Data Governance and Privacy Policy

1. Purpose and scope

This policy sets out what personal information AWARE Community Foundation ("AWARE") collects, why, how it is protected, who can see it, and how long it is kept. It applies to all directors, staff, Athlete Educator Corps educators, contractors (including the independent evaluator) and volunteers, and to every system AWARE uses to hold information.

It has two jobs. First, to make AWARE's public privacy statement on awarecf.com accurate today. Second, to set the rules for program and research data before any is collected in 2027. Appendix A lists the website changes needed so the site matches this policy.

2. Which law applies

AWARE is a non-profit company registered under Part 9 of the Alberta Companies Act. Alberta's Personal Information Protection Act (PIPA) applies to non-profit organizations of this kind only for personal information collected, used or disclosed in connection with a commercial activity. Some AWARE activities may be commercial (for example, the paid "Trained by AWARE" staff seminar for operators and partner agreements); program delivery to athletes may not be. Which AWARE activities fall within PIPA, and whether the federal PIPEDA applies to any cross-border activity, is subject to legal advice.

AWARE will not rely on that distinction. AWARE applies PIPA-standard protections to all personal information it holds, commercial or not. Schools and school authorities that host sessions are subject to Alberta's public-sector privacy legislation; AWARE will meet any additional requirements a host sets.

3. Principles

1. Collect the minimum. Only what is needed for the stated purpose.
2. Say what we do. Every collection point explains its purpose in plain language, and the privacy page describes every way data is collected, including automatic saving.
3. Use only for the stated purpose. No secondary use without fresh consent.
4. No data to funders about people. Partners receive public aggregate results and an account of their funds. Nothing else.
5. No personal data from minors through AWARE channels. Schools and clubs are the point of contact for under-18 athletes.
6. Independent research. Evaluation is run by an independent evaluator under ethics review, not by AWARE staff or funders.
7. Keep it no longer than needed. Retention limits in section 11 are enforced.
8. Security in proportion to sensitivity. Disclosures, safeguarding records and research data get the strongest protection.

4. What we collect now (website)

The website is hosted on Netlify. Forms are processed by Netlify Forms, which stores submissions in the Netlify account and sends email notifications to AWARE.

All forms include a hidden anti-spam field. Netlify also processes standard technical data such as IP addresses to deliver the site and detect spam. What Netlify logs, and for how long, is checked against Netlify's current terms and recorded in the vendor register.

Consultation form: additional behaviour. The consultation page behaves differently from the other forms, and this must be disclosed:

• Browser storage. Answers are saved in the respondent's own browser (localStorage) as they type, so the session can be resumed. This copy stays on the respondent's device until they clear their browser data; it is not currently removed automatically after submission (see Appendix A, item 4).
• Partial ("checkpoint") submission. When the respondent completes question 4, the answers so far, including company, name, title and work email, are sent to AWARE automatically, before the respondent reaches the end. A second, complete submission is sent at the end. Both are linked by the random respondent ID.
• Time spent. The number of seconds since the session started is recorded.

Fonts. Site pages load fonts from Google Fonts, which means the visitor's browser connects to Google servers. AWARE will either self-host the fonts or disclose this on the privacy page (see Appendix A, item 7).

No advertising tracking. The site has no advertising or analytics trackers. If any analytics tool is added, this policy and the privacy page are updated first.

Mailing lists. Email addresses from athlete-family and similar sign-ups are used only for low-frequency updates, each with an unsubscribe option. Consent is recorded with the date and form.

5. What we will collect later (programs and research)

Nothing in this section is collected yet. Before any collection starts, the privacy page is updated.

AWARE does not collect athlete names, contact details or betting behaviour as part of program delivery. Anything an athlete discloses in a session is handled under the Safeguarding and Working with Minors Policy and is never shared with a funder in any form.

6. Minors

• No personal data from under-18s through AWARE's forms or channels. Website forms are for adults and organizations. Each form will carry a required confirmation: "I am 18 or older, or I am contacting you on behalf of an organization." The team-request form will no longer offer "Athlete" as a role for under-18 school and club teams; athletes are directed to ask their coach or athletic director. The "Athlete" role is kept only for adult athletes at university and provincial level, subject to the age confirmation above.
• If AWARE learns it has received personal information from a minor through a form, it deletes it and, if appropriate, replies once directing the young person to their coach and to help resources.
• School or club is the point of contact for every under-18 session. Parent and guardian notices are sent by the host, not by AWARE.
• No photographs or recordings of minors by AWARE, consistent with the published privacy page.
• Research with minors happens only under section 7, with REB approval, active parental or guardian consent and the young person's own assent, and any additional approval the school authority requires.

