PROTECTION OF PRIVACY POLICY

While the procedural rules governing the conduct of its dispute resolution services provide for confidentiality safeguards, as outlined in the policies under which it operates, Sport Dispute Management cannot be held responsible for the conduct of the Parties, Authorized Representatives, or witnesses involved in complaint processes which may cause unlawful disclosure of Personal Information that forms part of the evidentiary record before Sport Dispute Management.

In delivering most of its services virtually, Sport Dispute Management shall take reasonable steps to prevent unauthorized access to Personal Information in electronic form while stored on its own servers, however, it cannot be held responsible for any breach caused by email or Internet service providers of intended email recipients.

Sport Dispute Management’s websites provide links to third party websites. Sport Dispute Management is not responsible for the collection, use or disclosure of Personal Information obtained by those third party websites. It is strongly recommended that Sport Dispute Management’s website visitors consult the privacy policies of those third parties before disclosing any Personal Information.

The distribution of the information received in a complaint process is subject to the requirements of the policy under which it was received and that policy takes precedence over the terms described here.  

Sport Dispute Management Inc. (Sport Dispute Management) focuses its practice on the administration of sport disputes in accordance with policies and procedures developed by National Sport Organizations, Provincial/Territorial Sport Organizations and Multi-Sport Organizations. 

The Sport Dispute Management Protection of Privacy Policy (“the Policy”) is based on the ten principles outlined in the Model Code for the Protection of Personal Information of the Canadian Standards Association and in the PersonalInformation Protection and Electronic Documents Act’s (“PIPEDA”) fair information principles.

The purpose of this Policy is to describe the way that Sport Dispute Management collects, uses, retains, safeguards, discloses and disposes of Individual’s Personal Information. 

The Policy may be updated or modified from time to time by Sport Dispute Management for any reason, including to account for the introduction of new technologies, business practices, stakeholder needs or applicable laws and regulations.

Authorized Representative: any lawyer or any other person so designated in writing by the Individual, or, in the case of a minor Individual who is not emancipated, any parent, legal guardian or authorized representative representing a party to a complaint process.

Document Management Program: the software platform used by Sport Dispute Management in the management of documents for complaint proceedings and/or its business operations.

Clients: the individuals or organizations who retain Sport Dispute Management’s services.

Complaint: a submitted complaint intake form or information expressly deemed by Sport Dispute Management to constitute a complaint.

Complaint Management Program: the software platform used by Sport Dispute Management in the management of Complaints to share information internally and with the Contractors, Clients and those authorized by Clients to receive the information.

Contractor: any person retained by Sport Dispute Management to execute tasks in the conduct of its operations in exchange for monetary compensation or co-op education credits. 

Express Consent: consent given electronically, in writing or orally when necessary by an Individual, which mustalways be unequivocal and not require inference on the part of Sport Dispute Management.

Implied Consent: consent that can be reasonably inferred from an Individual’s actions or inaction.

Individual: a person whose Personal Information is collected, used, disclosed or retained by Sport Dispute Management including, but not limited to, Party(ies) and Clients.

Party(ies): user of Sport Dispute Management’s dispute resolution services, including but not limited to, acomplainant, a respondent, an affected party, each as defined in the policies under which Sport Dispute Management operates.

Personal Information: means any information provided to or collected by Sport Dispute Management about an identifiable individual, or an individual whose identity may be inferred or determined from the information. This Policy applies regardless of how Personal Information is recorded (for example, electronically, or on paper). This Policy does not cover any information about more than one individual where the identity of the individuals is not known and cannot be inferred from the information ("Aggregated Information"). Sport Dispute Management retains the right to use Aggregated Information in any way that it reasonably determines is appropriate. This Policy also does not apply to information about companies or other legal entities.

