Privacy policy

1. Who we are and what this covers

The Royal Canadian Legion Branch 370, Iroquois, of 24 Dundas St, Iroquois, Ontario K0E 1K0, telephone 613-652-4516, is responsible for the personal information described in this policy. Privacy enquiries reach us at privacy@legionbranch370.ca; the name of the executive member accountable for this file will be published here before the site goes live.

We apply the Personal Information Protection and Electronic Documents Act (PIPEDA) to this activity. Although non-profit organisations are often outside PIPEDA, selling raffle tickets is a commercial activity, so we do not rely on that exemption. Where a provincial rule gives you more protection than PIPEDA, the provincial rule applies.

This policy covers legionbranch370.ca and the branch's handling of information about supporters, members, enquirers and prize winners. It does not cover the separate websites we link to, including our raffle supplier's checkout, which publishes its own policy.

2. Our commitments

1. Accountability. One named person at the branch is answerable for personal information, including information we pass to a supplier.
2. Limiting collection. We ask for what the licence and the transaction require, and nothing else. There is no "tell us about yourself" field anywhere on this site.
3. Limiting use. Information collected to sell a ticket is used to sell that ticket, pay a prize and satisfy the regulator. It is not quietly repurposed for marketing.
4. Openness. This document is written to be read. If a passage is unclear, telephone the branch and we will explain it.

3. What we collect

This website itself collects very little. Almost all purchase information is collected by our licensed electronic raffle supplier on their own systems.

We do not collect information about your health, your finances beyond the transaction itself, your ethnic origin, your religion, or your veteran status through this website. If you contact the Service Officer at so@legionbranch370.ca, that correspondence is confidential to the Service Officer. It does not go to the general branch inbox, it is not linked to any raffle record, and it is not discussed at executive meetings without your agreement — see Veterans support.

4. Why we collect it

1. To verify that a purchaser is 18 or older and physically in Ontario, as the lottery licence requires.
2. To issue tickets and to identify and pay a winner.
3. To keep the audit trail the Alcohol and Gaming Commission of Ontario and the licensing municipality may inspect.
4. To answer enquiries about hall rentals, membership and veterans' support.
5. To meet our own record-keeping, accounting and reporting obligations.

We do not use personal information to build profiles, to score supporters by how much they spend, or to target advertising at people who have shown interest and not bought.

5. Consent

1. Buying a ticket requires you to give the information the licence demands; without it there is no lawful sale. Completing the purchase is your consent to that use.
2. Analytics and any marketing cookies run only after you accept them in the cookie banner. Declining changes nothing about your ability to use the site or buy a ticket.
3. Marketing email requires separate express consent, obtained at the point it is asked for, and never bundled into the purchase.
4. You can withdraw consent for anything that is not required by the licence at any time, by telephone or in writing. Withdrawal takes effect promptly and does not affect processing already carried out.

6. Who we share it with, and where it goes

1. Our electronic raffle supplier (TBC) acts as our processor for ticket sales and holds the purchase record on our behalf, under a written agreement requiring protection comparable to our own.
2. The AGCO and the licensing municipality, where disclosure is required by the licence terms or by law.
3. A payment processor engaged by the supplier, for the purpose of taking payment.
4. Google Fonts receives your IP address and browser headers when this site loads its typefaces, because the fonts are served from Google's servers. No cookie is set by that request and no account is involved, but the request itself leaves Canada. We treat this as a disclosure and name it here rather than leave it buried.
5. Where a service provider is outside Canada, your information may be subject to the laws of that country, including lawful access by its authorities. We name every such provider in this policy and in the Cookie Policy.
6. We do not sell, rent or trade personal information to anyone, ever. We do not share it with other Legion branches, with Command, or with any other charity for their own fundraising.

7. How long we keep it

When a retention period ends, records are destroyed or irreversibly anonymised.

8. How it is protected

1. Payment card data is handled by the supplier under PCI DSS. The branch never holds card numbers.
2. This website is served over HTTPS only, with HTTP requests redirected.
3. Branch volunteers are given access to enquiry messages on a need-to-know basis, and access ends when the role ends.
4. Paper records — claim forms, the membership roll — are held at the branch in a locked cabinet.
5. No safeguard is perfect. We do not claim this site or any system is unbreakable, and we say what we would do if something went wrong — see clause 13.

9. Information stored in your own browser

Some things are stored on your device rather than sent to us. We never see them.

1. Your 18+ acknowledgement, so you are not asked on every page. Stored for 30 days.
2. Your cookie choices, so they are honoured on your next visit.
3. The Branch Office demonstration portal at /login.html stores its simulated accounts, session and sample records entirely in your browser's local storage. It has no server, no database and no real member information. Clearing your browser data removes it completely.

You can delete all of it at any time by clearing site data for legionbranch370.ca in your browser settings.

10. Cookies and analytics

Analytics load only after you accept the analytics category. Categories, named third parties, durations and how to change your mind are set out in the Cookie Policy. You can reopen the consent panel from the link in the footer of any page.

11. Email and CASL

We will send commercial electronic messages — draw reminders, branch news — only where you have given consent, and every message will carry an unsubscribe link that works and is honoured within ten business days. Every message identifies the branch and gives a postal address and telephone number.

We do not rely on the registered-charity exemption under Canada's Anti-Spam Legislation, both because ticket-sale messaging is commercial and because Branch 370 is not currently a CRA-registered charity. We do not buy mailing lists and we do not add people to a list because they once entered a draw.

12. Children

This site is for adults. Tickets may not be sold to anyone under 18, and we do not knowingly collect personal information from anyone under 18. A visitor who tells the age gate they are under 18 is taken to a page with no raffle content on it. If you believe a child has given us information, telephone the branch and we will delete it.

13. If something goes wrong

1. If personal information in our control is lost or accessed without authorisation, we assess whether the breach creates a real risk of significant harm.
2. Where it does, we report it to the Office of the Privacy Commissioner of Canada and notify the affected people directly, as soon as feasible, telling them what happened and what to do about it.
3. We keep a record of every breach, whether or not it was reportable.
4. Where the breach happened at our supplier, we require them to tell us without delay, and we notify you ourselves rather than leaving it to them.

14. Your rights and how to use them

1. You may ask what personal information we hold about you, what we have used it for, and to whom it has been disclosed.
2. You may ask us to correct information that is wrong or incomplete. If we disagree, we record your objection alongside the record.
3. You may withdraw consent for marketing email at any time, and for anything else not required by the lottery licence.
4. Write to the branch at 24 Dundas St, Iroquois, Ontario K0E 1K0, or telephone 613-652-4516. There is no charge for a request. We will respond within 30 days.
5. We may ask you to confirm your identity before releasing information, to make sure we are not giving your details to someone else.
6. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. You do not have to go through us first.

15. Changes to this policy

Material changes are published here with a new version number and date. Where a change affects how information already collected is used, we ask for consent again rather than assume it. Previous versions are available on request.

16. Contact

Privacy questions: email privacy@legionbranch370.ca, telephone 613-652-4516, write to 24 Dundas St, Iroquois, Ontario K0E 1K0, or use the contact page. The name of the accountable executive member will be added here once confirmed — TBC.