7. Research and evaluation ethics

1. Independent evaluator. All outcome evaluation and the baseline study are designed and run by an independent evaluator appointed before delivery; the appointment is confirmed and recorded by the board before AWARE's first session. The evaluator controls research data. AWARE staff receive only de-identified or aggregate data.
2. Ethics review. Every study involving human participants is reviewed by a research ethics board (REB) operating in line with the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS 2), before data collection. The REB (through the evaluator's institution or an independent REB) is confirmed and recorded by the board before AWARE's first session.
3. Pre-registration. Research questions, outcome measures and analysis plans are pre-registered publicly on a recognized open registry before data collection. The registry is confirmed and recorded by the board before AWARE's first session.
4. Consent. Participation is voluntary, with informed consent; for minors, active parental or guardian consent plus the young person's assent. Declining has no effect on the athlete's participation in the session.
5. De-identification. Surveys are anonymous by design wherever possible. Where linking pre- and post-session responses is necessary, the evaluator uses a self-generated code, not names. Any key is held only by the evaluator and destroyed at the end of the study.
6. Small-cell suppression. Results are published only in aggregate. Any figure based on fewer than 10 respondents is suppressed or combined, and no table may allow a team, school, club or individual to be identified.
7. Publication. Results are published regardless of outcome. Partners receive advance notice of publication, never review or approval, consistent with published partner terms.
8. No funder access. No identifiable data, and no institution-level data, is ever shared with any funder, partner or gambling operator.

8. Funder firewall

• Partners never receive athlete-level data, educator-level data, or data identifying any school, club, team or institution.
• The annual outcomes briefing to each partner contains only: the same aggregate results published publicly, and an itemized account of that partner's funds.
• The Partner Council receives operational information (scheduling, reach counts at the provincial level, in-product distribution) and nothing identifiable.
• Consultation responses from operators are confidential to AWARE. They are not shared with other operators and are not referenced publicly, even in aggregate, without explicit consent, as stated on the privacy page.
• Funding agreements will include a clause confirming the partner has no right to any personal or institution-level data, in wording settled subject to legal advice.
• Any request from a funder for data outside these limits is refused and reported to the board.

9. Data residency and vendors

Current state, disclosed. Netlify (hosting and forms) is a US-based provider, and form submissions are processed and stored outside Canada. Email is handled by a third-party provider; the provider and its storage location are confirmed and recorded by the board before AWARE's first session and disclosed on the privacy page. Google Fonts connects visitors' browsers to Google servers. Data stored outside Canada may be accessible to authorities in that country under its laws.

Target state. Program data, safeguarding records and all research data will be stored in Canada. Website contact forms may continue to use a non-Canadian provider if disclosed, but AWARE will evaluate a Canadian-hosted form option, and the board will record its decision, before program launch.

Vendor rules.

• Every vendor that handles personal information is listed in a vendor register with: purpose, data handled, storage location, retention and security terms.
• Vendors are chosen for security and data location, not only cost. Research vendors are approved by the evaluator and the REB.
• No vendor may be a gambling operator or affiliated with one.
• Access uses named accounts with two-factor authentication. No shared passwords.

10. Security

• Access is limited to people who need it. Safeguarding and incident records: Safeguarding Lead and independent safeguarding director only.
• Two-factor authentication on Netlify, email and any storage system.
• Personal information is not kept on personal devices or in personal email accounts.
• Exports of form data are deleted from local devices once processed.
• Paper records (for example, signed consent forms) are stored locked and scanned only into approved systems.

11. Retention schedule

The periods below are subject to legal advice. Where law, an insurer or a host requires a longer period, the longer period applies. Periods for safeguarding records and records relating to minors are minimums.

The Privacy Officer runs a deletion review at least annually and records it.

12. Access, correction and deletion requests

Anyone may ask to see, correct or delete personal information AWARE holds about them by writing to info@awarecf.com. AWARE will:

• confirm receipt within 5 business days;
• respond in full within 30 days, consistent with PIPA timelines where PIPA applies;
• verify identity in proportion to the request, without collecting more than needed;
• explain any information withheld and why (for example, information about another person, or safeguarding records that must be retained by law).

AWARE cannot delete data held only in a person's own browser (the consultation's saved answers); the privacy page will explain how to clear it.

13. Breach response

A privacy breach is any loss of, unauthorized access to, or disclosure of personal information.

