What we collect, and what we don’t

Who we are and what this policy covers

HarmonYouth Foundation is a student-run, non-profit organisation based in Calgary, Alberta, Canada. We:

• bring live musical performances to senior homes and care facilities; and
• organise assistive-device build meetings for people with disabilities.

Our website includes pages and features relating to Home, Mission, Programs, Performances, Photos, Build Meets, Meet the Team, Get Involved, Donate, this Privacy Policy, and the website’s 404 or “page not found” function.

The website also includes:

• performance and build-meeting schedules;
• photo galleries;
• volunteer information;
• three Formspree forms on the Get Involved page;
• donation information and GoFundMe widget or QR-code routes;
• a WeChat contact route;
• a link to our Instagram account; and
• a light/dark colour-mode preference.

This policy applies to personal information that HarmonYouth Foundation collects through the website, through related email or telephone communications, during program registration, and through written participation or photo-consent processes.

Third-party platforms have their own privacy practices. Section 08 explains which outside services we use and what information they may receive.

Information we collect

We collect personal information through three forms on get-involved.html. All three forms are delivered using Formspree.

2.1 Performer roster sign-up

2.2 Build meeting sign-up

2.3 General inquiry

2.4 Information we do not request

The website does not ask form users to provide:

• a date of birth;
• a street address;
• a postal code;
• a Social Insurance Number;
• a passport, health-card, driver’s-licence, or other government identifier;
• an account password; or
• account login information.

HarmonYouth Foundation does not operate user accounts on the website.

Please do not include unnecessary sensitive information in a free-text message field. If you submit information that we did not request and do not need, we may delete it.

2.5 Changes to form fields

If HarmonYouth Foundation adds a new personal-information field to any website form, this policy must be updated on the same day and before the new field goes live.

A form must not collect a new category of personal information unless the policy first identifies the information and explains why it is needed.

Why we collect and use information

We collect and use personal information only for the purposes described in this policy, including:

1. scheduling live-music performances at senior homes and care facilities;
2. operating assistive-device build meetings;
3. coordinating performers, builders, volunteers, venues, and attendees;
4. confirming which participants are available for particular dates;
5. planning performance programs based on instruments, voices, and roles;
6. keeping accurate volunteer-hour records;
7. issuing volunteer certificates and service letters;
8. confirming and documenting parent or guardian consent;
9. handling urgent or same-day coordination by phone;
10. responding to inquiries, booking requests, program questions, and messages;
11. managing photo and media consent;
12. processing access, correction, withdrawal, deletion, and photo-removal requests; and
13. sending short performance reminders only where the recipient has expressly opted in.

3.1 Volunteer certificates and service letters

Volunteer certificates and service letters may include:

• the participant’s full name;
• the participant’s instrument or role;
• event or participation dates; and
• total volunteer hours.

These documents are normally sent as PDFs only to:

• the email address provided by the participant;
• the participant’s parent or guardian, where applicable; or
• a third party, such as a school, scholarship committee, or award body, when the participant or guardian makes an explicit written request.

HarmonYouth Foundation does not publicly post certificates or service letters.

3.2 Uses we do not make

We do not use form information to:

• create advertising audiences;
• build marketing lists;
• send newsletters;
• send fundraising appeals or solicitations;
• conduct behavioural profiling;
• sell or rent personal information; or
• contact someone for a materially different purpose without appropriate notice and consent.

Information obtained through a form will not be used to add someone to a donation or fundraising mailing list.

Photographs and other media

HarmonYouth Foundation takes photographs at performances and may publish selected photographs on harmonyouthfoundation.com and through our Instagram account, @harmonyouthfoundation.

Photographs may also be stored in a private HarmonYouth Foundation Google Drive folder. Photographs published through Instagram are processed and stored by Instagram/Meta under that platform’s terms and privacy practices.

4.1 Care homes and residents

Before taking photographs at a care home or similar venue, HarmonYouth Foundation obtains written venue consent.

The written process must:

• identify the venue and relevant event or events;
• state that photographs may be published on the HarmonYouth Foundation website and Instagram;
• identify residents who have opted out, where the venue provides that information; and
• be signed and dated by an authorised venue representative.

Residents who opt out must not be intentionally photographed. HarmonYouth Foundation does not publish resident names in public photo captions.

