Privacy and Project Information Policy
1. About this Policy
The Nonprofit Data Capacity Navigator Initiative (the “Initiative”) helps nonprofit organizations understand their data needs and access self-guided assessments, curated resources, cohort-based supports, and tailored advice from nonprofit data and technology experts.
This Policy applies to nonprofit organizations participating in the Initiative, their authorized representatives, Data Capacity Advisors, cohort participants, project partners, and other individuals who interact with the Initiative through its website, assessments, forms, surveys, interviews, focus groups, advisory services, and related activities.
The Initiative is delivered collaboratively by Blueprint-ADE (“Blueprint”), Purpose Analytics, the Canadian Centre for Nonprofit Digital Resilience (“CCNDR”), PolicyWise for Children & Families (“PolicyWise”), and the Tamarack Institute. Together, these organizations are referred to in this Policy as the “Project Partners.”
2. Key Definitions
| Term | Meaning |
|---|---|
| Participant | A nonprofit organization that has agreed to participate in the Initiative. One or more individuals may act on the organization’s behalf, but the Participant is the organization as a whole. |
| Authorized Representative | An individual who provides information, completes project activities, or communicates with the Initiative on behalf of a Participant. |
| Personal Information | Information about an identifiable individual. In this Initiative, this generally includes a representative’s name, title, email address, communications, survey responses, and opinions or comments that can be linked to that individual. |
| Project Information | Information collected, created, or generated through the Initiative that is not Personal Information. This includes organizational information, assessment responses, service-delivery records, case-management records, project participation information, evaluation findings, and project administration records. |
| Data Maturity Assessment (DMA) | The organizational data-capacity assessment administered by Data Orchard CIC (“Data Orchard”). |
| Data Capacity Advisor (DCA) | An organization or authorized individual providing tailored data-capacity advice and support to participating nonprofit organizations. |
| Softr | The Initiative’s customer relationship management and case-management platform used to support service delivery, project administration, progress tracking, case notes, governance, monitoring, and reporting. |
| Qualtrics | The survey platform used to administer project forms and questionnaires, including intake, feedback, and reflection surveys. |
3. Information We Collect
The Initiative collects a limited amount of Personal Information and a broader range of Project Information about participating organizations and project delivery.
3.1 Personal Information
Personal Information collected through the Initiative may include:
- the name, job title, role, email address, of an Authorized Representative;
- survey or interview responses that can be linked to an identifiable individual;
- opinions, observations, or comments about an identifiable individual contained in case notes, open-text responses, or project communications; and
3.2 Service Delivery Project Information
Project Information includes, but is not limited to, the following record types:
| Record type | Examples |
|---|---|
| Organizational information | Organization name, website, charitable status or number, service area, sector, budget range, funding sources, staffing and volunteer levels, governance characteristics, and whether the organization serves or is led by particular communities. |
| Data-capacity and support information | Data needs, challenges, priorities, current practices, systems and tools, readiness, barriers, desired supports, and DMA responses and results. |
| Case-management and service-delivery records | DCA case notes, recommendations, referrals, action items, progress updates, follow-up records, and communications required to provide support. |
| Project participation and evaluation information | Cohort participation, engagement status, milestones, satisfaction ratings, outcomes, lessons learned, feedback, and synthesized findings from interviews or focus groups. |
| Governance and administration records | Dashboards, project reports, operational records, meeting materials, implementation updates, risk information, and other records required to manage and oversee the Initiative. |
4. How Information Is Collected and Managed
Information is collected directly from Authorized Representatives, DCAs, cohort delivery partners, and other project partners through service delivery, project administration, evaluation, and governance activities.
| Collection channel | How it is used |
|---|---|
| Qualtrics | Collects project forms and surveys, including intake, feedback, and reflection instruments. Individual responses are transferred or made available for project administration and service delivery. |
| Softr | Acts as the Initiative’s CRM and case-management system. It contains organization profiles, individual responses from Qualtrics, non-anonymized DMA information used for service delivery, DCA and cohort case records, progress information, dashboards, and related operational records. |
| Data Orchard | Administers the DMA under its own privacy policy and contractual arrangements with Blueprint. Data Orchard discloses DMA information for approved Initiative purposes. Blueprint and Purpose Analytics may have direct access to raw DMA data where required by their approved responsibilities. While Project Partners and DCAs can access individual DMA information through Softr for the purposes of service delivery. |
| Meetings and qualitative activities | Information may be collected through emails, virtual meetings, interviews, focus groups, workshops, and advisory or cohort activities. Qualitative findings are generally shared with Project Partners in synthesized form. |
5. Why We Use Information
5.1 Personal Information
- to communicate with Participants and their representatives;
- to administer registration, scheduling, reminders, and service delivery;
- to match Participants with appropriate supports, DCAs, or cohort opportunities;
- to respond to questions, requests, complaints, or privacy concerns;
- to conduct project evaluation and follow-up activities; and
- to contact individuals about future engagement only where they have asked or agreed to be contacted.
