Privacy Policy

1Who we are and what this policy covers

This policy applies to visitors, donors, newsletter subscribers, event registrants, program applicants and participants, partners, volunteers and job candidates in Canada and the United States.

Who “we” are. “AquaAction”, “we”, “us” and “our” mean:

• AquaAction (Canada), a registered Canadian charity (registration no. 79 333 5498 RR 0001), which is responsible for personal information collected through aquaaction.org and from people in Canada; and
• AquaAction, Inc. (US), a US tax-exempt organization (EIN 41-4457046), which is responsible for personal information collected through us.aquaaction.org and from people in the United States.

Where we refer to “the Websites”, we mean aquaaction.org, us.aquaaction.org, our program and event pages, and our donation pages.

What it covers. This policy covers information collected through the Websites, our online forms, our donation pages, our emails and newsletters, our events, and our programs (including AquaHacking, AquaEntrepreneur, AquaNation and the Water Literacy Project). Some programs may give you additional privacy notices at the time you apply; those notices add to this policy.

What it does not cover. Information about our own employees is handled under a separate internal policy. Websites and services run by others, including social media platforms, are governed by their own policies.

“Personal information” means information about an identifiable individual. It does not include information that has been de-identified or aggregated so that it can no longer reasonably identify you.

By using the Websites or giving us your information, you acknowledge that you have read this policy. Where the law requires your consent, we will ask for it as described below.

2Information we collect

We collect only the information we need for the purposes described in this policy. Most of it you give us directly.

Information you give us

You can choose not to give us information, but we may then be unable to provide the related service, such as processing a donation or reviewing an application.

Information collected automatically. When you use the Websites or open our emails, we and our service providers collect technical information through cookies, pixels and similar tools. This includes IP address, approximate location derived from it, device and browser type, pages viewed, links clicked, referring website, time spent, and whether you opened or clicked an email. See section 4.

Information from others. We may receive information about you from payment and donation platforms, event co-hosts and program partners, peer-to-peer fundraisers who give in your honour, and public sources such as professional websites. Social media platforms also provide us with aggregated reports on how our posts and campaigns perform.

Sensitive information. We do not ask for sensitive information such as health, financial or government identification details, except where needed for a specific purpose (for example, accessibility needs for an event) and with your express consent. Please do not send us sensitive information we have not asked for.

Payment card information. We do not receive or store your full card number. It is collected and processed directly by our payment processor (see section 5).

3How we use your information

We use personal information only for the purposes below, or for other purposes we tell you about when we collect it.

• Donations: to process gifts and recurring donations (including AquaHero monthly giving), issue tax receipts, send thank-you messages, and keep the records charities are legally required to keep.
• Communications: to send newsletters, updates, event invitations and fundraising appeals you have agreed to receive, and to respond to your questions.
• Programs and events: to register you, review and score applications, manage participation, connect participants with mentors, judges and partners, and report on outcomes.
• Relationships: to keep an accurate record of your interactions with us in our CRM, so we can communicate in a relevant way and avoid duplicate contact.
• Website and outreach: to operate and improve the Websites, understand how visitors use them, and measure how our social media posts and campaigns perform and how much traffic they bring to the Websites (section 4).
• Operations and compliance: to prevent fraud and misuse, secure our systems, meet legal, tax and audit obligations, respond to lawful requests, and protect our rights.
• Research and reporting: to produce statistics and impact reports using aggregated or de-identified information.

Consent. We ask for your consent when we collect your information, unless the law allows otherwise. Your consent may be express (for example, ticking a box to receive our newsletter) or implied where reasonable (for example, using your address to send a tax receipt after you donate). We do not use your information for a new purpose without your consent, unless the law permits it.

Email marketing. In Canada, we send commercial electronic messages only in accordance with Canada’s Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link, and we act on unsubscribe requests within 10 business days.

Automated decisions. We do not make decisions about you based solely on automated processing. Program applications are reviewed by people.

4Cookies, analytics and campaign measurement

We use cookies, pixels and similar technologies to run the Websites, understand how they are used, and measure how our posts and campaigns on social media perform. Non-essential cookies are used only with your consent, which you can give, refuse or change at any time through the cookie banner or the button below.