1. Contain. Whoever discovers it tells the Privacy Officer immediately. Stop the access, recover the data, change credentials.
2. Assess. The Privacy Officer assesses within 48 hours whether there is a real risk of significant harm to any individual.
3. Notify. Where there is a real risk of significant harm, AWARE notifies the affected individuals directly and without unreasonable delay. Where PIPA applies, it also notifies Alberta's Office of the Information and Privacy Commissioner (OIPC) without unreasonable delay, as required by PIPA. Where it is unclear whether PIPA applies, AWARE will notify the OIPC voluntarily. Notice content follows PIPA and its regulations, subject to legal advice.
4. Inform the board. The chair, the non-founding directors overseeing privacy and, once seated, the independent director responsible for privacy are told within 24 hours of a confirmed breach. Breaches involving a minor or a disclosure are also reported to the Safeguarding Lead.
5. Record and learn. Every breach is logged, including ones not notifiable, with cause and corrective action.

14. Roles

• Privacy Officer. The co-founder and interim chair, Victor Cui, until staff are hired, contactable at info@awarecf.com. Responsible for this policy, the vendor register, requests, retention reviews and breach response.
• Independent oversight. Until the independent majority of the board is seated, the two non-founding directors oversee the Privacy Officer and receive an annual privacy report, which is also tabled with the full board. Once the independent majority is seated, an independent director takes over this role. Because the Privacy Officer is the founder, any complaint about the founder's handling of personal information goes to the two non-founding directors, with the Foundation's external legal counsel as external reviewer where needed, pending the independent director.
• Independent evaluator. Data controller for research data under the REB-approved protocol.
• Safeguarding Lead. Custodian of safeguarding and incident records.
• All personnel. Complete privacy orientation, follow this policy, and report suspected breaches immediately.

15. Review

The board reviews this policy at least annually, before any new data collection begins, and after any breach or change in law.

Appendix A: Website changes required to align the site

The board adopted this policy in October 2026. Items 1 to 5 are made before the site is promoted further.

1. Age confirmation on every form. Add a required checkbox to team-request, corps-interest, athlete-family, partner-conversation, seminar-interest, contact-general and aware-consultation: "I am 18 or older, or I am contacting you on behalf of an organization."
2. Team-request role list. Remove or qualify the "Athlete" and "Parent of an athlete" options so under-18 athletes are directed to their coach or athletic director; add a line: "Under 18? Ask your coach or athletic director to contact us."
3. Corps-interest form. State that Corps educators must be 18 or older, and add the line: "Educators may not hold any endorsement or marketing arrangement with a gambling operator."
4. Consultation page notice. Near the "Auto Saves" indicator and email field, add: "Your answers are saved in this browser so you can resume. When you finish question 4, your answers so far, including your name and work email, are sent to AWARE; the full set is sent when you finish." Add a link to /privacy/ and a "Clear my saved answers" control, and clear the saved answers from localStorage automatically after the complete submission.
5. /privacy/ page: "What we collect". List all seven forms by purpose, including the consultation; disclose checkpoint (partial) submissions, the respondent ID and time-spent field, and browser localStorage with how to clear it.
6. /privacy/ page: "How it's stored". Replace "delivered to the Foundation by email" with an accurate description: submissions are processed and stored by Netlify, a US-based provider, and also sent by email; name the email provider; state that data may be stored outside Canada.
7. /privacy/ page: Google Fonts. Disclose that fonts load from Google, or self-host the fonts and remove the statement.
8. /privacy/ page: Privacy Officer. Name the Privacy Officer (Victor Cui, co-founder and interim chair, until staff are hired) and the contact info@awarecf.com; state the 30-day response commitment.
9. /privacy/ page: Minors. Add: "Our forms are for adults and organizations. We do not knowingly collect personal information from anyone under 18. Sessions for under-18 teams are arranged through the school or club."
10. /privacy/ page: Research. Update "Evaluation and research data" to say evaluation is run by an independent evaluator with research ethics board review; that research with minors requires parental consent; and that results are published only in aggregate with small groups suppressed.
11. /privacy/ page: Retention. Add a short retention summary and link to the full policy.
12. /privacy/ page: Funder firewall. Keep the existing commitment and add: "Funding partners never receive athlete-level or institution-level data."
13. /privacy/ page: Law and complaints. Add a line that individuals may contact Alberta's Office of the Information and Privacy Commissioner if unsatisfied with AWARE's response, in wording settled subject to legal advice on PIPA applicability.
14. /privacy/ page: Date. Update "Last reviewed" when changes are published.

← All governance documents · Questions: info@awarecf.com