Privacy Policy

This privacy policy (the “Policy”) sets out how Birthright Israel Foundation of Canada (“BRIFC”, “us”, “we” and “our”) collect, hold, use or communicate to third parties Personal Information (as defined hereinafter) of visitors or users (individually “you” and “your”) of our website (the “Website”), other than our employees or contracted staff, which is dealt with separately.

Introduction

BRIFC raises funds in Canada to send Jewish Canadian young adults on the Birthright Israel program.

We are committed to treating any Personal Information we collect, hold, use or communicate with care, within the limits of this Policy and applicable law.

Please read this Policy carefully, as it applies to you. By accessing and using our Website, you agree to be bound by this Policy. If you do not agree with any or all of the provisions hereof, please do not access or use our Website.

Types of Personal Information

This Policy applies to Personal Information regardless of the type of medium or the form in which it is accessible: written, graphic, sound, visual, taped, filmed, computerized, or others.

We define “Personal Information” as any information about an identifiable individual, which alone or when combined with other data, allows an individual to be identified. By way of illustration, Personal Information could consist of, but is not limited to:

• first and last name;
• date of birth;
• phone, home address and email address;
• preferred language;
• time zone;
• financial, credit, billing, and account information;
• authentication credentials and account identifiers, where applicable;
• details about the use of a website obtained by means of cookies or similar tools;
• Internet protocol (IP) address, browser type, locale preferences, mobile carrier; and
• any other information which allows for the identification of the individual to whom it pertains.

The Purposes for which we Collect Personal Information

We collect Personal Information for the following purposes:

• to provide and maintain our Website;
• to create, manage, and administer user accounts;
• to develop, manage, and improve our business operations and platform functionality;
• to communicate with you regarding your account, transactions, updates, or support requests;
• for marketing and advertising purposes;
• for statistical purposes relating to the use of our Website;
• to improve our Website;
• to attend or manage requests to us;
• to comply with our legal, regulatory and risk management obligations;
• to evaluate employment applications where applicable;
• any purpose permitted or required by applicable laws; and
• any other purpose to which you have consented.

Means by which we Collect Personal Information

We primarily collect Personal Information directly from you when you interact with BRIFC, communicate with us, or submit information through our Website. We may also collect Personal Information from third party sources such as service providers, partners, social networks, or publicly available sources, where such collection is permitted by law and consistent with this Policy.

We additionally collect, passively using cookies, a limited amount of Personal Information from our Website users. Cookies are small text files or strings that a website can send to your device to identify your web browser and the activities of your computer. This mainly consists of IP address, type of operating system, pages visited, requests made, dates and times of connections. Cookies help us improve our Website.

We use both strictly necessary cookies, which are required for the Website to function properly, and optional cookies, such as analytics and marketing cookies, where permitted by law.

The use of cookies does not allow us or our analysis service providers to identify you specifically. Furthermore, it does not give us access to your device or any other information about you, other than the data you choose to share with us. The use of cookies can be accepted through the cookie banner displayed when entering our Website for the first time. You may also adjust your browser settings to manage or delete cookies at any time. Please note that if you choose not to accept cookies, you may not be able to access or fully experience the interactive features of our Website.

Outsourcing, Storage and Transfers of Personal Information

We may disclose the Personal Information we have collected to third parties in the following circumstances:

• to service providers in connection with the Website, including hosting, cloud storage, data processing, payment processing, analytics, marketing, and customer support;
• to comply with an applicable statute, regulation, rule of law, a subpoena, a search warrant, a court or regulatory order, lawful requests by public authorities, including to meet national security or law enforcement requirements, or other legal process;
• to allow us to enforce available recourses or limit the damages we may suffer;
• to protect the safety and/or security of the Website or the general public;
• in connection with a business transaction such as a merger, acquisition, financing, or sale of assets; and
• any other circumstances to which you have consented.

