Privacy policy for Get Involved! Guelph

Last updated: 2026-08-29

1. Who we are

Get Involved! Guelph is a nonprofit organization based in Guelph, ON. Our registered name is Get Involved Guelph, a not-for-profit corporation incorporated in Ontario.

In this policy, “we”, “us” and “our” mean the organization named above.

This policy covers the Get Involved! Guelph website at GetInvolvedGuelph.ca. It does not cover our Facebook and Instagram pages, which Meta runs under its own privacy policy, and Eventbrite, which runs its own.

2. The short version

Use this to find the section you need. The sections below are what applies.

What we collect: your email address if you sign up, what you write in our contact and petition forms (including your name and postal code), what you give us when you donate, and information your browser sends.
Why: to send you the updates you asked for, to send petition messages to decision-makers on your behalf, to take donations and thank you for them, to reply to you, and to see which pages people read.
Who else sees it: the decision-makers our actions are addressed to. Google, Cloudflare, Mailchimp, Eventbrite and Stripe also receive information.
Tracking: yes, on every page. See Cookies, analytics and tracking.
Signing a petition or donating also puts you on our email list. Email from us explains how to stop.
Your choices: you can ask to see, correct, or delete what we hold. See Seeing, correcting and deleting your information.

3. Definitions

Personal Information is information about you as an identifiable person. For us that means your name, your email address, your postal code, your phone number if you give it, and anything you choose to write to us.

Technical information. Some information reaches us simply because you visited: your IP address, which browser and device you are using, which pages you look at, which site or link sent you here, and which outside links you click to leave. On its own this does not tell us who you are. It can become identifying when it is joined to something you have given us.

“you” means the person the Personal Information is about. Who we are says who “we” are.

4. What we collect and why

We collect Personal Information only when you give it to us or when your browser sends it, and only for the purposes named here:

Your email address, if you sign up for updates: email address. Why: to send you the updates you signed up for, and to keep a record that you asked us to. Optional. You only give it if you sign up.
What you send us through the contact form: name, email address, subject, and your message. Why: to read your message and reply to it. Optional. You only give it if you write to us.
What you give us when you sign a petition or take an action: first name, last name, email address, postal code, and your message or comments; phone number and organization are optional. Why: to add your name to the petition, to send your message to the decision-makers it is addressed to, and to keep a record of what you agreed to. Required if you want to sign, because we cannot send an unsigned message on your behalf.
What you give us when you ask about the Campaign School: first name, last name, email address, your message, and your Instagram handle if you give it. Why: to answer your question about the programme. Optional. You only give it if you write to us.
What you give us when you donate: email address, and your name if you give it; the amount, the currency, whether the gift is one-time or monthly, and whether you ask to hear about volunteering. Why: to take the donation, to email you a confirmation and thank you, to add you to our email list, to contact you about volunteering if you asked us to, and to keep our own record of the gift. Optional. You only give it if you donate. Your card or bank details are typed into the payment provider’s own form and never reach us.
Information your browser sends: IP address, browser and device type, the pages you view, how you reached us, and which links you click to leave the site. Why: to see which pages and campaigns people read. Sent automatically by your browser whenever you visit any website. Whenever you send us one of the forms on this site, we also record the date, the wording you agreed to, and the IP address you sent it from. That record is how we can show you agreed to hear from us, and How long we keep it says how long we hold it. Donating is the one exception, and only in part: the payment form is Stripe’s, so the address it reaches us from is Stripe’s rather than yours, and we do not record an IP address for a donation. We do record the date and the wording you agreed to.

Giving us your Personal Information is your choice. You can read everything on this site without giving us anything.

5. How we use it

We use Personal Information only for the purposes listed in What we collect and why. If we want to use it for something new, we will tell you what that is and ask you first where the new purpose needs your consent.

We do not sell, rent, barter or lease your Personal Information, and we do not swap lists with other organizations.

We try to keep Personal Information accurate and up to date for as long as we are using it. Seeing, correcting and deleting your information explains how to have it corrected.

6. Messages we send on your behalf

When you use one of our petition or action forms to send a message to the decision-makers that campaign is addressed to (Guelph City Council, school board trustees, or whoever else the campaign is aimed at), here is what happens.