Sport Dispute Management takes the protection of Personal Information seriously.  Sport Dispute Management requires all Contractors and others who provide services in connection with the delivery of services to our Clients to comply with these obligations.   

a)  Sport Dispute Management collects Personal Information that is necessary for its operations and/or required by law.  This includes the categories of information described below as well as any other Personal Information voluntarily provided to us.

b)  Sport Dispute Management’s operations minimally require last names, given names, and contact information (email address and/or telephone number), confirmation of identity or authority of Contractors, Clients, Parties and, if applicable, their Authorized Representatives.

c)  Sport Dispute Management is also seized by the Parties or their Authorized Representatives of certain Personal Information through the evidentiary record and submissions filed in the course of dispute resolution proceedings, through the Complaint management process or administration of the policies under which it operates, such as health information, criminal offences, last name, given name, contact information, and information relating to complaints against individuals and related sanctions. Personal Information provided by the Parties or their Authorized Representatives, including without limitations, financial information, health information, last name, given name and contact information, information regarding Complaints or other information about procedures before Sport Dispute Management, may also be collected in order to determine the admissibility to certain programs offered by Sport Dispute Management’s Clients (e.g. mental health referrals) and in order to offer such programs to the eligible Parties.

d)  Sport Dispute Management collects Personal Information from its Contractors which includes, but is not limited to, financial information, last names, given names and contact information.

e)  Sport Dispute Management’s Complaint Management Program may collect cookies on user accounts such as IP addresses, sections of portal visited, and information downloaded.

f)  Sport Dispute Management’s websites may also collect non-identifiable information such ascookies including, but not limited to, IP addresses, sections of website visited, and informationdownloaded.

g)  In some cases, Sport Dispute Management collects Personal Information from regulatory and legal authorities, other organizations with whom Sport Dispute Management or Individuals have dealings, such as government agencies, credit reporting agencies, recruitment agencies, information or service providers, and from publicly available records.  Sport Dispute Management may also collect information from public sources in the context of an investigation or proceedings related to legal services and/or complaint administration services Sport Dispute Management is providing to one of its Clients. 

a)  The purposes for which Personal Information is collected by Sport Dispute Management are enumerated in Appendix A.

b)  Sport Dispute Management will inform the Individual of the applicable purposes at or before the time that the Personal Information is collected and used by referring the Individual to this Policy.

c)  Under no circumstances will Sport Dispute Management sell any Personal Information it has obtained.

a)  Except when it is reasonable to think that implicit consent was given, in case of emergency or when not required by law, Sport Dispute Management must obtain valid consent from the Individual, or Authorized Representative, at or before the time of collection for the use and disclosure of Personal Information.

b)  Except when permitted by law, if the Personal Information collected is to be used for purposes not originally agreed upon by the Individual, Sport Dispute Management will notify and obtain consent for any new purposes for which it intends to use such information.

a)  An Individual or their Authorized Representative’s provision of Personal Information to Sport Dispute Management means that they agree to the collection, use and disclosure of their Personal Information under this Policy.  If they do not agree to these terms, they should not provide any personal information to Sport Dispute Management.  However, while providing some Personal Information to Sport Dispute Management is optional, certain services can only be offered if the Individual’s Personal Information is provided and Sport Dispute Management may not be able to offer certain services if the Individual chooses not to provide the required Personal Information.

b)  Consent can either be Express Consent or Implied Consent and may be provided by the Individual or by an Authorized Representative. In determining the form of the consent required, Sport Dispute Management will take into account the sensitivity of the Personal Information and the reasonable expectations of the Individual. Notwithstanding the above, except when permitted by law, Sport Dispute Management shall seek Express Consent when the Personal Information is likely to be considered sensitive.

a)  Sport Dispute Management shall only collect Personal Information by fair and lawful means necessary for the identified purposes. This may include (a) for the purpose of determining whether Sport Dispute Management will enter into a professional relationship with a client (b) during the course of a professional relationship with a client, or (c) when Sport Dispute Management otherwise is required to collect Personal Information, for example during the administration of a Complaint process. 

a) Sport Dispute Management shall only use and disclose Personal Information for the identified purposes and such purposes shall be limited solely to fulfilling the necessary functions of Sport Dispute Management.

a)  Last name and given name may be shared with other Parties involved in the same dispute or Complaint and with their Authorized Representatives during the proceedings.

b)  Personal Information described in section 2.1 c) may, at the sole discretion of the Sport Dispute Management and/or by any Contractor in the course of an investigation, adjudication, appeal or mediation be disclosed in the investigation report and/or adjudicator’s decision when necessary to provide reasoning for the decisions rendered.

