CANHEIT Privacy Policy

 

Effective date: January 1, 2026
Who we are: CUCCIO (Canadian Universities Council of Chief Information Officers); (“Organizer”, “we”, “us”, “our”).

Event: the current or upcoming CANHEIT taking place within 12 months.

We are committed to protecting personal information of everyone participating in the current or upcoming CANHEIT (“Event”). This Policy explains what we collect, how we use it, who we share it with (including exhibitors), and your choices.

We handle personal information in accordance with applicable Canadian privacy laws, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial private sector‑ laws in British Columbiaand Alberta, and Québec Law 25 where applicable. 

1) Scope

This Policy applies to personal information collected from delegates/attendees, speakers, sponsors/exhibitors, and volunteers in connection with the current year’s CANHEIT conference. (including registration systems, mobile app, website, onsite badge scanning, and surveys). It does not cover activities unrelated to the Event. We follow the fair information principles (accountability, purpose identification, consent, limiting collection/use/disclosure/retention, accuracy, safeguards, openness, access, and challenging compliance). https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/

2) Information We Collect

We collect only the information needed for Event operations:

  • Identity & contact: name, employer, title, business contact details, country/province, professional role. (Note: “business contact information” may be treated differently under some provincial laws, but we protect it appropriately.
  • Registration details: ticket type, sessions, dietary preferences, accessibility needs.
  • Transaction data: payment confirmations (handled by a PCI compliant‑ processor; we do not store full card numbers).
  • Event app & website data: profile information you add, usage logs, device/browser info, cookies (see Section 10).
  • Onsite interactions: badge scans at exhibitor booths/sessions; photos/video from Event areas (see Section 9).
  • Communications: emails/messages about schedules, logistics, and where permitted marketing consistent and compliant with CASL (see Section 6).

3) Purposes for Collection and Use (Event Only)

We collect and use personal information for Event purposes only, including:

  • Registration & administration: to confirm attendance, issue badges, manage sessions, and provide support.
  • Safety & operations: venue access control, emergency communications.
  • Program delivery: session scheduling, speaker/exhibitor coordination, networking features in the Event app.
  • Communications: send essential Event notices and, with appropriate consent, promotional updates about this Event.
  • Feedback & improvement: post Event‑ surveys, aggregate analytics.
  • Legal & compliance: audits, fraud prevention, and to comply with law.

Collection and use are limited to purposes a reasonable person would consider appropriate in the circumstances, and not for “no-go‑ zones” identified by a privacy commissioner (e.g., unlawful collection, discriminatory profiling, significant harm, charging for takedowns, requiring social media passwords, using a person’s own device for surveillance).

4) Lawful Basis & Consent

We obtain meaningful consent before collecting, using, or disclosing personal information beyond what is necessary to provide the Event. Consent can be express (opt-in) or implied depending on context; we emphasize key elements (purposes, third party sharing, risks, withdrawal option‑s) and seek express consent when information is sensitive or use is outside reasonable expectations.

For participants from Québec, we align with Law 25 (Bill 64) requirements for clear, informed, specific, and separate consent for secondary purposes (e.g., exhibitor marketing).

5) Sharing With Exhibitors (Event Only)

Exhibitor access to delegate information is strictly controlled and Event l‑imited:

  • Badge Scans = Delegates’ Choice: Exhibitors may collect a delegate’s contact details only when a delegate voluntarily allows their badge to be scanned at that exhibitor’s booth or session. The scan records the delegate’s Event profile/business contact information, and constitutes consent for that exhibitor to contact the delegate about the Current Event or the exhibitor’s offerings presented at the Event. Any broader/ongoing marketing requires express opt-in that is separate from the scan consent (especially in Québec).
  • Event ‑Only Use: Exhibitors must use scanned data only for Event related ‑follow-up and must not sell, lease, or repurpose delegate lists. Continued post Event marketing must comply with CASL (consent, identification, unsubscribe).
  • Contracts & Safeguards: Exhibitors agree by contract to protect personal information, limit use to Event purposes, honor unsubscribe/withdrawal requests, and securely delete data when no longer needed. (Québec requires written clauses limiting use and retention by service providers/mandataries.) 

