Kids Help Phone Foundation Privacy Policy

The Foundation is a registered charity established to support the fundraising activities of Kids Help Phone (KHP) We work collaboratively to ensure that critical e-mental health and crisis support services remain accessible to young people across Canada.

The Foundation and KHP operate in a collaborative data governance model where each organization may act as either a Data Controller or Data Processor depending on the specific processing activity:

When the Foundation Acts as Data Controller

For certain activities, the Foundation independently determines the purposes and means of processing personal information:

Direct Fundraising Activities:

• Major gift solicitations and stewardship
• Foundation-initiated fundraising campaigns
• Direct donor relationships and cultivation
• Foundation events and galas
• Planned giving programs managed by the Foundation
• Foundation volunteer management
• Foundation-specific newsletters and communications

Foundation Responsibilities as Controller:

• Determines purposes and legal basis for processing
• Maintains legal responsibility for data protection decisions
• Responds to privacy rights requests from individuals
• Makes decisions about retention, deletion, and disclosure
• Ensures compliance with privacy legislation
• Conducts privacy impact assessments for Foundation initiatives

KHP’s Role as Processor (when applicable):

• Processes information on Foundation’s documented instructions
• Provides technical support and shared services
• Maintains security of shared systems
• Reports incidents to the Foundation
• Returns or destroys data as directed

When KHP Acts as Data Controller

For other activities, KHP determines the purposes and means of processing:

Service-Related Fundraising:

• Fundraising directly tied to service delivery
• Integrated donor and service user communications
• Organization-wide campaigns
• Donor information collected through KHP channels
• Corporate partnerships managed by KHP

KHP Responsibilities as Controller:

• Determines purposes and legal basis for processing
• Maintains legal responsibility for data protection decisions
• Coordinates responses to privacy rights requests
• Makes decisions about retention and disclosure
• Ensures overall compliance with privacy legislation
• Manages and documents all employee data

Foundation’s Role as Processor (when applicable):

• Processes information on KHP’s documented instructions
• Implements appropriate security measures
• Maintains confidentiality and trains staff
• Reports security incidents to KHP
• Cooperates with audits and assessments

Shared Controller Arrangements

For some activities, the Foundation and KHP act as Joint Controllers:

Joint Activities Include:

• Integrated fundraising campaigns
• Shared donor databases and CRM systems
• Cross-organizational events
• Combined stewardship programs
• Collaborative grant applications

Joint Controller Responsibilities:

• Jointly determine purposes and means of processing
• Share responsibility for compliance
• Coordinate on privacy rights requests
• Maintain clear allocation of responsibilities
• Ensure consistent privacy protection

Data Governance Agreements

• All data processing relationships between the Foundation and KHP are governed by:
• Comprehensive Data Protection Agreement
• Joint Controller Agreements (where applicable)
• Data Sharing Protocols
• Security and Incident Response Procedures
• Clear allocation of responsibilities matrix

Scope and Information We Collect

Who This Policy Applies To

• Donors: Individual donors, corporate donors, major gift donors, planned giving participants, and memorial/tribute gift contributors
• Volunteers: Foundation volunteers, event volunteers, campaign volunteers, committee members, and board members
• Event Participants: Fundraising event attendees, workshop participants, speakers, and vendors
• Digital Users: Website visitors, newsletter subscribers, social media followers, and online donors
• Corporate Partners: Sponsors, corporate partners, employee giving program participants, and vendor contacts
• Employees and Contractors: Foundation employees, contractors, consultants, and temporary personnel

Types of Information Collected

Donor Information:

• Contact details: name, address, phone, email
• Donation information: amounts, payment methods, frequency, designation preferences
• Communication preferences and recognition preferences
• Event participation and volunteer activity records
• Wealth screening and capacity assessment information (Foundation as Controller)

Event Participants:

• Registration information including accessibility needs and dietary restrictions
• Payment information for events and activities
• Photography and media consent for promotional purposes
• Feedback and evaluation responses

Website Visitors:

• Technical information: IP address, browser type, device information
• Usage data: pages visited, engagement patterns, referral sources
• Cookies and tracking technologies as described in our Cookie Policy

Corporate Partners:

• Business contact information and decision-maker details
• Partnership agreements and collaboration records
• Employee and volunteer participation in giving campaigns and events
• Recognition and stewardship preferences
• Employee and volunteer information

How We Use Your Information

Primary Purposes

The specific controller for each purpose determines the legal basis and processing parameters:

Donation Processing and Stewardship:

• Processing and acknowledging donations (Controller: Foundation or KHP depending on donation channel)
• Issuing official charitable tax receipts (Controller: Foundation for direct donations)
• Managing recurring donation programs and pledges Sending thank-you communications and impact updates
• Providing donor recognition (with consent).