4.2 Performer photo consent

Before a performer is intentionally photographed for publication, HarmonYouth Foundation obtains written photo consent from:

• the performer, if the performer is 18 or older; or
• the performer’s parent or guardian, if the performer is under 18.

The photo-consent form must:

• explain that photographs may be published on the website and Instagram;
• provide a clear YES, I consent option;
• provide a separate, clear NO, I do not consent option;
• be signed and dated; and
• explain that consent covers future HarmonYouth Foundation shows until it is withdrawn.

Photo-consent records are retained for a minimum of five years from the last event covered by the consent.

4.3 Names and identifying details

Public captions involving student performers follow these rules:

• a performer may be identified by first name only;
• a first name is used only where the performer and, for a minor, the parent or guardian are comfortable with and have consented to that use;
• residents are not identified by name;
• student last names, schools, phone numbers, and other identifying details are not publicly disclosed; and
• an exception will be considered only if a parent or guardian specifically requests it in writing and HarmonYouth Foundation determines that publication is appropriate.

A written request does not require HarmonYouth Foundation to publish additional identifying details if doing so would create a privacy or safety concern.

4.4 Requesting photo removal

Anyone appearing in a photograph, or their parent, guardian, or authorised representative, may request removal by emailing harmonyouthfoundation@gmail.com or calling (403) 926-6122.

Where the person is the primary subject, HarmonYouth Foundation will remove the photograph from its controlled website and Instagram locations usually within one business day, and always within 48 hours after receiving and reasonably verifying the request. An incidental appearance in a group photograph may take up to seven days to remove or address.

Removal from HarmonYouth-controlled accounts does not guarantee immediate deletion from:

• third-party platform backups;
• search-engine caches;
• another person’s screenshots;
• reposts made by people outside our control; or
• other systems operated independently by Instagram/Meta or another service.

HarmonYouth Foundation will nevertheless take the removal steps reasonably available through the accounts and systems it controls.

Minors, minimum age, and guardian consent

5.1 Minimum participation age

The minimum age to participate in a HarmonYouth Foundation program is 6 years old.

We do not knowingly collect personal information from children under 6. If we discover that information from a child under 6 has been submitted, we will delete it immediately, subject only to any minimal record needed to document the deletion or respond to a safety concern.

5.2 Participants under 18

Anyone under 18 requires active parent or guardian consent before participating.

Every website form asks whether the person is under 18. If the answer is yes:

• the parent or guardian email fields become required;
• the form submission does not by itself authorise participation;
• HarmonYouth Foundation contacts the parent or guardian;
• the minor is not added to an active roster and does not participate until confirmation is received; and
• a timestamped record of the confirmation is retained.

5.3 Guardian confirmation message

The guardian confirmation message should:

• name the student;
• identify the student’s instrument or role where applicable;
• briefly describe HarmonYouth Foundation and the relevant program;
• provide a clear way to confirm consent; and
• provide a clear way to report that the registration was unauthorised and request removal.

A minor must not be treated as approved merely because a guardian email address was entered on a form.

5.4 Guardian consent records

A timestamped guardian confirmation is kept while the student is active, and for a minimum of five years after the last event covered by the consent.

For paper or in-person sign-ups, a parent or guardian must provide signed consent in person before the minor participates. The signed form is retained under the same consent-record rules.

Withdrawing consent

An adult participant may withdraw their own consent at any time. A parent or guardian may withdraw consent for a minor at any time.

To withdraw consent, email harmonyouthfoundation@gmail.com or call (403) 926-6122 and provide the participant’s name and the word WITHDRAW.

We may take reasonable steps to confirm that the requester is the participant, parent, guardian, or authorised representative before changing or deleting records.

Once a valid withdrawal request is received, HarmonYouth Foundation will:

1. remove the participant from the performer or builder roster within 24 hours;
2. delete the participant’s personal information from HarmonYouth Foundation’s own active records within 14 days, unless retention is legally required;
3. submit a Formspree deletion request at the same time as the internal deletion process;
4. remove photographs in which the participant is the primary subject from HarmonYouth-controlled website and Instagram locations within 48 hours;
5. address incidental appearances in group photographs within seven days; and
6. confirm completion by email.

Withdrawal does not require a reason.

HarmonYouth Foundation may retain a minimal consent and withdrawal record solely to demonstrate:

• that consent was originally obtained;
• when withdrawal was requested;
• the action taken; and
• when the action was completed.

