This Privacy Policy explains how Cds Family Foundation collects, uses, shares, stores and protects personal information when a family, volunteer, donor, partner organisation or visitor interacts with our foundation. The foundation was designed, built and is maintained by the developer CDS Family, and that developer contributed the technical structure of this website, the contact form and the mail handling routines described below. We have written this policy in plain language on purpose. A family in a difficult season should not have to decode legal phrasing to understand what happens to a note it sends us.
We are a small organisation and we handle a modest amount of information. That does not make the information unimportant. Much of what we receive concerns health, disability, family circumstance and financial need, and we treat all of it as sensitive by default. If anything here is unclear, please contact us using the details at the end of this document and a person will explain it without jargon.
1. Who we are
Cds Family Foundation is a family support foundation based in Toronto, Ontario, Canada. We provide respite grants, counselling referrals, caregiver circle evenings, sibling support days, an emergency family fund and navigation walkthroughs to households caring for a child or adult with high support needs. Our registered address is 149 Dunblaine Avenue, Toronto - M5M 2S4, Canada (CA). Our general contact email address is service@cdsfamily.buzz and our telephone number is +19706023378.
For the purposes of applicable privacy legislation, Cds Family Foundation is the organisation responsible for the personal information described in this policy. That means we decide why information is collected, how it is used and when it is no longer needed. When we engage a partner organisation to deliver part of a service, we remain accountable for the care of the information we have handed over and for the instructions we give.
This policy covers the website at cdsfamily.buzz, the printed and electronic forms we use at the house, our telephone conversations, our email correspondence, our volunteer records and our grant files. It does not cover the independent practices of clinicians, schools, landlords or government agencies that we may refer a family toward. Each of those organisations publishes its own privacy notice, and we encourage families to ask for it before sharing information directly.
2. Information we collect
The information we collect falls into a few practical groups. We collect only what a service requires, and we try to write our forms so that a family can see why each line exists.
Contact and identity information
This includes a name, preferred name, home address, email address, telephone number, language preference and the best time to reach a household. We also record the names of any family members a household asks us to include in correspondence, and whether a family prefers written or spoken contact.
Household and support information
This includes the ages of children in the home, the nature of a caregiving situation as described by the family, the services a household has requested and the outcomes of those requests. We record the short household note described on our services page, which captures what a month has actually looked like for a family in the family words.
Health and clinical information
Where a family shares it, we may record a diagnosis, a medication routine, an allergy, a mobility requirement, a communication preference or a safety plan. We do not request medical records as a condition of service. When a clinician is involved through a referral, that clinician holds the clinical record, and our file holds only the referral status and the information the family has agreed we may keep.
Financial information
For a respite grant or an emergency fund release, we may collect the amount requested, the purpose, the name of the provider who will be paid and the bank details needed to make a direct payment. We do not store full payment card numbers, and we do not ask families for a deposit or for account credentials.
Volunteer and donor information
For volunteers we collect a name, contact details, availability, training records and references. For donors we collect a name, contact details, donation history, receipting details and any communication preferences. We never publish a donor name without explicit permission.
Technical and website information
When someone visits this website, our hosting provider logs a small set of standard technical details such as the requested page, the time of the request, the referring page, a truncated network address and the browser type. We use these logs to keep the site available and secure. We do not use them to build advertising profiles.
Communication records
We keep a record of telephone calls, emails, letters and meeting notes connected to a household file. These records help a family avoid repeating a difficult story to a new staff member, and they help us check that we did what we promised.
3. How we collect information
Most information reaches us directly from the person it concerns. A family telephones, writes an email, completes a form at the house or speaks with a volunteer during a visit. Some information arrives through a referral from a clinic, a school, a settlement worker or another charity, and in that case we ask the referrer to confirm that the family knows about the referral before the file is opened.
A small amount of information is generated by the website itself. The contact form on this site does not transmit a message to a remote server. It prepares an email in the visitor own mail program and sends it to service@cdsfamily.buzz, which means the message travels through the email provider that visitor has chosen. The technical logs described above are created automatically by the hosting infrastructure when any page is requested.