c)  Any Personal Information described in section 2.1 c) that is disclosed in an adjudicator’s decision and that allows for the identification of an Individual against whom a violation has been asserted shall be published, retained and distributed in accordance with the complaint management policy under which the complaint underlying the adjudicator’s decision was administered.

d)  Personal Information described in section 2.1 d) shall be used strictly for purposes of human resources management, governance and activities of Sport Dispute Management respectively.

e)  Where possible and if it can serve the same purpose, the Personal Information described in sections 2.1 e) and 2.1 f) will be used in aggregate forms.

f)  Access to, use and disclosure of Personal Information will be limited to Sport Dispute Management’s Contractors in accordance with the reasonable limits required to fulfill their duties and responsibilities with Sport Dispute Management.

g)  Personal information that is subject to a request shall be retained for as long as is necessary to allow the Individual to exhaust any recourse that he/she may have, provided the request is made prior to its deletion.

h)  Any Personal Information collected by Sport Dispute Management shall be managed in accordance with the Safeguards and Security standards stated in Section 7.

a)  Personal Information shall be retained only as long as reasonably necessary and still relevant for the purposes for which it was collected.

b)  Procedures for the retention and archiving of Personal Information shall be in accordance with the Safeguard and Security standards stated in Section 7.

a)  Sport Dispute Management will take reasonable steps to ensure that Personal Information is accurate, complete, and as up-to-date as is necessary for the identified purposes.

b)  Sport Dispute Management requires that each Individual be responsible to provide accurate Personal Information and to ensure it remains current by communicating any changes promptly to Sport Dispute Management.

c)  Sport Dispute Management is not responsible for any loss of services resulting from Individuals who fail to advise Sport Dispute Management in writing of any changes to their Personal Information on file.

a)  Sport Dispute Management has implemented safeguards to protect against loss, theft, unauthorized access, disclosure, copying, use or modification of Personal Information. Sport Dispute Management commits to maintain those measures or equivalent ones as they may be modified from time to time.

b)  The security methods employed by Sport Dispute Management include, but are not limited to:

i.  Physical measures including, but not limited to, retaining no hard copy documents or materials and immediately shredding any printed materials after use.

ii.  Administrative measures including, but not limited to, appointing a Privacy Officer, limiting access to data on a need-to-know basis and requiring Contractors to sign confidentiality agreements before providing access to Personal Information; and

iii.  Technological measures including, but not limited to, data transmission protocols, applying reasonable standards of data security to the Complaint Management Program and retaining emails and documents only on the Document Management Program.

a)  Access to Personal Information stored on Sport Dispute Management’s Complaint Management Program and Document Management Program is restricted to each Contractor’s/Contractor’s responsibilities and needs.

b)  Sport Dispute Management’s Complaint Management Program and Document Management Program deploy the following data protection measures: 

·  Password protection with minimum requirements; 

·  Two-factor authentication;

·  AES 256-bit encryption;

·  TLS encryption;

·  SOC 1 Type II, SOC 2 Type II, SOC 3 compliance ;

·  Network protection through isolated networks and firewalls;

·  Regular Virus scanning;

·  Ransomware protection;

·  Highly secure data centers;

·  Automatic backups;

·  Automatically scanning updates for malware or illegal content;

·  End-to-end encryption for backups, uploads and downloads

c)  Sport Dispute Management is compliant with PIPEDA and HIPAA standards

End-to-end encryption for backups, uploads and downloads. 

d)  Any necessary transfer of Personal Information held by Sport Dispute Management shall be transferred through the Complaint Management Program and Document Management Program with limited transmission via email.  All transmissions of Personal Information will be in non downloadable, non printable formats. 

e) Sport Dispute Management’s Chief Executive Officer is the only person with access to Contractor personnel files.

a)  All Contractors are made aware of the importance of maintaining the security and confidentiality of Personal Information by Sport Dispute Management.

b)  All Contractors shall execute an agreement which binds them to this Policy and the relevant provisions of the policy under which the complaint(s) they are addressing are administered.