What measurement tools collect. These tools may record that a browser arrived from one of our posts or campaigns, which pages it visited, and whether it completed an action such as a sign-up or donation, along with device identifiers, IP address and browser information. We receive this as aggregated reports. The platforms (Meta, LinkedIn and Pinterest) may link this activity to your account on their service and use it under their own privacy policies. We set these tools so that they do not receive the content of form fields such as your name, email, address or donation amount, and we do not use them to infer sensitive characteristics about you.

Your choices.

• Refuse or withdraw consent for analytics and campaign measurement cookies through our cookie settings.
• We treat the Global Privacy Control (GPC) browser signal as a refusal of campaign measurement cookies.
• Adjust your browser settings to block or delete cookies, or use private browsing.
• Opt out of Google Analytics with the Google Analytics opt-out add-on.
• Control how each platform uses your activity on other websites through its own settings: Meta, LinkedIn and Pinterest.

Refusing analytics or measurement cookies does not prevent you from using the Websites, signing up or donating.

5Online donations

Online donations in Canada and the United States are collected through FundraiseUp, our donation platform, and processed by Stripe, our payment processor.

• Your card or bank details go directly to Stripe over an encrypted connection. AquaAction never sees or stores your full card number; we receive only limited details such as card type, the last four digits and expiry date to help manage recurring gifts and answer your questions.
• FundraiseUp shares your name, contact details and donation details with us so we can issue receipts and thank you. This information is synced to our CRM (HubSpot).
• Stripe and FundraiseUp use fraud-prevention tools that may analyze device and transaction data. They process payment information under their own privacy policies: FundraiseUp and Stripe. Stripe acts as an independent party for some purposes, such as meeting its own legal and anti-fraud obligations.
• Gifts to AquaAction (Canada) are receipted under Canadian tax law. Gifts to AquaAction, Inc. are receipted under US tax law. The organization named on your receipt is responsible for that donation record.
• You can update, pause or cancel a recurring donation at any time through the donor portal link in your receipt email or by contacting us (section 11).

We keep donation records for the period required by tax law (see section 8). We do not sell, rent or trade donor lists.

6How we share information

We do not sell your personal information for money. We share it only as described below.

• Between AquaAction organizations. AquaAction (Canada) and AquaAction, Inc. share information with each other to run joint programs (such as binational AquaHacking and AquaEntrepreneur), manage our shared CRM and avoid duplicate contact.
• Service providers. We use trusted providers that act on our behalf and may only use your information to provide services to us, under contracts with confidentiality and security obligations. These include website hosting, CRM, forms and email (HubSpot), donation processing (FundraiseUp, Stripe), analytics (Google), cloud storage and productivity tools, and our accountants, auditors and legal advisers.
• Analytics and social media platforms. As described in section 4, and only with your consent where required, Google, Meta, LinkedIn and Pinterest receive information through cookies and pixels. We use this only to measure our campaigns and website traffic; we do not display ads on the Websites. If a US state law treats this as a “sale” or “sharing” of personal information, you can opt out at any time through our cookie settings or with the Global Privacy Control signal.
• Program partners. If you apply to or take part in a program, we may share relevant information with judges, mentors, funders and co-hosting partners who help deliver it. We tell you about this in the program application. We share CVs or business plans with outside advisers only with your consent.
• Public recognition. We may name donors, participants or winners in reports, on the Websites or on social media. You can ask to remain anonymous at any time.
• Legal reasons. We may disclose information when required by law, a court order or a government authority, or when needed to protect the rights, safety or property of AquaAction, our community or others.
• Organizational changes. If AquaAction merges with or transfers its activities to another charitable organization, personal information may be transferred to it, subject to this policy.

We may share aggregated or de-identified information that does not identify you, for example in impact reports.

7Where your information is stored

Your information may be stored and processed outside your province, state or country, including in the United States, Canada and the European Union. Our main service providers (HubSpot, FundraiseUp, Stripe, Google, Meta, LinkedIn and Pinterest) operate data centres in several countries.