We do not purchase mailing lists, we do not buy personal information from data brokers, and we do not scrape information from social media accounts. If we receive unsolicited personal information about a third party, we limit access to it, check whether retention is necessary and where possible notify the person concerned.
4. Why we use information
We use personal information to deliver the six services described on our services page, to keep our promises and to run the foundation responsibly. The specific purposes are set out below.
- To answer an enquiry and arrange a first conversation with a household.
- To assess a request for a respite grant, an emergency fund release or another form of practical help.
- To make and confirm a counselling referral and to follow up on whether the fit was right.
- To invite a family to a circle evening or a sibling support day and to provide childcare or a meal where needed.
- To prepare for and carry out a navigation walkthrough and to leave a written summary of next actions.
- To maintain a household note that allows a family to avoid repeating their story.
- To train volunteers, supervise their work and manage safeguarding concerns.
- To process donations, issue receipts and satisfy charity reporting duties.
- To keep the website, telephone line and premises secure and available.
- To prepare anonymous statistics about how many families were supported and where gaps remain.
- To respond to a complaint, an access request or a legal obligation.
We do not use personal information for advertising, we do not sell it, and we do not rent a mailing list to any other organisation. If a family asks not to receive invitations or appeal letters, we record that preference and honour it across the foundation.
5. Legal bases for processing
Where privacy law requires a legal basis, we rely on consent, on the performance of a service a family has requested, on compliance with a legal obligation or on our legitimate interest in running a safe and effective foundation.
Consent
We ask for consent before collecting sensitive information, before sharing a family details with a partner organisation and before using a story or photograph in our annual account. Consent can be withdrawn at any time, and withdrawal does not affect work already completed.
Service performance
When a household asks us for a grant, a referral or a walkthrough, we need the information necessary to provide it. This includes contact details, the purpose of the request and the details of the provider who will be paid.
Legal obligation
As a foundation we must keep certain financial records, respond to lawful requests from a public authority and maintain safeguarding records in line with Ontario and federal requirements. Where the law requires retention, we cannot delete on request while the obligation lasts.
Legitimate interest
We have a legitimate interest in keeping the website secure, preventing fraud against the foundation and training volunteers properly. We balance that interest against the privacy of families and we restrict the information used for these purposes to what is necessary.
6. Sensitive information
Information about health, disability, family relationships and financial hardship is sensitive. We collect it only when a service needs it, we limit access to the staff and volunteers who need it to do their work, and we store it with additional safeguards described later in this policy.
A family may choose how much to share. We will explain what is needed for a grant or a referral, and we will accept a shorter account where a full one would be distressing. No family is required to describe a diagnosis to receive a circle invitation or a sibling day place. Where a household chooses to share less, we record that choice so that a future volunteer does not ask again.
We do not infer health conditions from browsing behaviour, we do not build profiles of disability, and we do not use sensitive information to rank families against each other. The review table reads each application on its own terms.
8. Service providers
We use a small number of service providers to keep the foundation running. These include a website hosting provider, an email provider, an accounting platform and a telephone service. Each provider processes information on our instructions and is selected for reliability and for a reasonable security posture.
Before engaging a provider, we consider what information it will touch, whether the information is sensitive, where the provider stores data and how the provider handles deletion. We keep a written agreement that requires confidentiality, limits use to the agreed purpose and requires notification if a security incident occurs. We review these arrangements at least once a year.
The developer CDS Family designed this website without third party analytics, without advertising scripts and without embedded social media widgets. That decision was deliberate: every script on these pages is served from our own domain, so a visit to this site does not quietly send information to a large platform.
10. How long we keep information
We keep information only as long as a purpose requires. The retention periods below are guidelines, and a specific file may be kept longer where a legal obligation, an open complaint or a safeguarding concern applies.
- General enquiries that do not become a household file are deleted or anonymised within twelve months.
- Household notes are kept for the period a family is in contact and for three years afterwards, so that returning does not mean starting over.
- Grant and emergency fund records are kept for seven years to satisfy financial record keeping duties.
- Volunteer training and reference records are kept for the period of service and for two years afterwards.