We cannot guarantee immediate deletion from Formspree, Meta, Google, third-party backups, caches, or systems outside our control.

Performance reminder emails and CASL

HarmonYouth Foundation treats its performance-reminder emails as subject to Canada’s Anti-Spam Legislation, or CASL.

7.1 Express opt-in only

Every website form includes an optional reminder-consent checkbox. The checkbox:

• must not be pre-ticked;
• requires the person to actively select it;
• is optional;
• does not affect registration, participation, roster placement, volunteer hours, certificates, service letters, or responses to inquiries; and
• applies only to the reminders described in this section.

Submitting a form without selecting the checkbox does not authorise reminder emails.

We may still send communications reasonably necessary to:

• respond to the person’s inquiry;
• process their requested registration;
• obtain guardian consent;
• coordinate an event the person has agreed to attend;
• provide a requested certificate or service letter; or
• respond to a privacy or safety matter.

7.2 Consent records

For each reminder opt-in, HarmonYouth Foundation records the email address, the date and time of consent, and the form through which consent was provided.

7.3 Reminder content and frequency

A person who opts in may receive one short reminder before each scheduled performance.

Reminder consent is not used to send newsletters, fundraising appeals, donation requests, advertising, promotional mailing campaigns, or unrelated marketing messages.

Every reminder email identifies:

• HarmonYouth Foundation as the sender;
• Calgary, Alberta as our location;
• (403) 926-6122 as our telephone number; and
• a working unsubscribe method or link.

7.4 Unsubscribing

Unsubscribe requests take effect immediately for future reminder emails and remain in effect unless the person expressly signs up again.

We do not re-add an unsubscribed email address merely because the person submits another form without selecting the reminder-consent checkbox. Reminder email addresses are not shared with other organisations for their own communications.

Third-party services and cross-border processing

Some website functions depend on services operated by other organisations. Several of these services are based in or process information in the United States.

Information processed in the United States is subject to United States law and may be accessible to courts, law-enforcement agencies, or government authorities where permitted by applicable U.S. law.

8.1 Formspree

Formspree receives and delivers submissions from the three forms on the Get Involved page. Form submissions are transmitted using HTTPS.

Formspree may retain a copy in its own dashboard or systems. When HarmonYouth Foundation receives a valid deletion request, we will delete the relevant copy from our own records within the timelines in this policy, and submit a deletion request to Formspree at the same time.

We cannot guarantee immediate deletion from Formspree. Formspree’s own technical processes and retention rules govern its deletion timeline.

8.2 GoFundMe and donations

GoFundMe processes donation payments. HarmonYouth Foundation does not receive or store payment-card numbers or donor billing addresses.

Unless the donor selects GoFundMe’s anonymous-donation option, GoFundMe may make the following information available to HarmonYouth Foundation through its campaign tools:

• donor name;
• donor email;
• donation amount; and
• donation date.

Where a donation is anonymous, HarmonYouth Foundation generally sees the donation amount without the donor’s public identity.

Donor information is used only for donation administration and an appropriate thank-you message. Donors are not added to a mailing list without separate express consent.

8.3 Google Fonts

If Google Fonts remains enabled, the visitor’s browser contacts Google servers to retrieve font files. That request may include an IP address, browser information, and ordinary technical request information. HarmonYouth Foundation does not receive or retain that information.

If the fonts are later self-hosted and the Google Fonts request is removed, this section and the corresponding master policy must be updated on the same day so the policy does not describe a transfer that no longer occurs.

8.4 Instagram, WeChat, and embedded content

Instagram/Meta and WeChat operate under their own terms and privacy practices. Information supplied directly to those services is handled by those services.

An embedded GoFundMe widget, Instagram, or another external platform may place cookies or use technical storage outside HarmonYouth Foundation’s control.

8.5 Makers Making Change

HarmonYouth Foundation may use publicly available, open-source device designs from Makers Making Change. We do not share participant personal information with Makers Making Change merely because we use or refer to those designs.

Cookies, local storage, analytics, and tracking

HarmonYouth Foundation does not use:

• advertising cookies;
• tracking pixels;
• Google Analytics;
• another third-party analytics platform;
• behavioural advertising profiles;
• retargeting;
• remarketing; or
• tools intended to monitor which pages an identifiable visitor views.