When information is stored outside Canada or outside Quebec, it is subject to the laws of that place and may be accessible to its courts, law enforcement and national security authorities. Before transferring personal information outside Quebec, we assess whether it will receive adequate protection, as required by Quebec law, and we rely on written contracts that require our providers to protect it.

If you would like more information about our service providers outside Canada, contact our Privacy Officer (section 11).

8How long we keep it and how we protect it

Retention. We keep personal information only as long as needed for the purposes it was collected for, or as required by law. Then we securely destroy it or de-identify it.

Security. We use reasonable administrative, technical and physical safeguards suited to the sensitivity of the information. These include encrypted (TLS) connections, two-factor authentication on our systems, role-based access for staff, and confidentiality obligations for staff and service providers. Our staff receive training on protecting personal information.

No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your information. Please help by keeping any account credentials confidential and telling us right away if you suspect misuse.

Privacy incidents. If a privacy incident creates a risk of serious harm, we will notify affected individuals and the relevant authorities as required by law, including the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada and applicable US state authorities. We keep a register of incidents as required by law.

9Your rights and choices

You can make a request at any time by contacting our Privacy Officer (section 11). We respond within 30 days, or within the time required by the law that applies to you. We may need to verify your identity first, and we may refuse or limit a request where the law allows, for example to keep tax records. Requests are free, unless they are repetitive or excessive.

Everyone can ask us to:

• confirm whether we hold information about you and give you access to it;
• correct inaccurate or incomplete information;
• delete information we no longer need or are not required to keep;
• stop sending marketing emails (use the unsubscribe link or contact us);
• withdraw consent, subject to legal or contractual limits;
• not be publicly named as a donor or participant.

In Canada. Our practices follow the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and Quebec’s Act respecting the protection of personal information in the private sector. Quebec residents may also ask for their computerized information in a structured, commonly used technology format; ask to stop the dissemination of their information or have a hyperlink de-indexed where the law allows; and be informed when technology is used to profile or locate them. If you are not satisfied with our response, you may complain to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

In the United States. Some state privacy laws apply to nonprofit organizations. Where a state law applies to us and to you, you may have the right to:

• know what personal information we have collected about you and obtain a copy in a portable format;
• correct or delete it;
• opt out of the “sale” or “sharing” of personal information and of profiling, to the extent that law treats our campaign measurement tools as such;
• appeal our decision on your request by replying to our response; if we deny your appeal, you may contact your state Attorney General.

You may use an authorized agent to make a request where state law allows; we may ask for proof of authorization. We will not discriminate against you for exercising your rights.

Do Not Track. We honour the Global Privacy Control signal as described in section 4. Because there is no common standard for other “Do Not Track” signals, we do not respond to them.

10Other important information

Children and youth. The Websites are not directed to children under 13, and we do not knowingly collect personal information online from children under 13 in the United States. In Quebec, we do not collect information from a minor under 14 without the consent of a parent or guardian, unless the collection is clearly for the minor’s benefit. Where a program is open to youth, we collect only what is needed and ask for parental consent where required. If you believe a child has given us information without proper consent, contact us and we will delete it.

Links and social media. The Websites link to other sites and social media pages, and may embed content such as videos. We are not responsible for the content or privacy practices of those sites. When you interact with us on social media, the platform’s own privacy policy applies.

Information you make public. Content you post publicly, such as comments on our social media pages, may be seen and used by others. We are not responsible for how others use it.

Limitation of responsibility. To the extent permitted by law, AquaAction is not responsible for the privacy practices of independent third parties such as social media platforms, payment networks or sites linked from the Websites, or for unauthorized access to information that occurs despite our reasonable safeguards. Nothing in this policy limits any right you have that cannot be limited under applicable law.

Changes to this policy. We may update this policy to reflect changes in our activities, tools or the law. We will post the new version on the Websites with a new “Last updated” date. If we make a significant change, we will tell you through a notice on the Websites or by email before the change takes effect. If English and French versions differ, the version in the language you used to read it applies, except where Quebec law requires otherwise.

11Contact us

Our Privacy Officer is responsible for protecting personal information at AquaAction and handles all requests and complaints.

Please include your name, how to reach you, and a description of your request. If we cannot resolve your concern, you may contact the regulators listed in section 9.