We send your name, your postal code or address, your email address, and your message to the recipient. Campaigns differ in how much of this they send, and each action page says what that campaign shares before you sign, so read it there. We list the widest case here so that nothing is understated.
The message is sent by us, on your behalf, as part of the campaign’s submission.
Once it is sent, we cannot take it back. What happens next is up to the recipient. They may keep it, reply to it, forward it, count it, or publish it. Their handling of your Personal Information is governed by their rules, not by this policy.
Correspondence with a public office may be subject to record-keeping or access-to-information laws, which can make it disclosable to others.
Some of our actions let you read and edit the message before it is sent. Others are petitions with fixed wording, where you can add a comment but cannot change the petition text. Each action page makes clear which it is.
We keep a copy of what was sent. See How long we keep it.

7. Cookies, analytics and tracking

These are the tools we set or load on Get Involved! Guelph. If you find something here we have not listed, tell us. See Who is accountable, and how to complain.

What	What it does	Stores something on your device?	Can it identify you?	Who operates it
Google Analytics 4	counts visits, shows us which pages are read, and records which outside links you click	Yes: cookies _ga and _ga_GQHW0PM77T. Turning analytics off deletes them.	Only if combined with information you give us	Google LLC (United States)
Cloudflare Turnstile	checks that a form is being filled in by a person rather than a bot, on every form on this site	On the pages that carry a form. Cloudflare operates it and describes what it stores in its own documentation	No	Cloudflare
Stripe Checkout	shows the payment form on the donate page and takes the payment	On the donate page only. Stripe sets its own storage there, which Stripe describes in its own privacy policy	Yes, to Stripe, because it is taking your payment	Stripe Payments Canada, Ltd.
Cloudflare Web Analytics	counts visits	No: it sets no cookie and stores nothing on your device	No	Cloudflare (global)

Email. When we send you an email, Mailchimp records whether you opened it and which links in it you clicked, and ties that to your subscription. Most email apps can block remote images, which stops the open tracking. Confirmed by the operator 2026-08-19: open and link tracking are both enabled on this account.

What you can do about this is in Your tracking choices.

8. Your tracking choices

We use Google Analytics and Cloudflare Web Analytics to measure how this site is used, so we know which pages are worth keeping and which need work. This is not needed to show you the site, so you can turn it off. Turning it off stops both of them, and it takes effect on the next page you open. Turning analytics off also deletes the Google Analytics cookies already set in this browser. Your choice is remembered here using a single stored setting rather than a cookie, and outside the donate page that setting is then the only thing this site keeps on your device. The donate page is the exception: Stripe’s payment form sets its own storage there, we do not control it, and turning analytics off does not affect it. If you clear your browsing data, or use another browser or device, you will need to set your choice again.

You can also block or delete cookies in your browser settings.

You give us Personal Information by doing something specific: signing a petition or taking an action, signing up for email updates, making a donation, writing to us through the contact form, or asking about the Campaign School. When you do, you are agreeing to us using it for the purpose named at the time, and for nothing else.

Some collection happens without you doing anything: the analytics described in Cookies, analytics and tracking run when a page loads. We describe them there so you know what is happening; we do not pretend you have agreed to them by visiting.

The petition and action forms say that by giving us your contact information you agree to receive communications from us, so signing a petition does add you to our email list. The donation page says the same thing where you give, so donating adds you as well. You can unsubscribe at any time, and Email from us explains how.

Withdrawing consent. You can tell us to stop at any time. Contact us (Who is accountable, and how to complain). We will stop emailing you and delete what we hold, except anything the sections below say we have to keep. How long we keep it lists anything we have to keep afterwards, and Messages we send on your behalf explains the one thing we cannot undo.

We will not use information we already hold for a new purpose without telling you first, and asking you where the new purpose needs it.

10. Email from us

You go on our email list if you sign up for updates, if you sign one of our petitions or action forms, or if you donate. Those forms and the donation page say so where you submit them. We do not add you for writing to us through the contact form.

