Privacy Policy

Last updated: 18 August 2026. This Privacy Policy explains how the Canadian Canyoning Association / Association canadienne de canyonisme (“CCA,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information through https://www.canadacanyoning.ca (the “Site”), including public pages, forms, donations launched from the Site, and the staff administration area at /admin and /login.

Please read this policy together with our Terms of Use and Code of Conduct. This policy is provided for transparency. It is not legal advice. If you need certainty for your situation, consult qualified counsel.

Who we are

The CCA is a not-for-profit national organization incorporated in Canada in 2025. We support responsible canyoning practice, stewardship, safety collaboration, and community partnership. Contact: canyoningcanada@gmail.com.

Laws we aim to follow

We aim to handle personal information in a manner consistent with Canadian privacy law that may apply to our activities, including:

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), where our activities are commercial in nature (for example certain membership, donation, or service processes);
British Columbia's Personal Information Protection Act (PIPA), given that a substantial part of our volunteer board and operations is based in British Columbia;
Québec's Act respecting the protection of personal information in the private sector (Law 25), where we deal with personal information of Québec residents;
Canada's Anti-Spam Legislation (CASL) for commercial electronic messages we send, where that law applies.

We identify purposes for collection at or before collection, limit collection to what is reasonably required, and use or disclose information only in ways a reasonable person would consider appropriate in the circumstances.

Information we collect

Information you provide

Contact form: name, email, optional subject, and message.
Membership applications: name, email, optional WhatsApp or phone number, region or connection to canyoning, membership class, interests, Code of Conduct acknowledgement, and any other answers you submit. We generate a PDF copy of the application for Association records.
Donations: payment and tax-receipt details are collected by Zeffy on Zeffy's systems. We may receive your name, email, donation amount, and related confirmation so we can thank you and keep Association records.
Email: if you write to canyoningcanada@gmail.com or other Association addresses, we keep the correspondence needed to respond and administer the Association.

Staff and invited accounts

Staff administration is invitation-only. If a director or authorized volunteer is invited, we store an account identifier, email, optional display name, role (for example admin or editor), active/inactive status, login events, and audit logs of actions taken in the dashboard (calendar, news, applications, users, and similar).

The login pages at /login and /admin/login are reachable by the public so invited staff can sign in. We may record technical data about attempted sign-ins (including failed attempts) to protect the system. Visiting a login page does not create a staff account. We do not grant access to members of the public who submit credentials without an invitation.

Technical, security, and usage data

IP address, browser and device details, pages viewed, timestamps, referring URLs, and similar diagnostic data generated when you visit the Site.
Security logs, rate-limit signals, and error diagnostics used to operate and protect the Site.
Analytics and performance data described below, only after you accept analytics cookies.

Information we do not intentionally collect

We do not ask for government identification numbers, payment card numbers, or health information on this Site. Do not send sensitive information in public forms. If you include extra information in a message, we will treat it with care but cannot guarantee that a free text field is the right channel for highly sensitive data.

Purposes

Operate, maintain, and secure the Site and staff systems
Respond to inquiries and membership applications
Administer membership, volunteers, and Association records
Publish public calendar events, news, and development updates
Process or acknowledge donations in coordination with Zeffy
Measure Site performance and improve the Site after consent
Prevent fraud, abuse, and unauthorized access
Comply with legal obligations and lawful requests

We do not sell personal information. We do not use Site data for third-party advertising, retargeting, or cross-site marketing.

Consent

Depending on the activity, we rely on express consent (for example when you submit a form or accept analytics cookies), implied consent where the law allows (for example basic technical data needed to deliver a page you requested), or other lawful bases such as our legitimate need to secure the Site and comply with law.

You may withdraw consent for future collection, use, or disclosure where withdrawal is legally permitted, subject to reasonable notice and legal or contractual restrictions. Withdrawing consent may affect our ability to respond to you, process an application, or provide certain features. Use the contact details below, or Cookie preferences in the Site footer for analytics cookies.