5.2 Service Delivery Project Information
- to assess organizational data needs and maturity;
- to tailor DCA, cohort, self-service, and referral supports;
- to document service delivery, case management, progress, and outcomes;
- to administer, monitor, evaluate, and improve the Initiative;
- to support Governance Committee oversight and project reporting;
- to produce anonymized, aggregated, or synthesized sector-level findings; and
- to support an approved longitudinal study after project delivery using anonymized data.
6. Access to and Sharing of Information
6.1 Personal Information
Personal Information is available only to authorized project partners who require it for an approved Initiative purpose. Depending on the activity, this may include Blueprint staff, designated staff of Purpose Analytics, PolicyWise, CCNDR, the assigned DCA or cohort delivery team supporting the Initiative.
Contact information and linked survey responses will be shared with an assigned DCA or cohort delivery partner when needed to provide the requested support. Personal Information is not disclosed publicly and is not shared for unrelated marketing or commercial purposes without consent, unless disclosure is required or permitted by law.
6.2 Service Delivery Project Information
Project Partners may have technical or administrative access to Project Information in Softr. Technical access does not authorize unrestricted use. Each Project Partner may use Project Information only for its approved Initiative responsibilities.
- Purpose Analytics and PolicyWise may create and use organization-specific records for their approved DCA responsibilities. PolicyWise may also collect and use information arising from its separate cohort-delivery responsibilities.
- Purpose Analytics may manage raw DMA data received from Data Orchard where required by its approved responsibilities. Other authorized Project Partners may access non-anonymized DMA information made available through Softr for approved service-delivery or governance purposes.
- CCNDR may have administrative access to Softr because of its platform, website, and governance, but it is not expected to routinely use organization-specific information for DCA or cohort delivery.
- Qualitative information from interviews, focus groups, and similar activities is generally shared with Project Partners and the Governance Committee in synthesized form.
- Public reports, communications, and knowledge-mobilization products use anonymized, aggregated, or synthesized information. An individual or organization will not be identified publicly without appropriate authorization.
- Third-party service providers serving as Data Capacity Advisors may use Personal Information and Project Information only as necessary to provide services to the Initiative and are expected to use appropriate privacy, confidentiality, and security safeguards.
7. Storage and Security
Personal Information and Project Information may be stored in approved cloud-based systems and organizational storage environments used for surveys, CRM and case management, assessment administration, communications, scheduling, reporting, and project administration. These systems may include Qualtrics, Softr, Data Orchard systems, scheduling and automation tools, and approved organizational cloud storage.
7.1 Personal Information safeguards
The following safeguards are in place for personal data collected and managed through the Initiative.
- role-based access and account controls;
- limiting access to authorized personnel;
- secure transmission and storage practices;
- confidentiality expectations and privacy procedures; and
- incident response and breach-management processes.
7.2 Service Delivery Project Information safeguards
Project Information may not be personal information, but it can still be confidential, commercially sensitive, or capable of identifying a Participant organization. The Initiative therefore applies reasonable access, confidentiality, security, and data-minimization controls to Project Information as well as Personal Information.
No electronic storage or transmission method can be guaranteed to be completely secure. The Initiative nevertheless takes reasonable steps appropriate to the nature and sensitivity of the information.
8. Retention, Access Removal, and Disposal
Information is retained only for as long as necessary for the purpose for which it was collected or created, subject to legal, contractual, funding, audit, and records-management requirements.
8.1 Personal Information
Personal Information is retained only while needed for communication, service delivery, follow-up, evaluation, complaint handling, or another identified purpose. Contact information used for future engagement will be retained only where the individual has agreed to be contacted or where another lawful basis applies. When no longer required, Personal Information will be securely deleted, destroyed, de-identified, or separated from retained Project Information, as appropriate.
8.2 Service-delivery Project Information
Authorization to use disaggregated, non-anonymized, or organization-specific Project Information for DCA services, cohort delivery, or another approved service ends when the relevant service or engagement is completed. At that time, the organization providing the service will stop using the information for that service and securely destroy or return locally retained copies unless retention is legally or contractually required or approved in writing. Continued technical access to Softr for another role does not authorize continued use for a completed service.