To stop. Use the unsubscribe link at the bottom of any email we send, or email privacy@getinvolvedguelph.ca. We act on it, at no cost to you, and you do not have to give a reason.

11. Donations and sponsorship

Our events are free to attend, so there is nothing to pay for a place at one. Money reaches us two other ways, and PIPEDA (Canada’s federal privacy law) applies to the information involved in both of them, which means you have rights under it.

The first is a donation. Donations are taken by Stripe, which shows you its own payment form: you can give once or monthly, by card, by one of the payment buttons your phone or browser offers, or by Canadian pre-authorized debit from a bank account. Your card or bank details are typed into Stripe’s form and never reach us. What we receive back is your email address, your name if you gave one, and the amount, and we keep a record of the gift. Who we share it with says what Stripe receives and How long we keep it says what we keep.

The second is sponsorship. We ask organizations and individuals to sponsor the Campaign School. If you contact us about sponsoring it, we keep your contact details so we can follow up.

12. Children and young people

This site is for the general public and we do not seek Personal Information from children. We cannot tell how old someone is when they fill in a form, so if a young person has given us their information and a parent or guardian would like it removed, ask us and we will remove it.

Email privacy@getinvolvedguelph.ca and we will deal with it the same way as any other deletion request.

We do not sell Personal Information. Beyond the decision-makers described in Messages we send on your behalf, we share it only with the providers below, and only the information each one needs for its role.

Google Analytics 4 (Google LLC): measures which pages people read, and which links they click to leave the site. Shared: IP address, pages viewed, browser and device information, and the address of any outside link you click. Region: United States.
Mailchimp: stores the mailing list and sends our emails. Shared: email address; whether you open our emails or click their links; when you sign a petition or take an action, your first and last name, your postal code, your phone number if you gave one, which campaign you signed, and a shortened copy of what you wrote; and, if either applies to you, a label recording that you have donated or that you asked to hear about volunteering. Region: United States.
Eventbrite: took registrations for our events, which are free. We are not using it at the moment. Shared: your name and email address, if you registered for an event while we were using it. Region: United States.
Stripe (Stripe Payments Canada, Ltd.): takes donations through its own checkout form, and holds the payment records. Shared: your email address, your name if you give it, the amount and currency, and whether the gift is one-time or monthly. We also send it the version of the consent wording you saw and whether you ticked the volunteering box. Your card or bank details go straight to Stripe on its own form and never reach us. Region: United States.
Cloudflare: hosts the website and its server logs. Shared: everything the site receives.
Cloudflare: sits in front of the website, serves it and secures the connection, and measures visits through Cloudflare Web Analytics. Shared: every request, including your IP address. Region: North America.

We may also disclose Personal Information where a law, court order, or other lawful authority requires us to.

14. Where your information is stored

We are based in Guelph, ON. The website keeps its own database, described in How long we keep it, and Cloudflare runs it for us in the region it calls Eastern North America. That region covers eastern Canada and the eastern United States, and Cloudflare does not tell us which of them the database sits in, so we cannot tell you it stays in Canada. Some providers process or store Personal Information in the United States:

Google Analytics 4 (Google LLC): site measurement (United States)
Mailchimp: mailing list and email delivery (United States)
Eventbrite: event registrations, from when we used it (United States)
Stripe (Stripe Payments Canada, Ltd.): donation payments (United States)

While your Personal Information is in another country, it is subject to the laws of that jurisdiction and may be accessible to the courts, law enforcement and national security authorities there. We remain accountable for it.

15. How long we keep it

We keep Personal Information only as long as its purpose, or a legal or evidentiary requirement, needs it, then delete it:

Your place on our email list: We keep you in Mailchimp until you unsubscribe or ask us to remove you. We also delete contacts that have been inactive for 2 years.
Anything you send through a form on this site: We keep a record of it in the website’s own database, and we keep it until you ask us to delete it rather than on a timer. The record is your email address, which form you used, when you sent it, the wording you agreed to, the IP address you sent it from, and anything you wrote in a free-text box. It is the only evidence we will ever have that you agreed to hear from us, which is why we do not delete it automatically. What you send is passed to Mailchimp as well.
Donations: We keep a record of each donation in the website’s own database, until you ask us to delete it: your email address, the amount and currency, whether the gift was one-time or monthly, when we received it, the payment reference, the wording you agreed to, and whether you asked to hear about volunteering. Alongside it we keep the same kind of consent record described above, showing when you donated and the wording you agreed to, but with no IP address. Your card and bank details are in neither. Stripe keeps the payment records under its own retention policy.
The petition messages we send on your behalf: A copy is kept in the website’s own database as part of the record above, and in Mailchimp alongside your contact record.
Event registrations: We are not using Eventbrite at the moment, and it still holds the registrations from when we were, under its own retention policy.

16. How we protect it

We protect Personal Information with safeguards appropriate to its sensitivity: the website’s own database holds only what a consent or donation record needs, and never card or bank details, which stay with the payment provider; this site is served over HTTPS, so what you send us is encrypted on the way; and we limit access to the people who need it to run our campaigns. No system is perfectly secure, and we do not promise that. We notify you and the regulator when the law requires it (If there is a breach).

17. Seeing, correcting and deleting your information

You can ask us to:

show you the Personal Information we hold about you, how we have used it, and who we have shared it with;
correct anything wrong or incomplete;
delete it: we will delete what we hold, and tell you if anything has to stay;
stop using it in a particular way.

Email privacy@getinvolvedguelph.ca and tell us what you want. We may need to check who you are first, so that we do not hand your Personal Information to someone else.

We answer within 30 days. If we need longer, we will tell you inside those 30 days why, and when you will hear from us. If we cannot do what you asked, we will tell you why, and how to take it further.

A message already sent on your behalf cannot be recalled (Messages we send on your behalf).

18. If there is a breach

If Personal Information we hold about you is lost, stolen, or accessed by someone who should not have it, and there is a real risk of serious harm to you, we will tell you as soon as we can. We will say what happened, what information was involved, what we are doing about it, and what you can do.

Where a breach affects information covered by PIPEDA, we will also report it to the Privacy Commissioner of Canada as the Act requires.

We keep a record of every such incident, and we keep it for as long as the law requires.

19. Who is accountable, and how to complain

Our Privacy Contact at Get Involved Guelph is responsible for how we handle Personal Information and for this policy.

Email: privacy@getinvolvedguelph.ca
Mail: Get Involved Guelph, 52 Arthur Street North, Guelph, Ontario, N1E 4T8

If you are unhappy with how we have handled your Personal Information, tell us first. We will look into it and tell you what we found and what we changed. We will get back to you within 30 days.

If our answer does not resolve it, you can complain to the privacy regulator that oversees us:

Office of the Privacy Commissioner of Canada, which oversees PIPEDA, for the sponsored and donation parts of our work. priv.gc.ca

20. Links to other websites

Get Involved! Guelph links to websites we do not run, including the City of Guelph, news coverage, and our Facebook and Instagram pages. This policy does not cover them, and we do not control what they collect. Read their own privacy policies before giving them your information.

21. Changes to this policy

When we change this policy, we post the new version at /privacy-policy and update the “Last updated” date at the top. If a change expands what we collect or how we use it, we will tell you before it takes effect and, where the change needs your consent, we will ask for it.

22. The rules we follow

Most of what we do is not commercial. Our campaigns, our election coverage, our blog and our email updates sit outside Canada’s federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), so it does not reach them. Ontario, where we are based, has no general private-sector privacy law of its own. Most of the people we hold information about are in Ontario as well, but our petitions and our donation page are open to anyone, so some may live in a province that does have one. For those activities we follow PIPEDA’s standard because we think you should be able to expect it, not because a law requires it of us. PIPEDA does apply to the parts of our work you sponsor or donate to, described in Donations and sponsorship. For that information you have rights under the Act, including the right to complain to the Privacy Commissioner of Canada.

Where we follow PIPEDA’s standard by choice rather than by law, that is a commitment we make in this policy. If we do not live up to it, tell us. The last section explains how.

We apply this policy to everyone we hold information about, wherever you live. Where a law that applies to us gives you more than this policy promises, that law governs.

Privacy policy