c)  Parties and their Authorized Representatives are bound by the relevant provisions of the policy under which their complaint is administered which stipulate that they and any other persons attending the proceedings on their behalf shall not disclose any information or document obtained through their participation in the resolution process, unless required by law.

a)  Personal information will be destroyed, deleted, permanently anonymized or, in the case of paperfiles, shredded, once it is no longer relevant or necessary for the purposes of the collection.

a)  The role of the privacy officer is to ensure that the Policy complies with applicable privacy laws andregulations, to monitor Sport Dispute Management’s compliance with the Policy, and to report and respond to privacy complaints and breaches.

b)  The privacy officer oversees the implementation of Sport Dispute Management’s other policies and procedures which also contribute to the protection of Personal Information.

c)  The privacy officer may be contacted by email at privacy@sportdispute.com. 

a)  The Policy shall be made publicly available through Sport Dispute Management’s website(s) and upon request.

b)  Sport Dispute Management shall make accessible, through the Policy or otherwise:

i.  A description of the type and purpose of Personal Information gathered;

ii.  The methods for Individuals to gain access to their Personal Information on Sport Dispute Management’s records; and

iii.  Where Personal Information is shared with third parties, a justification for giving access to those third parties.

a)  Amendments to the Policy shall be made publicly available, after their adoption but at least one (1) month prior to becoming effective, through Sport Dispute Management’s website or upon request. It is recommended to Individuals sharing Personal Information with Sport Dispute Management to check the Policy regularly for changes and updates.

a)  In the event that there are any discrepancies between applicable privacy legislation and the Policy, the applicable privacy legislation shall take precedence.

Subject to section 7.4,

a)  It is the right of any Individual to access his or her Personal Information upon written request to the Sport Dispute Management’s privacy officer;

b)  Sport Dispute Management shall also provide, upon written request, basic information regarding the use of the Individual’s Personal Information, including disclosure to third parties;

c)  The Individual is entitled to request the correction of any demonstrable errors, in writing; and

d)  Where necessary for the conduct of its operations or the maintenance of services and benefits to the Individual, Sport Dispute Management shall transmit the amended Personal Information to Contractors and third parties with authorized access.

a)  Only requests made in writing by Individuals having properly identified themselves or by Authorized Representatives having the proper authority on behalf of such Individual to obtain the requested Personal Information may be fulfilled.

b)  Proper identification of the requestor shall include two government issued identification document (passport, driver’s license, birth certificate, etc.), at least one of which must bear a photo of the requestor.

a)  Sport Dispute Management shall respond no later than 30 days from the date of receipt of a written request by an Individual.

b)  Under reasonable circumstances including, but not limited to, requests of voluminous information, impracticable requests, or requests requiring a conversion of information, Sport Dispute Management may require an extension of time beyond the 30-day time limit. In such cases, the requestor will be notified in writing before the expiration of the 30 days, of the reasons for extending the time limit and of their right to make a complaint to Sport Dispute Management’s privacy officer in respect of the extension.

a)  Sport Dispute Management may require the Individual requesting a response to pay a cost for the response.  The individual will be advised of the approximate cost and must make payment before the requested information will be provided.

a)  Sport Dispute Management may refuse a correction request, with reasons, under certain limitedinstances including, but not limited to, where the Individual fails to provide sufficient proof that such information is incorrect. When it is impossible to amend a document, the correction shall be made by a note to file.

b)  Despite a general right to access Personal Information upon request, Sport Dispute Management may refuse an access request with reasons provided.

c)  Sport Dispute Management may err on the side of caution and deny an access request in certain situations such as, but not limited to:

i.  Fulfilling the access request may cause harm to the Individual or to another Individual;

ii.  Fulfilling the access request may compromise the administration, investigation or preparation for adjudication of a Complaint;

iii.  Fulfilling the access request would reveal Personal Information of another Individual that is not severable without his or her consent, and is not needed to avoid harm to that other individual; or

iv.  Any reasonable doubt exists in the proper identification or authority of the requestor, whether the Individual or the person alleged to have authority to act on behalf of the Individual.