The site does not track a visitor’s page-view history for HarmonYouth Foundation’s own analytics or advertising purposes.

9.1 Colour preference

The only browser storage intentionally controlled by the website is localStorage used to remember whether the visitor selected light or dark colour mode. This preference:

• is stored locally on the visitor’s device;
• does not identify the visitor by name;
• is not transmitted to HarmonYouth Foundation; and
• may be removed by clearing the browser’s site data.

9.2 External technical information

External services may independently log ordinary technical information, such as:

• IP address;
• browser type;
• device information;
• request time; or
• interaction information.

External services may also place their own cookies when a visitor uses an embedded widget, follows a link, interacts with Instagram, or uses another third-party platform. Those activities are governed by the relevant service’s privacy practices.

How long we keep information

We keep personal information only for as long as reasonably required for the identified purpose, subject to the specific periods below.

Consent records are stored in access-restricted locations, organised by year, and reviewed each January so records that are no longer required can be securely deleted.

Deletion from HarmonYouth Foundation’s own records may include deletion from:

• organisational email;
• active Google Drive folders;
• volunteer spreadsheets;
• rosters; and
• other records under our control.

Copies held by Formspree or other third parties are subject to those services’ own retention and deletion processes. HarmonYouth Foundation will make the applicable deletion request but cannot guarantee the third party’s completion time.

Nothing in this section requires deletion where limited retention is reasonably necessary to:

• comply with law;
• document consent or withdrawal;
• protect the safety of a participant;
• establish, exercise, or defend a legal claim; or
• demonstrate that a privacy request was completed.

Data breaches and security incidents

If a security incident involving personal information creates a real risk of significant harm, HarmonYouth Foundation will notify affected people as soon as reasonably possible, and always within 72 hours after discovering the incident.

Where required by law, HarmonYouth Foundation will also notify the Office of the Information and Privacy Commissioner of Alberta, or OIPC Alberta.

A notice to an affected person will explain, as specifically as reasonably possible:

1. what happened;
2. when the incident was discovered;
3. what personal information was involved;
4. what HarmonYouth Foundation has done or is doing in response; and
5. what the affected person can do to reduce potential harm.

The Privacy Officer is responsible for coordinating incident assessment, containment, documentation, and notification.

An incident involving a third-party service will be assessed based on the information reasonably available to HarmonYouth Foundation. We cannot guarantee that a third party will immediately discover or report an incident to us.

Your privacy rights and requests

Subject to applicable law and reasonable identity verification, a participant, parent, guardian, donor, or other individual may request the following.

12.1 Access

You may ask what personal information HarmonYouth Foundation holds about you. We will respond within 30 days, unless applicable law permits or requires a different period. If additional time is lawfully required, we will explain why.

12.2 Correction

You may ask us to correct inaccurate or incomplete personal information, such as a misspelled name or incorrect contact detail.

12.3 Deletion

You may ask us to delete personal information held in HarmonYouth Foundation’s own records. We will complete deletion within 14 days, unless:

• we are legally required to retain specific information;
• limited retention is necessary to document consent or withdrawal;
• deletion would interfere with a legal claim or safety obligation; or
• the information is controlled by a third party rather than HarmonYouth Foundation.

If information must be retained, we will explain what is being kept and why.

12.4 Photo removal

You may request photo removal under section 04. Primary-subject photographs are removed from HarmonYouth-controlled public locations within 48 hours, while incidental group appearances may take up to seven days.

12.5 Withdrawal of consent

Adults may withdraw their own consent, and parents or guardians may withdraw consent for minors, using the process in section 06.

12.6 Unsubscribe

You may unsubscribe from reminder emails at any time through the email’s unsubscribe method or by contacting the Privacy Officer.

12.7 Complaint

If you are not satisfied with our handling of a privacy matter, you may contact the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca.

You may contact the Privacy Officer before making a complaint, but doing so does not remove any right to contact the regulator.

12.8 How to make a request

Contact Adam Wu, Privacy Officer — harmonyouthfoundation@gmail.com · (403) 926-6122 · Calgary, Alberta, Canada.

Please identify the person and the request clearly. Do not send unnecessary identity documents by ordinary email. If identity verification is reasonably necessary, the Privacy Officer will explain what limited information is required.

