Privacy Policy

1. Introduction

WITS Programs Foundation ("WITS Foundation," "we," "us," or "our") is a registered Canadian charity headquartered in Victoria, British Columbia. We develop and deliver evidence-based programs that help children and youth develop strategies for dealing with bullying, peer victimization, and social exclusion. Our programs include WITS, WITS LEADS, DIRE/MENTOR (French-language programs), Pink Shirt Day Canada, and WAIS to Belong.

We are committed to protecting the privacy and personal information of everyone who interacts with our organization, including educators, school administrators, parents, volunteers, donors, and website visitors.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

2. Scope

This policy applies to personal information collected through:

• Our websites, including witsprogram.ca, pinkshirtdaycanada.ca, wais.education, schools.witsprogram.ca, and maps.witsprogram.ca
• Our online store at witsprogram.ca/store/
• Program registration and subscription forms
• The WAIS to Belong pilot intake form
• Job applications and recruitment processes
• Event registrations (including through Pretix ticketing)
• Telephone inquiries via our phone support line
• Email correspondence with our staff
• The AI Educator Co-Pilot service (available to subscribed schools)

3. Personal Information We Collect

3.1 Information You Provide Directly

Depending on how you interact with us, we may collect:

• Contact information: name, email address, phone number, mailing address
• Professional information: school name, school district, job title, role
• Account information: username, password (encrypted), subscription status
• Payment information: processed by Stripe and PayPal; we do not store credit card numbers on our servers
• Order information: products purchased, order history, shipping address
• Application materials: resume, cover letter, references (for job applicants)
• Event registration details: name, email, dietary preferences, accessibility needs
• Form submissions: contact forms, survey responses, and program intake forms
• Communications: emails, phone call records, and support inquiries

3.2 Information Collected Automatically

When you visit our websites, we automatically collect:

• Technical information: IP address, browser type, operating system, device type
• Usage information: pages visited, time spent on pages, referring URL
• Cookie data: session cookies for website functionality; see Section 10

3.3 Information from Third-Party Sources

We may receive information from:

• School districts and provincial education departments (publicly available school registration data used for our school partner database)
• Payment processors (Stripe, PayPal) providing transaction confirmation

3.4 Information About Children

WITS programs serve children in Kindergarten through Grade 8 (approximately ages 5 to 14). However, we do not knowingly collect personal information directly from children. All program delivery is mediated through educators, school administrators, and parents. If we become aware that we have inadvertently collected personal information from a child without appropriate parental or guardian consent, we will delete that information promptly.

The AI Educator Co-Pilot generates lesson plans for educators. It does not interact with students, and no student-identifiable information is collected through the Co-Pilot service.

4. How We Use Your Personal Information

We use personal information for the following purposes:

• Program delivery: to administer our programs, manage school partnerships, and coordinate with educators
• Subscription services: to process subscriptions, manage access to gated content, and maintain subscriber accounts on schools.witsprogram.ca
• Online store: to process orders, arrange shipping, handle returns, and provide customer support
• AI Co-Pilot: to provide the AI Educator Co-Pilot service to subscribed and opted-in schools. Usage data (prompts submitted, outputs generated) is logged for quality assurance and audit purposes. This data is associated with the subscribing school, not individual students.
• Communications: to respond to inquiries, send program updates, and deliver transactional emails (order confirmations, subscription notices, password resets)
• Recruitment: to evaluate job applications and communicate with candidates
• Fundraising and events: to manage event registrations and communicate with supporters
• Website improvement: to analyze website usage patterns and improve our services
• Legal compliance: to comply with legal obligations, including tax reporting for charitable donations and CRA requirements

5. Consent

We obtain your consent before collecting, using, or disclosing your personal information. Consent may be:

• Express: you actively provide consent through a checkbox, signature, or verbal agreement (for example, when subscribing to our email list or submitting a program registration form)
• Implied: your consent is implied by your actions (for example, when you provide your email address to place an order, we use it to send order confirmations)

You may withdraw your consent at any time by contacting us at the details provided in Section 13. Withdrawal of consent may affect our ability to provide certain services to you. For email communications, you may also use the unsubscribe link included in every email.

6. When We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information with the following categories of recipients:

6.1 Service Providers

6.2 Legal Requirements

We may disclose personal information when required by law, court order, or regulatory requirement, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

6.3 Grant Reporting

We may share aggregate, de-identified program data with our funders (including Heritage Canada and CIRA) as required by grant agreements. This data does not include personal information about individual educators, schools, or students.

7. Where Your Information Is Stored

We host our primary infrastructure on self-managed servers located in Victoria, British Columbia, Canada. AI processing services are hosted on Microsoft Azure in the Canada East region (Montreal). Your personal information remains in Canada except where a third-party service provider listed in Section 6.1 processes data in accordance with their own privacy policies.

Brevo (Sendinblue) processes email data on infrastructure based in the European Union, which has privacy protections that are comparable to Canadian standards.

8. How Long We Keep Your Information

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our retention periods include:

When personal information is no longer needed, it is securely deleted from our systems.

9. How We Protect Your Information

We implement reasonable technical, administrative, and physical safeguards to protect your personal information, including:

• Encryption of data in transit using HTTPS (TLS 1.2+)
• Secure credential management using a self-hosted secrets management platform
• Access controls limiting personal information access to authorized staff on a need-to-know basis
• Regular security monitoring of our infrastructure
• Self-hosted infrastructure under our direct physical and administrative control

No method of data transmission or storage is completely secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security.

10. Cookies and Tracking Technologies

Our websites use cookies for the following purposes:

• Essential cookies: required for website functionality, such as maintaining your login session and shopping cart
• Analytics cookies: used to understand how visitors use our websites so we can improve the user experience

We do not use cookies for advertising or behavioral tracking. You can control cookies through your browser settings. Disabling essential cookies may affect website functionality.

11. Your Rights

Under PIPEDA and PIPA BC, you have the right to:

• Access your personal information: you may request a copy of the personal information we hold about you
• Correct your information: you may request correction of any inaccurate or incomplete personal information
• Withdraw consent: you may withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions
• File a complaint: if you are not satisfied with our handling of your personal information, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner of British Columbia (oipc.bc.ca)

We will respond to access and correction requests within 30 calendar days. There is no fee for making a request.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will post the updated policy on our website with a revised “Last Updated” date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or want to file a complaint about our privacy practices, please contact us at:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or the Office of the Information and Privacy Commissioner of British Columbia (oipc.bc.ca, 250-387-5629).