d)  Sport Dispute Management may, where reasonable and possible, allow access to Personal Information in a redacted form in order to avoid harm.

e)  Sport Dispute Management will be deemed to have refused an access request if it fails to respond within the 30-day time limit.

a)  All written privacy inquiries, concerns and complaints are to be forwarded to the Sport Dispute Management’s privacy officer upon receipt.

a)  When an Individual makes an inquiry or lodges a concern or a complaint regarding a possible confidentiality breach by:

i.  a Party, the privacy officer shall refer the Individual to the relevant provisions of the policy applicable to their complaint process on breaches of such policy;

ii.  a Contractor, the privacy officer shall refer the Individual to this Policy.

b)  Unless the privacy officer determines that there is sufficient cause to handle the inquiry, concern or complaint in another manner, Sport Dispute Management will investigate all concerns and complaints.

c)  The privacy officer will complete an initial review of any concerns or complaints within a reasonableperiod of time. In any event, the privacy officer will inform the Individual having lodged the concern or complaint of the progress of the review with an estimated date of completion.

d)  If a concern or complaint is not resolved to the satisfaction of the Individual, Sport Dispute Management will:

i.  record the substance of the unresolved concern or complaint with the relevant records about the Individual; and

ii.  where appropriate, transmit the existence of the unresolved concern or complaint to any third parties having access to the Personal Information in question.

a)  Privacy breaches include, but are not limited to, any inadvertent or intentional theft or loss of Personal Information, any unauthorized collection, use or disclosure of Personal Information, any unauthorized modification or destruction of Personal Information, or any non-compliance with this Policy.

b)  The privacy officer is obligated to ensure, minimally:

i.  Containment from further harm and unauthorized theft, loss, use, or disclosure;

ii.  Prompt notification of all affected, or possibly affected, Individuals;

iii.  Investigation of the breach, including a review of relevant systems and policies, and practices and procedures; and

iv.  Recommendations to the Chief Executive Officer of Sport Dispute Management for remediation, rectification and, where appropriate, disciplinary measures.

c)  The privacy officer shall keep a record of all incidents and notifications with supporting reasons and inform the Individual of the outcome of the investigation regarding his or her concern or complaint.

a) As deemed necessary, Sport Dispute Management’s Board of Directors, may initiate an independentaudit of its own compliance with the Policy.

Sport Dispute Management collects Personal Information in respect of Individuals for the purposes set out below:

·  to assist the Individuals with administrative or technical support in the use of Sport Dispute Management’s Document and Complaint Management Programs, systems and services;

·  to collect the Individuals’ opinions and comments in regard to Sport Dispute Management’s operations;

·  such other collections and uses of Personal Information from such persons and for such purposes for which Sport Dispute Management may obtain consent from time to time; and

·  as otherwise required or permitted by law.

·  to respond to the Individuals’ complaints or inquiries;

·  to receive, process, administer, investigate, mediate and adjudicate Complaints related to the matter the policy relevant to their complaint process;

·  as part of the Individuals’ requests for Sport Dispute Management’s dispute resolution services or dispute prevention services;

·  as part of the Individuals’ applications to participate in one of Sport Dispute Management’s programs;

·  to advise Individuals about new programs and services that may be of interest to them or to their organizations;

·  to monitor the use of the Complaint Management Program and Document Management Program and detect possible fraudulent attempted use; and

·  for the purposes of statistical reporting and clients’ sport profiles.

·  to organize events involving their participation;

·  for the purpose of recruitment for positions at Sport Dispute Management;

·  for the purpose of the administration of Sport Dispute Management’s policies and procedures regarding the training, retention and evaluation of Contractors;

·  for the purposes of coaching, mentoring and professional development;

·  for the purposes of managing productivity, including making accommodations and allowances;

·  to refund admissible expenses incurred by Contractors in the form of invoices, receipts and travel information;

·  from Third Party providers of benefits, pension arrangements and insurance and other related Contractor services, for the purpose of providing compensation and such services and fulfilling taxation requirements in respect of same; and

·  to comply with other requirements imposed by law including, but not limited to, collecting Personal Information as required by applicable workplace insurance and safety legislation and occupational health and safety legislation.