How we safeguard information

HarmonYouth Foundation uses reasonable administrative, technical, and organisational safeguards appropriate to the information it holds. Current safeguards include:

• HTTPS transmission for Formspree website forms;
• an organisational Gmail account protected by two-factor authentication;
• Google Drive access limited to organisers who require the information;
• access-restricted folders for consent and volunteer records;
• limited sharing of personal information;
• separate documentation of guardian and photo consent;
• retention reviews and deletion procedures;
• no storage of payment-card information by HarmonYouth Foundation; and
• use of GoFundMe to process donation payments.

Organisers must not use personal information for personal purposes or disclose it to people who do not need it for HarmonYouth Foundation activities.

No website, email account, cloud-storage system, or third-party platform can be guaranteed perfectly secure. Our safeguards are intended to reduce risk, but they do not create a guarantee that loss, unauthorised access, or a security incident will never occur.

Privacy Officer and accountability

HarmonYouth Foundation has designated the following person as responsible for privacy matters:

Privacy Officer: Adam Wu
harmonyouthfoundation@gmail.com · (403) 926-6122
Calgary, Alberta, Canada

The Privacy Officer is responsible for:

• overseeing privacy compliance;
• responding to access, correction, deletion, withdrawal, unsubscribe, and photo-removal requests;
• maintaining guardian, photo, and reminder-consent records;
• overseeing retention reviews;
• coordinating security-incident and breach responses;
• limiting access to personal information;
• keeping the website privacy page and master policy consistent;
• reviewing website practices for accuracy; and
• updating this policy on the same day and before launch when a form begins collecting a new field or category of information.

If the Privacy Officer changes, HarmonYouth Foundation will update the website and the master policy within one week.

Limitation of liability

HarmonYouth Foundation is responsible for taking reasonable steps to protect the personal information under its control and for meeting its own obligations under applicable law and this policy. However:

• no information system can be guaranteed absolutely secure;
• HarmonYouth Foundation does not control every action, system, security decision, or retention practice of Formspree, GoFundMe, Google, Instagram/Meta, WeChat, or another independent third party;
• third-party platforms may experience outages, security incidents, unauthorised use, policy changes, or technical failures outside our reasonable control; and
• information publicly shared or independently copied by others may remain outside HarmonYouth Foundation’s control.

To the fullest extent permitted by applicable Canadian law, HarmonYouth Foundation’s liability for a third party’s independent failure, breach, misuse, or action outside our control is limited.

This section does not:

• exclude responsibility for HarmonYouth Foundation’s own unlawful conduct;
• remove any obligation imposed on HarmonYouth Foundation by privacy or other applicable law;
• limit a right or remedy that cannot lawfully be limited;
• prevent a person from making a complaint to a regulator; or
• waive statutory rights.

Governing law and jurisdiction

This policy is governed by the laws of the Province of Alberta and the federal laws of Canada applicable in Alberta.

Subject to any non-excludable right or jurisdiction under applicable law, disputes relating to this policy or HarmonYouth Foundation’s handling of personal information will be resolved in the courts of Alberta, Canada.

HarmonYouth Foundation:

• operates in Calgary, Alberta;
• does not target its programs or website to people outside Canada; and
• does not knowingly enroll participants who reside outside Alberta.

If you are outside Canada and believe that additional privacy rights apply to you, contact the Privacy Officer. We will review the request and respond according to the laws that apply. This governing-law section does not override mandatory privacy rights that cannot lawfully be excluded.

Changes to this policy

HarmonYouth Foundation may update this policy when its website, forms, programs, service providers, or legal obligations change. When the policy changes:

1. the Last updated date at the top will be revised;
2. material changes affecting people whose information we hold will be communicated to those people through an appropriate channel;
3. a new category or use of personal information will not be applied quietly or retroactively without appropriate notice and consent;
4. a new website form field will not go live until this policy has been updated on the same day;
5. the website privacy page and the master document will be kept aligned in substance; and
6. outdated statements about third parties or technology will be corrected promptly.

If Google Fonts is self-hosted and the external Google request is removed, the Google Fonts disclosures must be updated on the same day.

The version displayed on the website and the official master version should describe the same collection, uses, disclosures, retention periods, rights, and commitments. If an accidental difference is discovered, HarmonYouth Foundation will correct it promptly and will not use the inconsistency to reduce a person’s privacy rights.