8.3 Governance and project-delivery Project Information
Aggregated, de-identified, synthesized, or project-level information used for governance, delivery, monitoring, evaluation, and reporting may be retained until the end of project delivery, unless an earlier date applies.
8.4 End of project and Future use for research purposes
Access to Softr will be removed when the Initiative ends or when a Project Partner’s or DCA’s participation ends, whichever occurs first. Summary analysis will be maintained after the end of the project by Project Partners and the Project Partners reserve the right to use the data for research purposes after project end.
Raw DMA information retained or managed by Blueprint, Purpose Analytics, or Data Orchard remains subject to the applicable Data Orchard privacy policy and contractual arrangements. Anonymized Data Maturity Data will be used for future data analysis by Project Partners.
9. Consent, Organizational Authorization
9.1 Personal Information
Participation is voluntary. By submitting Personal Information, an individual agrees to its collection, use, and sharing as described in this Policy and in any collection, notice presented at the time the information is requested. Consent may be withdrawn by contacting the Initiative, subject to legal, contractual, operational, and record-keeping limitations. Withdrawal may affect the Initiative’s ability to provide a requested service; the Initiative will explain this where applicable.
9.2 Service Delivery Project Information and Organizational Authorization
An Authorized Representative who provides Project Information confirms that they are authorized to provide that information on behalf of the Participant organization. Participants should not provide information about clients, service users, employees, or other individuals unless it is necessary, authorized, and appropriate for the Initiative.
A Participant may ask to correct inaccurate organizational information or request that the Initiative stop using information for a particular optional activity. Some information may need to be retained for contractual, legal, audit, evaluation, or project-integrity purposes, and information already anonymized or included in aggregate analysis may not be capable of removal.
10. Access and Correction Requests
Individuals may request access to or correction of their Personal Information held by the Initiative, subject to applicable limitations. Participant organizations may request correction of inaccurate Project Information about their organization. Requests should be directed to the contact listed at the end of this Policy.
11. Privacy and Security Incidents
11.1 Incidents involving Personal Information
The Initiative will assess, contain, investigate, document, and respond to any actual or suspected unauthorized access, use, disclosure, alteration, loss, or destruction of Personal Information. Affected individuals and regulators will be notified where required by applicable law or where notification is otherwise appropriate based on the risk of harm.
11.2 Incidents involving Project Information
Incidents involving confidential or organization-specific Project Information will also be assessed, contained, investigated, and addressed. Affected Participant organizations or Project Partners may be notified where appropriate, even where the incident does not involve Personal Information.
Project Partners and service providers are expected to promptly report suspected incidents and cooperate with the Initiative’s breach-response process.
11.3 Incidents involving Data Maturity Assessment Information
Incidents involving Data Maturity Assessment data specifically are governed by Data Orchard's own privacy policy and Data Orchard's contractual obligations to Blueprint, rather than by Section 11 of this Policy. Data Orchard is contractually required to notify Blueprint/the Project Partners promptly of any incident affecting DMA data, and the Initiative will then apply this Policy's incident process.
12. Privacy Standards and Legal Requirements
The Initiative aims to follow recognized Canadian privacy principles, including accountability, identifying purposes, consent where appropriate, limiting collection, limiting use and retention, safeguards, openness, individual access, and complaint handling. The Project Partners will comply with privacy, confidentiality, electronic communication, and data-protection requirements that apply to their activities.
The Initiative is committed to protecting Personal Information and Project Information in accordance with applicable Canadian privacy laws and recognized privacy best practices. Where applicable, the Initiative follows the principles set out in the Personal Information Protection and Electronic Documents Act (PIPEDA) and complies with Canada's Anti-Spam Legislation (CASL) for electronic communications and provincial privacy legislation where appropriate.
13. Policy Updates
This Privacy Policy may be updated from time to time to reflect changes to the Initiative, project partners, systems, applicable legal requirements, or information management practices. The most current version will be available on the Initiative website and will indicate the date it was last updated. Where appropriate, participants may also be notified of material changes.
14. Contact and Complaints
If you have any questions, requests, or concerns about this Privacy Policy or how your Personal Information or Project Information is collected, used, shared, or protected, please contact:
Blueprint-ADE
Privacy Contact: Alberta Johnson, Manager of Data Capacity
Email: [email protected]
Phone: 647-956-1408
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or another applicable privacy regulator.