Personal Information may be stored or processed in jurisdictions outside your place of residence, including outside Quebec, Canada, the European Economic Area, the United Kingdom or the United States, where our service providers or partners may operate. In such cases, we implement appropriate contractual, technical, and organizational safeguards to ensure a level of protection consistent with applicable data protection laws, including standard contractual clauses or other recognized transfer mechanisms where required.

Your Consent under this Policy

We will not collect, hold, use or disclose your Personal Information without your consent unless it is authorized or required by applicable law.

By using our Website or by otherwise submitting your Personal Information to us, you consent to the collection, use and disclosure of your Personal Information to the extent described in this Policy and as required or permitted by applicable law.

If you provide Personal Information concerning another individual to us, you represent that, prior to submitting such Personal Information, you have obtained the necessary consent or authority to permit us to collect, use and disclose such Personal Information for the purposes set out in this Policy, or that the collection, use and disclosure is permitted by applicable law.

You may vary or withdraw your consent to the use and disclosure of your Personal Information, or opt-out of certain uses and disclosures, subject to legal and contractual restrictions as well as to applicable law. Please note that the withdrawal of your consent may prevent us from providing or continuing to provide access to our Website.

Email Marketing Communications

We may send you marketing and promotional emails. If you no longer want to receive such emails, you may click on the “unsubscribe” link in such emails to opt out of future marketing communications.

If you require any assistance in understanding the scope of the consent being sought or to vary or withdraw your consent, please contact our Privacy Officer using the contact information in the “How to Contact Us” section.

Your Rights

Canada

If you are a resident of Canada, or if Canadian privacy laws otherwise apply to you, the collection, use, and disclosure of your Personal Information are governed by applicable Canadian privacy laws, including the federal Personal Information Protection and Electronic Documents Act (also known as “PIPEDA”), and applicable provincial privacy legislation, including the Quebec Act Respecting the Protection of Personal Information in the Private Sector (also known as “Law 25”), the Alberta Personal Information Protection Act, and the British Columbia Personal Information Protection Act.

You have the following rights regarding your Personal Information:

• to access and request an exported or physical copy of the documents containing your Personal Information, subject to the exceptions provided by applicable law;
• to have the Personal Information we have about you rectified, amended and updated if it is incomplete, ambiguous, out of date or inaccurate;
• to request the deletion of your Personal Information when: i) the retention of the information is no longer justified for the purpose for which it was collected and/or if you are a Quebec resident; ii) the information was not collected in a lawful manner; and/or iii) it is obsolete; and
• to withdraw or change your consent to our processing of your Personal Information, subject to applicable legal and contractual restrictions. In some instances, withdrawing your consent may result in us no longer being able to provide access to our Website.

We may request certain Personal Information for the purpose of verifying the identity of the person seeking to exercise their rights.

European Economic Area and United Kingdom

If the processing of your Personal Information is subject to the EU General Data Protection Regulation 2016/679 (also known as “EU GDPR”) or the United Kingdom General Data Protection Regulation (also known as “UK GDPR”), this subsection applies to you.

Our lawful bases for processing Personal Information may include where:

• you have given consent;
• processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract;
• processing is necessary for our legitimate interests or those of a third party, except where such interests are overridden by your rights;
• processing is necessary to comply with a legal obligation; or
• processing is necessary to protect vital interests of an individual.

In addition to the rights described above, you may also have the right to object to certain processing, request restriction of processing, request data portability, and lodge a complaint with a competent supervisory authority.

United States

Certain United States state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act, may provide individuals with additional rights regarding Personal Information. This subsection applies to you to the extent such laws apply to you, whether or not you are a resident of the applicable state, including under laws in states such as California and other jurisdictions that have enacted comprehensive privacy legislation.

Subject to applicable law, you may have the right to:

• access or request information about the Personal Information we collect, use, or disclose;
• request correction of inaccurate Personal Information;
• request deletion of Personal Information;
• obtain a copy of Personal Information in a portable format;
• opt out of certain processing, which may include targeted advertising, profiling, or the sale or sharing of Personal Information as defined by applicable law; and
• not be discriminated against for exercising your rights.