- Donation records are kept for seven years for receipting and audit purposes.
- Website technical logs are held by the hosting provider for a short rolling period and then discarded.
- Complaint files are kept until the complaint is resolved and for two years afterwards.
When a retention period ends, we delete the record or remove the details that could identify a person so that the remainder can be used for anonymous reporting. Deletion covers electronic copies, backups within the next backup cycle and paper files placed in secure destruction.
11. How we protect information
We use a layered approach rather than a single control. Paper files live in a locked cabinet at the house and are signed in and out by the staff member who needs them. Electronic files live in accounts protected by strong passwords and two step verification, and access is granted per person rather than to a shared inbox. Volunteers see only the household notes connected to their own work.
Telephone calls that concern sensitive matters take place in a room where a conversation cannot be overheard. Emails containing a referral note are sent with a request for confirmation and, where available, through a secure channel. Devices that access foundation files are encrypted, kept up to date and locked when unattended.
No system is perfect. We train staff and volunteers to recognise a suspicious message, we test our backup restoration at least once a year and we review access rights when a person leaves. If an incident occurs, the coordination team follows the notification steps described later in this policy.
12. Your rights
Subject to applicable law, a person has the right to know what information the foundation holds, to receive a copy, to correct an error, to withdraw consent and in some circumstances to ask for deletion or to object to a use. These rights apply to families, volunteers, donors and anyone who has contacted us.
- The right to be informed about how information is used, which is the purpose of this policy.
- The right of access to the personal information we hold about you.
- The right to correction of inaccurate or incomplete information.
- The right to withdraw consent where processing relies on consent.
- The right to request deletion where retention is no longer necessary.
- The right to object to a use based on legitimate interest.
- The right to ask for a portable copy of information supplied by you.
- The right to complain to a privacy regulator or to the foundation directly.
These rights are not absolute. A legal retention duty, an active safeguarding file or the rights of another person may limit a request, and if that happens we will explain the reason in writing rather than simply refuse.
13. Access and correction requests
To make a request, write to service@cdsfamily.buzz or send a letter to 149 Dunblaine Avenue, Toronto - M5M 2S4, Canada (CA). Please tell us what you are asking for and how we can verify that you are the person concerned. We do not require a formal form, and a family may ask a trusted advocate to write on their behalf with written permission.
We acknowledge a request within five working days and aim to provide a full response within thirty days. If a request is complex, we will explain the reason for any extension and keep the person informed. There is no fee for a first request, and we will waive a reasonable fee for a family for whom cost is a barrier.
If we correct a record, we note the correction and, where the information was shared with a provider or partner, we ask that party to update its copy. If we decide not to correct a record, we add a note of the disagreement so that the file reflects both views.
14. Privacy for children
Many of the households we serve include children, and some of those children have high support needs. We take extra care with information about a child. We collect only what a service needs, we do not publish a child name or photograph without written permission from a caregiver and, where the child is old enough to understand, from the child as well.
A caregiver may ask what we hold about a child in their care, and we will respond in a way that respects the child evolving capacity for privacy. A teenager may ask us not to share a particular note with a caregiver, and where the law and safety allow it we will honour that request and explain our limits honestly.
Sibling support days are designed so that a brother or sister can speak freely without a caregiver listening in. We keep those conversations confidential within the boundaries of safeguarding practice, and we provide a short summary only where the child agrees to it.
15. Email and telephone contact
Email is convenient but it is not a sealed letter. A message can be misaddressed, forwarded or stored by a provider outside our control. We use email for scheduling, general enquiries and the confirmation of a referral, and we avoid placing sensitive detail in a subject line. If a family prefers, we will telephone instead or arrange a conversation at the house.
Our telephone number +19706023378 reaches a person during business hours. We do not record calls by default. If a call needs to be recorded for training or for accuracy, we will ask first and explain how the recording will be stored and when it will be deleted. A family can decline recording and still receive the service.
We may leave a voicemail that gives only a name and a return number. We will not leave a message that reveals the nature of a family situation, because a voicemail can be heard by anyone near the telephone.