Fundraising Activities:

• Organizing and managing fundraising events and campaigns (Controller: Organizer of specific activity)
• Developing targeted fundraising strategies
• Conducting donor research and capacity assessment (Controller: Foundation for major gifts)
• Analyzing giving patterns to improve fundraising effectiveness
• Coordinating volunteer activities and engagement
• To support our fundraising, KHP may analyze donor and supporter information to:
  • Understand giving patterns and create aggregate reports.
  • Segment data to provide relevant communications.
  • Use predictive modeling to improve fundraising effectiveness
• All activities comply with PIPEDA, CRA, and CASL. We may use third-party platforms (potentially outside Canada) which are secured by contract, though data may be subject to local laws. We will always honor anonymity requests and provide clear opt-outs for communications and analytics.

Communication and Engagement:

• Sending newsletters, updates, and program information (Controller: Sender organization)
• Conducting surveys and collecting feedback
• Providing volunteer opportunities and community engagement
• Sharing success stories and impact reports

Analytics and Improvement:

• Analyzing donation patterns and campaign effectiveness (Joint Controllers for shared data)
• Improving donor experience and communication strategies
• Enhancing website functionality and user experience
• Measuring fundraising performance and return on investment

Legal Basis for Processing

The applicable Data Controller determines the legal basis for processing, which includes:

• Consent: For marketing communications and specific uses
• Legitimate interests: For fundraising activities supporting our charitable mission
• Contractual necessity: For donation processing and tax receipt issuance
• Legal obligations: For compliance with charity regulations and tax requirements

Information Sharing and Disclosure

Sharing Between Foundation and KHP

Information sharing between the Foundation and KHP occurs under three frameworks:

Controller to Processor: When one organization processes data on behalf of the other under documented instructions

Joint Controller Arrangement: When both organizations jointly determine purposes and means of processing

Controller to Controller: When organizations share information as independent controllers for compatible purposes

All sharing is governed by appropriate data protection agreements ensuring:

• Clear allocation of responsibilities
• Appropriate security safeguards
• Defined purposes and limitations
• Incident response coordination
• Privacy rights management

Third-Party Service Providers

We share information with trusted service providers who assist with:

• Payment processing and donor management systems
• Email marketing and communication platforms
• Event management and registration systems
• Website hosting and analytics services
• Professional services (accounting, legal, consulting)

All service providers are contractually required to:

• Process information only for specified purposes
• Implement appropriate security safeguards
• Maintain confidentiality and provide staff training
• Report security incidents immediately
• Return or destroy data upon contract termination

Other Disclosures

We may disclose personal information when:

• Required by law or legal proceedings
• Necessary to protect rights and safety of individuals
• Authorized by donors for list rental with other registered charities
• Sharing aggregate, de-identified data for reporting and research (minimum 100 people in dataset)
• Processing employee benefits and/or entitlements through external vendors.

Geographic Processing

Personal information is primarily processed and stored in Canada. Any processing outside Canada requires:

• Risk assessment by the responsible Controller
• Implementation of enhanced safeguards
• Clear documentation of transfers
• Appropriate contractual protections

Data Retention and Destruction

Retention periods are determined by the responsible Controller based on:

Foundation as Controller:

• Major donor records: Duration of relationship plus 10 years
• Foundation event information: 7 years following the event
• Foundation volunteer records: Duration of service plus 3 years
• Foundation-specific communications: Until consent withdrawn

KHP as Controller:

• Service-related donor records: Per KHP Foundation’s Data Retention policy
• Integrated campaign data: Per KHP Foundation’s Data Retention policy
• KHP Foundation employee records and information

Joint Controller Activities:

• Jointly determined retention periods documented in agreements
• Minimum 7 years for financial records per Canadian charity regulations

Secure Destruction: Both organizations implement secure destruction procedures for physical and digital information, including cross-cut shredding for documents and secure deletion standards for digital data.