Cookies and similar technologies

Essential cookies or local storage may be used for language preference (EN/FR), session authentication for invited staff, and remembering your analytics choice. These are needed for the Site to work as requested.

Analytics cookies and similar storage for Vercel Analytics, Vercel Speed Insights, and PostHog run only after you choose Accept on the cookie banner. If you Decline, those tools do not start. You can reopen Cookie preferences from the footer at any time.

If you use the EN | FR control, Google Translate may set additional cookies or process page text on Google's systems so the page can be translated. That processing is governed by Google's terms and privacy policy.

Service providers

We use processors that support hosting, database, authentication, email, donations, analytics, and security. They process information on our behalf for limited purposes. Providers may change as our infrastructure evolves. Current categories include:

Vercel, Inc. — hosting, deployment, Web Analytics, and Speed Insights (analytics after consent).
Supabase — database, authentication, and file storage for applications and staff records.
Resend — transactional email such as application confirmations and staff invitations.
Web3Forms — delivery of messages submitted through the public contact form.
PostHog, Inc. — product analytics after consent; not used for advertising.
Zeffy — donation forms and payment/tax-receipt processing. Zeffy's privacy policy and terms apply to data you enter on Zeffy.
Google — optional page translation if you select FR.

We may also disclose information where required or permitted by law, including to respond to lawful demands, enforce the Terms of Use, investigate security incidents, or protect the rights, safety, and security of the CCA, our volunteers, members, and the public.

International storage

The Site is used across Canada. Service providers may store or process information in Canada, the United States, or other countries. When information is processed outside your province or Canada, it may be subject to the laws and lawful access rules of that jurisdiction.

Retention and safeguards

We keep personal information only as long as needed for the purposes described here, including Association records, legal holds, and dispute resolution, then delete or de-identify it where practical. Membership applications, contact messages, donation acknowledgements, and audit logs may be kept for the life of related Association administration unless a shorter period is required or a longer period is legally necessary.

We apply reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including access controls for staff systems, encrypted transport, and audit logging. No method of transmission or storage is completely secure.

Staff systems and public login pages

Administration tools are for authorized directors and volunteers only. Accounts are created by invitation. Inactive or uninvited accounts cannot use the dashboard. The fact that a login form is visible on the public internet does not invite the public to attempt access.

We may log IP addresses, timestamps, user-agent data, and the outcome of authentication attempts. We may rate-limit, block, or report suspected unauthorized access, credential stuffing, or other abuse. Personal information in those logs is used for security, not marketing.

Photographs and search indexing

Public pages may be indexed by search engines. Photographs and similar media are not offered for Google Images or comparable image indexes where our technical controls allow (noimageindex, robots rules, and X-Robots-Tag on media). Social sharing previews may still use a designated Open Graph image. Images remain CCA brand assets; see the Terms of Use.

Children

The Site is intended for adults and for organizations. We do not knowingly collect personal information from children through Site forms. If you believe a child has submitted information, contact us so we can review and delete it where appropriate.

Your rights

Subject to applicable law and exceptions, you may request access to personal information we hold about you, information about how it has been used and to whom it has been disclosed, and correction of inaccurate information. We may need to verify your identity and may decline or limit requests where the law permits.

Québec residents may have additional rights under Law 25, including rights relating to de-indexation or data portability in the circumstances that law provides.

To make a privacy request, email canyoningcanada@gmail.com. If you are not satisfied after contacting us, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Information and Privacy Commissioner for British Columbia, the Commission d'accès à l'information du Québec, or another provincial or territorial commissioner with jurisdiction.

Third-party sites

The Site links to Instagram, Facebook, Zeffy, and other external sites. Their practices are governed by their own policies.

Changes

We may update this policy to reflect operational, legal, or technical changes. The revised version will be posted on this page with a new last-updated date. Continued use of the Site after an update constitutes notice of the revised policy. Material changes to how we handle personal information will be highlighted on this page where practical.

Contact

Canadian Canyoning Association
Association canadienne de canyonisme
canyoningcanada@gmail.com
Canada