the information shall be made in writing to the Privacy Committee. Where an employee of NAMIC receives a request for access to personal information, the request shall be forwarded immediately to the Privacy Committee.
3.5 In order to safeguard personal information, a customer or may be required to provide sufficient identification information to permit NAMIC to account for the existence, use and disclosure of personal information and to authorize access to the individual’s file. Any such information shall be used only for this purpose.
3.6 NAMIC shall promptly correct or complete any personal information found to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness shall be noted in the individual’s file. Where appropriate, NAMIC shall transmit to third parties having access to the personal information in question any amended information or the existence of any unresolved differences.
- Purposes for Collection and Use of Personal Information
4.1 NAMIC shall identify the purposes for which personal information is collected at or before the time the information is collected.
4.2 It is anticipated that NAMIC will collect personal information for the following purposes and in the following circumstances:
to establish and maintain responsible commercial relations with clients;
to provide customer support and services to its clients;
in order to meet customer/client needs and requests;
to develop, enhance, market or provide products and services;
to manage and develop NAMIC’s business and operations;
to meet legal and regulatory requirements;
in order to contact customers in the course of undertaking commercial activities including in order to provide services;
in order to contact suppliers and other third party service providers; and
in order to process payments and invoices related to the services.
in order to process expenses.
4.3 NAMIC shall collect only as much personal information as is required to fulfill its purpose. Employees and agents of NAMIC are expressly prohibited from collecting or using personal information outside the scope of their duties.
4.4 NAMIC shall identify the purpose for which the personal information is being collected at or before the time the information is collected. Employees and agents of NAMIC should be able to explain to individuals the purpose for which the personal information is being collected at the time of or before collection.
4.5 Where the personal information is to be used for a new purpose, the purpose shall be identified to the affected individual prior to use.
4.6 In certain circumstances (i.e. for legal, medical or security reasons), personal information can be collected, used or disclosed without the knowledge or consent of the individual. NAMIC will only engage in such conduct where required or permitted to do so by law.
- Limiting Use, Disclosure and Retention
5.1 Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law.
5.2 NAMIC shall retain files containing personal information as required by law.
5.3 Personal information that is no longer required by NAMIC to fulfill the purposes for which the information was collected shall be shredded and/or disposed of in a manner that safeguards the confidentiality of the information.
6.1 Personal information shall be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
6.2 NAMIC shall not routinely update personal information unless it is necessary to fulfill the purposes for which the information was collected.
VII. Safeguarding Personal Information
7.1 NAMIC shall take reasonable steps to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification of personal information. All personal information under the custody or control of NAMIC in written form shall be kept in locked filing cabinets or in secured office space and access to such files shall be limited to those employees who require access in order to complete their duties. Personal information that is stored electronically shall be protected by an appropriate firewalls and with password protected user accounts which limit access to such information to those employees who require access in order to complete their duties.
VIII. Openness Concerning Policies and Practices
8.1 NAMIC shall make readily available to customers specific information about its policies and practices relating to the management of personal information.
8.2 NAMIC shall make available information to help customers exercise choices regarding the use of their personal information and the privacy-enhancing services available from the company.
8.3 NAMIC shall inform a customer of the existence, use, and disclosure of his or her personal information upon request and shall give the individual access to that information, except in certain circumstances.
8.4 A customer shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
- Challenging Compliance
9.1 Should an individual have an issue with the manner in which NAMIC, its employees or agents are collecting, using, storing, disclosing or destroying personal information, or any other matter under this Policy, he or she may contact the Privacy Committee at the address previously set out above.
9.2 The Privacy Committee respond in a reasonable period of time from receipt of the complaint to investigate the complaint and to provide a response, including the remedy to be employed, if any.
9.3 If a complaint is found to be justified, NAMIC will take appropriate measures, including, if necessary, amending its policies and practices.