Edmonton Petroleum Golf and Country Club Privacy Policy

The Edmonton Petroleum Golf and Country Club (herein after referred to as EPGCC”) recognizes that protecting the privacy and confidentiality of personal information is an important aspect of the way EPGCC conducts its business. Collecting, using, and disclosing personal information in an appropriate, responsible, and ethical manner is fundamental to EPGCC’s daily operations. EPGCC strives to protect and respect personal information of its shareholders, employees, business partners, contractors and customers, in accordance with Alberta’s Personal Information Protection Act (“PIPA), and other applicable laws. Each staff member of EPGCC must abide by this organization’s procedures and practices when handling personal information.

Guidelines

Applicability This Privacy Policy informs everyone of EPGCC’s commitment to privacy and establishes some of the methods by which privacy is ensured. The EPGCC Privacy Policy applies to all personal information in EPGCC’s possession and control.

Private Information

Private information is defined as including any identifying information about an individual or group of individuals, including name, date of birth, address, phone number, email address, marital or family status, social insurance number, identifying number, employee and member file, nationality, gender, health history, financial data, credit card numbers, bank account numbers, assets, debts, liabilities, payment records, opinions, and personal views or other information which can be attributed to an individual or group(“Personal Information”).

Consent

Member/Prospective Member/Client/Guest

Consent occurs and is obtained when an individual signs a membership application or other form containing Personal Information, thereby authorizing EPGCC to collect, use, and disclose the party’s Personal Information for the purposes stated on the form or the Appropriated Use section of this Privacy Policy.

Senior Manager/ Employee/ Board Member/ Volunteer

EPGCC advises that Personal Information will be collected for the purposes of establishing an employee/ volunteer relationship and consent is deemed through the employment/volunteer relationship. Withdrawal or Variation of Consent if any individual wishes to withdraw or vary his/her consent respecting collection, use, or disclosure of his/her Personal Information, must notify in writing the Privacy Officer. At that point, EPGCC will note the request and discuss with the party options for going forward.

Where Consent Not Needed

EPGCC may collect, use, or disclose Personal Information without an individual’s consent under particular circumstances. These situations include, but are not limited to:

a reasonable person would consider the information being collected, used or disclosed is clearly in his/her interest and consent cannot be obtained in a timely way or it would not be reasonable expected that consent would be withheld;
EPGCC is under obligation by law to collect, use, or disclose Personal Information in order to adhere to the requirements of an investigation of the contravention of a provincial or federal law, under the purview of the appropriate authorities;
the Personal Information collected, used or disclosed is reasonable for the purposes of an investigation or legal proceeding (i.e. pertaining to breach of contract);
an emergency exists that threatens an individual’s life, health, or personal security;
the Personal Information is for in-house statistical study or research; and
the Personal Information is already publicly available or from a public body authorized to disclose the information.

Personal Information Purposes

EPGCC collects and uses Personal Information solely for the purpose of conducting business and developing an understanding of its members and employees. Personal Information may be collected from a prospective member/shareholder, client, contractor, participant, official, guest and volunteer (“individual”) and used by EPGCC representative for purposed that include, but are not limited to, the following:

Name, address, postal code, phone number, date of birth, fax number, and email address for the purpose of providing insurance coverage, managing insurance claims and obtaining provincial and national golf association memberships;
Employee information including name, address, postal code, phone number, email address, social insurance number, work permits, working visa and banking information for the purpose of processing payroll, source deductions, insurance and health benefits;
Credit card number, debit card or chequing information for the purpose of processing merchandise orders, registration, travel administration, purchasing equipment, lessons and competition fees;
Criminal record check, resume and personal reference for the purpose of implementing EPGCC’s screening programs;
Personal health information including provincial health card number (for minor travelling without a legal guardian or parent), allergies, emergency contact and past medical history for the safety of the individual and for the use in the case of medical emergency;
Coach information including name, address, telephone number, email, school, coaching experience, qualifications, NCCP, RCGA or PGA numbers, reference letters and performance results for employment purposes, media relations and determining level of certification;
Golf participant information including relevant medical history, height, weight, uniform size, birth date, citizenship, shoe size, feedback from coaches/officials, and performance results for the purpose of participant registration forms, outfitting uniforms, media relations, monitoring eligibility and various aspects of individual golf participant and team selection;
Golf participant status information including discipline, training times, and venues, training and tournament dates and locations, travel plans, competition schedule and disabilities, if applicable, for Canadian Centre for ethics in sport and inquiries for the purposes of possible applicable drug testing;
Video footage and photographs at competitions and at EPGCC for the purpose of technical monitoring officials training, educational purposes, sports promotion, media publications and posting on EPGCC’s website, displays or posters;
Marketing information including attitudinal and demographic data on individual members to determine membership demographic structure, and program requirements; and,
Passport numbers and frequent flyer number for travel purposes.

Policy Statements and Measures

The EPGCC Privacy Policy, other related EPGCC privacy policies and procedures, and applicable privacy laws is adopted by the Board of Directors. In the absence of a separate appointment, the EPGCC Board of Directors has appointed the EPGCC General Manager to act as the Privacy Officer.
EPGCC obtains Personal Information directly from the Individual to which the information belongs. Individuals are entitled to know how EPGCC uses Personal Information and this organization will limit the use of any Personal Information collected only to what is needed for those stated purposes. EPGCC will obtain consent if Personal Information is to be used for any other purpose, other than in situations where consent is not required as permitted by legislation.
EPGCC will not sell, distribute, or otherwise disclose Personal Information or contact lists to third parties, although, limited disclosure may be required as part of EPGCC fulfilling its business duties and day-to-day operations. This may include disclosure to agents, consultants, contractors, suppliers, or business partners of EPGCC, but only with the understanding that these parties obey and bide by this Privacy Policy, to the extent necessary for fulfilling their own business duties and day-to-day operations.
EPGCC will retain Personal Information only for the duration it is need for conducting business. Once Personal Information is no longer required, it will be destroyed in a safe and secure manner. However, some laws may require that some Personal Information be kept for a specified amount of time, which will govern. EPGCC will follow the record retention terms of the Canada Revenue Agency, unless determined by other requirements.
EPGCC vows to protect Personal Information with the appropriate security measures, physical safeguards, and electronic precautions. EPGCC maintains Personal Information through a combination of paper and electronic files. Where required by law or disaster recovery/business continuity policies, older records may be stored in a secure location. The safety of Personal Information will be carried out by the following measure:

