平台隐私政策

Effective October 27, 2026. UTSCCSSA is responsible for personal information handled through its website, events platform, internal workspace and SA's Study Room features. NLB Studio is the development credit, not a replacement for the organization responsible for privacy. External services may have separate policies.

Information and purposes

We process account and contact details to create, verify and protect accounts; registration answers, orders, payment verification, refunds and check-in records to operate events and tickets; and submitted messages, forms, attachments and feature records to provide the services you use. Internal members may also provide department and role information for organizational review and collaboration.

Some events request emergency contacts, relevant health or accessibility information, age or guardian information, signatures and waivers for safety, emergency arrangements and records of acknowledgement. Read the event notice first, provide only relevant information, and obtain appropriate authorization before providing someone else's details. Required fields support the stated service; optional fields may be left blank. If you do not provide necessary information, we may be unable to provide that service.

IP addresses, request and device/browser information, timestamps, sessions and security events support delivery, troubleshooting and abuse prevention. The contact form includes your source IP and submission time in the message to its recipients. Cookies and local/session storage support authentication, preferences and drafts. Clearing them may sign you out or remove drafts.

Access, providers and disclosure

Authorized personnel use the platform's existing account, role, position and activity permissions. Some administrative roles can access records across activities. Registration records, payment verification and signed documents have authorization checks and are distinct from public content. Be careful when posting to public or shared areas.

Hosting, database, email and payment providers process information needed for their services, including Titan email and Stripe where card payments are used. Providers and infrastructure may be in Canada or abroad and subject to local laws. Embedded maps, video, external images and links may expose IP and browser information to third parties. AI content-production tools process the material submitted by operators; they are not required for activity registration and should not receive unrelated personal or sensitive information. Contact us for details of applicable providers and arrangements. Disclosure may occur with appropriate authorization, for the relevant service, urgent safety needs or legal requirements; new non-essential purposes require appropriate notice and consent.

Choices and retention

Registration and waiver signatures do not subscribe you to marketing. Marketing is an independent, default-off choice with consent and withdrawal records. Use email preferences or the no-login link in a marketing message to unsubscribe. Essential verification, order and security messages continue, and internal task reminders have their own setting.

Records have different operational, accounting, dispute-resolution, security and legal retention needs; there is no single automatic deletion deadline for all categories. Cancellation, archival and account closure do not immediately delete every related record. Current closure removes some account information, while orders, registrations and signed records may remain. Recovery backups are separate; online deletion may not immediately remove existing backup copies. Ask about a specific category or request deletion; we will review its purpose, legal retention requirements and technical constraints and explain applicable limits. A backup rotation period is not the retention period of all personal information.

Requests, safeguards and changes

We use HTTPS, account verification, role permissions and private-file access checks; no system guarantees absolute security. You can edit available profile fields, request account closure, or send an access, correction, withdrawal, deletion or privacy concern through the contact form. Requests reach designated organization recipients, including the presidency team and designated platform maintenance personnel. Provide a contact email and the relevant account/order and request scope; do not send passwords, verification codes, full card numbers or unnecessary identity documents.

We may verify identity before disclosure and will respond within applicable legal deadlines. Where PIPEDA applies, access requests generally require a response within 30 days; permitted extensions require notice. We should explain a refusal and available complaint routes. The Office of the Privacy Commissioner of Canada provides information about relevant complaints. This policy's date identifies the current version. Updates do not retroactively replace consent; important new purposes or disclosures require appropriate notice and legally required consent. Event waivers address different matters and do not replace this privacy policy.