16. Donors and volunteers
Donors provide a name, contact details and the information required to issue a receipt. We publish donor names only with permission, and an anonymous gift is respected without question. We do not sell or exchange a donor list, and we do not send an appeal to a person who has asked us to stop.
Volunteers provide references, availability and training records. A volunteer file is kept separately from the household files a volunteer works on, so that a family note is never visible to the wider volunteer group. After a volunteer leaves, access is removed on the final day and the file is retained only for the period described in the retention section.
A volunteer who has a concern about how information was handled should raise it with the coordination team rather than discuss it with a family. That rule protects the household and it protects the volunteer.
17. Third party links
This website may link to a clinic, a school board, a government service or another charity that can help a family. Those sites are not operated by us and we do not control what they collect. When a visitor follows a link, the privacy policy of the destination site applies from the moment the new page loads.
We choose links with care and review them periodically, but a link is not an endorsement of every practice on the destination site. If a link leads to a page that seems inappropriate, please tell us at service@cdsfamily.buzz so that we can review it.
18. International transfers
Our operations are based in Toronto, Canada. Some of our service providers may store data on servers located outside Canada, including in the United States. Where that happens, we require the provider to protect the information through contractual terms that reflect the standards in this policy.
A family that prefers its information to remain in Canada should tell us before a file is opened. We will explain which parts of the service can be delivered without an international provider and where a limitation exists. We do not transfer sensitive information internationally for any purpose other than the operation of the service a family has requested.
19. Automated decisions
The foundation does not use automated decision making to decide whether a family receives a grant, a referral or a place at a circle evening. Every decision that affects a household is made by a person or by a small review table of people who have read the file.
The website uses a small amount of client side code to reveal sections as a visitor scrolls and to open and close the answers on the contact page. That code runs in the browser, does not profile a visitor and does not send a result to the foundation. No algorithm ranks families, no score is generated and no household is declined by software.
20. Breach notification
If we become aware of a breach of security that creates a real risk of significant harm, we act quickly. The coordination team contains the incident, restores access and records what happened, when it was discovered and what information was affected.
We notify affected individuals as soon as it is safe to do so, describing what happened, what information was involved and what steps a person can take to reduce risk. Where the law requires, we notify the Office of the Privacy Commissioner of Canada and any other regulator with jurisdiction. We do not conceal a breach to protect our reputation. A foundation that asks for trust must be willing to say when it has failed.
After an incident we review the cause, change the process that allowed it and record the lesson so that a future volunteer inherits a stronger system rather than the same weakness.
21. Changes to this policy
We review this policy at least once a year and whenever a service, a provider or a legal requirement changes. The effective date at the top of the page is updated on each revision. If a change materially affects how information is used, we will tell active households directly by email or letter rather than relying on a visitor to notice a new date.
An archived copy of a previous version is available on request. We keep earlier versions so that a family can see what was promised at the time information was collected, and we do not apply a new use retroactively to information gathered under an older promise without asking first.
22. Complaints
If you believe the foundation has mishandled personal information, please tell us first. Write to service@cdsfamily.buzz or telephone +19706023378 and describe what happened in your own words. A member of the coordination team who was not involved in the original decision will review the complaint.
We acknowledge a complaint within five working days and aim to give a written response within thirty days. If we got it wrong, we will say so, correct the record and explain what has changed. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or to the Information and Privacy Commissioner of Ontario. We will cooperate fully with either office.
23. Contact details
Questions about this policy, requests to access or correct information and complaints should be directed to Cds Family Foundation using the details below. This policy was structured and published with the assistance of the developer CDS Family, who can be reached through the same foundation address.
Cds Family Foundation
149 Dunblaine Avenue
Toronto - M5M 2S4
Canada (CA)
Email: service@cdsfamily.buzz
Telephone: +19706023378
Our office is open Monday to Thursday from 9:00 to 17:00 and Friday from 9:00 to 15:00. Messages received outside those hours are read on the next working day. If your matter concerns the health or safety of a person right now, please contact emergency services first and then let us know so that we can support the household afterwards.
Return to the homepage →