6) Email, SMS, and CASL Compliance

We send commercial electronic messages (CEMs) only in compliance with Canada’s Anti‑Spam Legislation (CASL):

  • We obtain express consent (opt-in) or rely on implied consent only where CASL allows (e.g., an existing business relationship within time limits). Each message includes identification and a functional unsubscribe mechanism. Consent records are retained. 
  • Exhibitors sending CEMs to delegates must independently comply with CASL and cannot rely on Organizer’s consent unless explicitly indicated.

7) Limiting Collection, Use, Disclosure & Retention

We collect the minimum personal information necessary and retain it only as long as required to fulfill Event purposes, meet legal/accounting obligations, and resolve disputes, after which we securely delete or anonymize records per out retention schedule. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/

8) Security Safeguards

We implement appropriate administrative, technical, and physical controls proportionate to the sensitivity of information (e.g., role based access, encryption in transit/at rest where feasible, vendor due diligence, staff training, incident response). 

If a privacy breach occurs, we will take steps to contain, assess risk, notify affected individuals and/or authorities as required, and prevent recurrence. 

 

 

 

 

 

 

9) Photography & Recording at the Event

We may capture photos, audio, or video in public Event areas to document proceedings. If you prefer not to appear in materials, please inform staff and avoid camera ‑designated areas. We limit use to Event reporting and promotion and honor reasonable objections. (We avoid problematic uses inconsistent with “appropriate purposes” under PIPEDA). 

10) Cookies, App Tracking & Online Analytics

Our website and Event app may use cookies and similar technologies for functionality (e.g., session management), preferences, and limited analytics. You can manage cookies through browser/app settings; certain features may not work without them. When technologies involve personal information, we obtain meaningful consent and avoid deceptive design patterns that undermine consent.

11) Cross Border‑ Transfers

When possible, should service providers store or access data outside the province or Canada, we endeavor to assess the risks, and disclose relevant information to you. Under PIPEDA, organizations handling information that crosses provincial or national borders in the course of commercial activities are subject to federal requirements. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/

12) Your Rights

Depending on applicable law, you have the right to:

  • Access the personal information we hold about you and request corrections for accuracy.
  • Withdraw consent (including stopping exhibitor follow-up and Organizer marketing).
  • Unsubscribe from CEMs using the link or instructions in each message.
  • Complain to us or to your provincial/federal privacy commissioner.

We will respond within statutory timelines and explain our decisions. (BC/Alberta PIPA and PIPEDA include access, correction and complaint mechanisms.)

13) Children

The Event is intended for professionals; we do not knowingly collect personal information from children. If a minor attends (e.g., student programming), we obtain consent from a parent/guardian consistent with the Office of the Privacy Commissioner of Canada’s guidance. 

 

14) Updates to This Policy

We may update this Policy to reflect changes in law or Event operations. Material changes will be communicated through our website and/or email before they take effect. (PIPEDA’s openness principle expects transparent policies.)

15) Contact Us

Lindsay Sill, Adrian Lim
info@cuccio.net

If your issue remains unresolved, you may contact the appropriate privacy regulator (e.g., Office of the Privacy Commissioner of Canada or your provincial commissioner.

Exhibitor Addendum (attached to exhibitor agreements)

  1. Purpose Limitation: Exhibitor may use delegate data only for Event related follow‑-up‑ and may not sell, rent, or transfer lists.
  2. Consent via Badge Scan: Each scan represents delegate consent to that exhibitor, limited to information related to the Event. Ongoing/expanded marketing requires new express consent (separate checkbox/form; especially in Québec). 
  3. CASL Compliance: Exhibitor must comply with CASL for all CEMs (consent, identification, unsubscribe) and keep consent records. 
  4. Safeguards & Deletion: Maintain appropriate security measures; delete or anonymize delegate data when no longer needed for Event follow-‑up. 
  5. Sub processors & Cross B‑order Use: Use of third party tools/cloud must include written contractual protections and disclosure of any cross‑ border transfers where required‑. (Québec Law 25 requires specific contractual clauses controlling use and retention.)

 

 

 

 

 

 

Appendix