Access to Personal Information will be authorized only for employees and other agents of EPGCC who require the information to perform their job duties, and to those otherwise authorized by law;
EPGCC computer and network systems are secured by passwords. Only authorized employees may access secure systems and databases;
Active files are kept in locked filing cabinets;
Routers and servers connected to the internet are protected by firewall through virtual private network, and are further protected by virus attacks or “outside observation” by sufficient and up-to[1]date software solutions; and
Personal Information is not transferred to volunteers, casual staff, or other non-paid staff by email or any other electronic format.

EPGCC Website will include this Privacy Policy and disclose our Personal Information Practices. Individual inputting data into the Website will be notified of:

Personal Information that can identify any individual person (“personal identifiable information”) that is collected from the Website or through affiliated sites;
Information about the EPGCC collecting the data;
How the data will be used;
With whom the data may or may not be disclosed;
What options are available to the individual regarding the collection, use, and disclosure of Personal Information; to
The information technology security procedures in place that protect against the destruction, loss, theft, alteration, or misuse of Personal Information under EPGCC possession and control;
How the individual may access and correct any inaccuracies in his/her Personal Information;
While IP addresses will be logged in order to administer the site, track visitor movement, and gather demographic information, these IP addresses will not be linked to any personally identifiable information; EPGCC does not collect any personal identifiable information from any individual known to be under the age of 13 years;
EPGCC may share compiled demographic information with its business partners and/or advertising agencies, but no personally identifiable information shall be disclosed;
EPGCC website may contain links to external sites, but is not responsible for the privacy practices of other organizations’ sites;
Any registration or order form asking site visitors to enter personal or financial information will be protected by SSL encryption; and
Site visitors are given the choice to opt out of having their personal information used at the point where information is gathered.

EPGCC will make efforts to ensure the accuracy of the Personal Information recorded/collected. However, EPGCC relies on individuals to notify EPGCC in writing if there is a change to their Personal Information.
In most instances, EPGCC will grant individuals access to their personal information up presentation of a written request and satisfactory identification to the Privacy Officer. Should the EPGCC deny the individual’s request for access to his/her Personal Information (i.e. where the information cannot be severed and is protected by legal privilege, the information was collected for an investigation or legal proceeding, where the information could reasonably be expected to threaten the life or security of another individual, or if it would reveal the identity of an individual who has provided an opinion in confidence and that individual does not consent to its disclosure), EPGCC will advise in writing of the reason for such a refusal. The individual may then challenge the decision through an internal review/grievance process and if still unresolved it may be brought to the attention of the Office of the Information and Privacy Commissioner for Alberta, if necessary.
If an individual finds errors of fact with his/her Personal Information, the EPGCC should be notified in writing as soon as possible of the request to make correction(s). EPGCC will correct, where appropriate, the information as soon as reasonable possible, and if the organization has disclosed incorrect information to other organizations, the EPGCC will send a notification containing the corrected information to each organization to which the incorrect information has been disclosed, if it is reasonable to do so. If, despite the request for correction, EPGCC decides that no factual error or omission exists, the request will be documented nonetheless.
EPGCC will respond to an individual seeking to access or correct Personal Information within 45 days from the day that the EPGCC has received the written request. In certain situations, this time period can be extended 30 days (or longer with permission of the Information and Privacy Commissioner of Alberta) and the individual will be notified of the extension and the reason(s) for such.
Any questions or concerns regarding this Privacy Policy, any other privacy policy or procedure implemented by EPGCC or any other privacy issue can be directed to the Privacy Officer or by contacting, EPGCC at (780) 470-0070. The Privacy Officer will investigate and respond to any concern regarding the handling of Personal Information by EPGCC. If the Privacy Officer is unable to resolve the concern, the EPGCC internal review/grievance process may be utilized. After EPGCC has issued a decision, a request for review of an EPGCC decision relating to Personal Information matters may be also make to the Office of the Information and Privacy Commissioner of Alberta, if necessary.
In the case of a privacy breach (where there is an unauthorized access to, collection, use, disclosure, retention or destruction of Personal Information) EPGCC will respond as quickly as possible upon notice. EPGCC will first use its best efforts to stop the privacy breach from continuing. The Privacy Officer will then conduct an investigation to determine the source and make recommendation(s). The individual(s) whose Personal Information has been affected, will be contacted and it will also be reported to the Office of the Information and Privacy Commissioner of Alberta. Police may be notified if there is a possible criminal infraction such as theft. Other bodies that may be notified include insurers, professional or other regulatory bodies involved, and credit card companies and/or other credit reporting agencies.
EPGCC will, to the best of its ability, train all of its employees in the application of Alberta’s Personal Information Protection Act, this Privacy Policy and other privacy policies and procedures implemented by EPGCC.
Copies of this Privacy Policy are readily available at the EPGCC and copies can be provided upon request. A copy of the Alberta Personal Information Protection Act can also be found through the Alberta Queen’s Printer website at www.qp.alberta.ca