California residents may also have rights under California Civil Code section 1798.83 (also known as “Shine the Light Law”) regarding certain disclosures of Personal Information for direct marketing purposes.

In certain states, you may have the right to appeal our decision if we deny a request, and we will provide information on how to appeal where required.

Requests to exercise rights may be submitted using the contact information provided in this Policy. We may take reasonable steps to verify your identity before fulfilling a request, and authorized agents may submit requests where permitted by law.

How we Safeguard Personal Information

In order to protect the Personal Information that is in our possession, we employ administrative, physical, and technological safeguards which are appropriate to the sensitivity of the Personal Information provided. These safeguards also prevent the accidental or unlawful destruction, loss, unauthorized alteration or disclosure, access, or misuse of the Personal Information in our possession. We follow generally accepted industry standards to protect the information that is provided during its submission and once it has been received. These include measures to deal with any suspected data breach.

Once communicated, the Personal Information is kept in an electronic file within our document management system or third-party technologies used by us, or both. Only those personnel who reasonably require the Personal Information to perform their duties are granted access to the information and they are bound by a duty of confidentiality. In the event of a data breach involving your Personal Information, BRIFC will notify affected individuals and relevant authorities in accordance with applicable laws.

It is important to note that, despite our best efforts to protect your Personal Information, there is a risk associated with the communication, exchange and storage of information, as no form of electronic transmission or storage is perfectly secure. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, YOU UNDERSTAND AND AGREE THAT BRIFC ASSUMES NO RESPONSIBILITY FOR THE DESTRUCTION, LOSS, UNAUTHORIZED ACCESS, DISCLOSURE, OR ALTERATION OF YOUR PERSONAL INFORMATION, NOR FOR ANY DAMAGES THAT MAY RESULT THEREFROM AND FROM WHICH YOU HEREBY HOLD BRIFC HARMLESS.

Links to Third-party Websites

Our Website may contain links to third-party websites or services that are not owned or controlled by BRIFC. This Policy only applies to information collected by us for the purposes mentioned in the “Purposes for which we Collect Personal Information” section. We have no control over these third-party websites, and your use of third-party websites and features are subject to privacy policies posted on those websites. We are not responsible or liable for the privacy or business practices of any third-party websites linked to our Website.

Personal Information of Children and Minors

Our Website is not directed at or intended for use by children, nor do we knowingly collect Personal Information from children under the age of 14 in Quebec, under the age of 13 in other Canadian jurisdictions, or under such other age threshold as may apply in certain jurisdictions pursuant to applicable privacy laws. If you are a parent or guardian and become aware that your child has provided us with Personal Information without your consent, please contact our Privacy Officer using the contact information in the “How to Contact Us” section.

Retention and Destruction of Personal Information

The Personal Information we collect is retained for varying periods of time depending on the type of information in question and the purposes for which it is collected and used. Subject to a retention period provided for by applicable law, the Personal Information we hold is destroyed or anonymized once it is no longer necessary for the purposes for which it was collected or used, or for any subsequent compatible purpose.

We may de-identify or aggregate Personal Information so that it no longer identifies you. To the extent permitted by applicable law, we may use and disclose such de-identified or aggregated information for legitimate business purposes, including analytics, service improvement, the development of new features or services and statistical reporting.

How to Contact Us

In order to obtain more information on the Policy or the use of your Personal Information, to exercise your rights or to file a complaint, please contact our Privacy Officer at the following coordinates:

Changes to this Policy

We may update this Policy from time to time to reflect changes to our privacy practices or for other operational, legal, or regulatory reasons. Changes will take effect immediately upon posting on the Website or by otherwise notifying you. By continuing to access our Website, or submit Personal Information to us after such changes are posted or communicated, you agree to the revised Policy. It is your responsibility to review this Policy regularly.