Your Privacy Rights

You may exercise your privacy rights by contacting the appropriate Data Controller or either organization who will coordinate the response:

Your Rights Include:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete information
• Withdrawal of Consent: Withdraw consent for marketing communications
• Opt-Out: Unsubscribe from communications and donor list rentals
• Deletion: Request deletion of your information (subject to legal requirements)
• Portability: Request transfer of your information in machine-readable format
• Complaints: File complaints about privacy practices

How to Exercise Your Rights

For Foundation-Controlled Data:

Kids Help Phone Foundation
300-439 University Avenue, Toronto, ON M5G 1Y8
Email: [email protected]
Phone: 1-800-268-3062

For KHP-Controlled Data:

Kids Help Phone
300-439 University Avenue, Toronto, ON M5G 1Y8
Email: [email protected]
Phone: 1-800-268-3062

For Joint Controller Activities:
Contact either organization – we will coordinate the response

Response Timeframe: Privacy rights requests will be processed within 30 days. For joint controller activities, both organizations will coordinate to ensure timely response.

Security Safeguards

Both organizations implement comprehensive security measures:

Administrative Safeguards

• Privacy training for all staff and volunteers
• Confidentiality agreements for all personnel
• Regular privacy policy reviews and updates
• Coordinated incident response procedures
• Role-based access controls

Technical Safeguards

• Encryption for data transmission and storage
• Secure payment processing systems (PCI DSS compliant)
• Regular security assessments and updates
• Advanced firewall and intrusion detection systems
• Secure backup and disaster recovery procedures

Physical Safeguards

• Secure storage with locked filing systems
• Restricted access to facilities
• Clean desk and clear screen policies
• Secure disposal procedures
• Environmental protection measures

Cookies and Website

Privacy Each organization’s website uses cookies and tracking technologies to:

Enable essential website functionality

Analyze website usage and improve performance

Personalize user experience and content

Measure effectiveness of fundraising campaigns

Cookie Management: Granular consent management allowing choice of cookie types, modifiable through preference centers on each website.

Third-Party Analytics: Privacy-compliant analytics with data minimization and anonymization techniques.

Breach Response and Incident Management

Incident Detection

Both organizations maintain monitoring systems to detect potential security incidents through:

• Automated security alerts
• Staff reporting procedures
• Regular security assessments
• Vendor incident notifications

Response Procedures

For Foundation-Controlled Data:

1. Immediate containment by Foundation security team
2. Notification to KHP if shared systems affected
3. Investigation and scope determination
4. Required notifications to regulators and individuals
5. Remediation and prevention measures

For KHP-Controlled Data:

1. Response per KHP Incident and Breach Management Policy
2. Notification to Foundation if shared systems affected
3. Coordinated response for joint activities

For Joint Controller Activities:

1. Immediate coordination between privacy teams
2. Joint investigation and response
3. Coordinated notifications
4. Shared remediation responsibilities

Individual Support

Appropriate support services for affected individuals, including identity protection assistance and monitoring where necessary.

Complaint Management

We respond to privacy complaints within 28 calendar days:

Process

1. Receipt and Acknowledgment: Immediate acknowledgment with reference number
2. Investigation: Thorough investigation including evidence collection
3. Coordination: For joint controller activities, coordinated investigation
4. Resolution: Development and implementation of corrective measures
5. Communication: Clear communication of findings and actions
6. Appeal: Internal appeal processes available

Complaint Submission

Foundation Privacy Matters:
Email: [email protected]
Mail: Privacy Officer, Kids Help Phone Foundation
300-439 University Avenue, Toronto, ON M5G 1Y8

KHP Privacy Matters:
Email: [email protected]
Phone: 1-800-268-3062

External Appeals

• Information and Privacy Commissioner of Ontario: www.ipc.on.ca
• Office of the Privacy Commissioner of Canada: www.priv.gc.ca

Updates and Contact Information

Policy Updates

This Privacy Policy may be updated to reflect changes in our practices, legal requirements, or organizational developments. Material changes will be communicated to stakeholders with the effective date clearly indicated.

Contact Information

Kids Help Phone Foundation
300-439 University Avenue, Toronto, ON M5G 1Y8
Website: khpfoundation.ca
Email: [email protected]

Kids Help Phone
300-439 University Avenue, Toronto, ON M5G 1Y8
Email: [email protected]
Phone: 1-800-268-3062

Languages: This Privacy Policy is available in English and French. Translations into other languages are available upon request.

Last Revised: September 2025