I'M NEW
PRIVACY

Privacy Policy

We respect your privacy and are committed to protecting the information you share with us.

TRANSFORMATION COMMUNITY CHURCH
Privacy Policy
Effective date: September 9, 2026
Approved by: Board of Directors

Our commitment

Transformation Community Church (“TCC,” “we,” “us” or “our”) respects the dignity and privacy of every person we serve. This
policy explains how we collect, use, disclose, safeguard, retain and dispose of personal information in a fair, transparent and
secure manner.

  1. Intent
    1.1 This policy establishes TCC’s requirements for responsible handling of personal information.
    1.2 TCC follows the ten fair information principles reflected in Canada’s Personal Information Protection and Electronic
    Documents Act (PIPEDA) and will comply with applicable federal and Manitoba privacy, employment, charitable, taxation,
    safeguarding and records-management laws.
    1.3 TCC is accountable for personal information under its control. The Board of Directors provides oversight, church leadership
    supports implementation, and the designated Privacy Officer administers this policy.
  2. Application
    2.1 This policy applies to TCC and to anyone who handles personal information on its behalf, including employees, officers,
    directors, ministry leaders, contractors and volunteers.
    2.2 It applies to personal information in any form, including paper, electronic, visual, audio and verbal information.
    2.3 TCC may handle information as required or permitted by law. Where a legal requirement conflicts with this policy, the legal
    requirement will govern.
  3. Privacy practices
    3.1 Personal information
    Personal information is information about an identifiable individual. Depending on the context, it may include:
  • Identity and contact information, including name, address, telephone number, email, signature and date of birth
  • Government identifiers, including Social Insurance Number and driver’s licence information
  • Demographic information, including citizenship, language, family status, religion and other characteristics provided
    voluntarily or required for a lawful purpose
  • Family, parent, guardian, emergency-contact and next-of-kin information
  • Health, accessibility and safety information, including allergies, accommodations, medical and emergency details
  • Financial information, including payroll, benefits, banking, payments and reimbursements
  • Donation information, including gift history, payment details, tax-receipt information and communication preferences
  • Employment, applicant and volunteer records, including resumés, screening, attendance, compensation, evaluations,
    complaints and termination records
  • Ministry information, including membership, attendance, registrations, participation, spiritual care, prayer requests and
    pastoral communications
  • Internal records, including reports, safeguarding records, meeting notes, opinions and assessments
  • Photographs, audio and video recordings, livestream images, security-camera recordings and access-control records
  • Technology information, including account identifiers, device, browser, IP address, website or app activity, communications
    and access logs
  • Other information provided during an individual’s relationship with TCC

  • 3.2 Collection and use
    TCC will identify its purposes before or at collection, collect only what is reasonably necessary, and use fair and lawful means.
    Purposes may include:
  • Providing worship services, pastoral care, prayer support and membership processes
  • Registering individuals for ministries, events, facility use, trips, camps and activities
  • Communicating ministry opportunities, schedules, service updates and emergency notices
  • Maintaining relationships with attendees, members, volunteers, donors, staff and community contacts
  • Recruiting, screening, scheduling, supporting and supervising employees and volunteers
  • Administering employment, payroll, benefits, performance and workplace safety
  • Protecting children, youth and vulnerable persons through appropriate screening and safeguards
  • Responding to medical, safety, security, pastoral or other emergencies
  • Processing donations, issuing charitable tax receipts and maintaining required financial records
  • Managing facilities, access control, insurance, risk, complaints and incident investigations
  • Operating and securing our website, mobile services, email, databases, networks and online accounts
  • Meeting legal, regulatory, contractual, audit, insurance, archival and historical-record obligations
    Video surveillance
    TCC may use security cameras to protect people and property and to investigate incidents. Access is restricted to authorized
    persons, and recordings are retained only as reasonably necessary or required for legal, insurance or preservation purposes.
    Website, mobile and online services
    Our digital services may collect information that a person submits, along with limited technical information such as device type,
    IP address, browser, app activity and diagnostic data. Cookies or similar technologies may be used for essential operation,
    security, preferences and service improvement. Where required, we will request consent. Users may manage optional cookies
    through their browser or device settings.
    TCC will identify any materially new use and seek further consent where required.

  • 3.3 Ten privacy principles
    Accountability
    TCC is responsible for information under its control, including information handled by service providers. Everyone covered by
    this policy must protect the information they handle.

  • Identifying purposes
    TCC will identify and document why information is needed before or at collection.

  • Consent
    TCC will seek meaningful consent unless applicable law permits or requires otherwise
  • Limiting collection
  • Collection will be fair, lawful and limited to identified purposes.
  • Limiting use, disclosure and retention
  • Information will be used, disclosed and retained only for identified or related purposes, or as permitted by law.
  • Accuracy
  • TCC will keep personal information sufficiently accurate, complete and current for its intended purposes.
  • Safeguards
  • Safeguards will reflect the information’s sensitivity, amount, format and location.
  • Openness
  • TCC will make understandable information about its privacy practices available.
  • Individual access
  • Individuals may request access to and correction of their information, subject to applicable exceptions.
  • Challenging compliance
  • The Privacy Officer will investigate privacy questions or complaints and address justified concerns.
  • 3.4 Consent
  • TCC will explain the nature, purpose and reasonably foreseeable consequences of handling personal information. Consent may
  • be express or implied depending on sensitivity, reasonable expectations and circumstances.
  • Express consent may be written, electronic, oral or provided by an authorized representative. It will generally be required for
    sensitive information, unexpected purposes or a meaningful risk of significant harm.
  • Consent may be implied when an obvious purpose leads an individual to provide information voluntarily.
  • For a person unable to consent, TCC may seek consent from an authorized representative, considering maturity, capacity
    and best interests.
  • Participation will not be conditional on consent to unnecessary collection, use or disclosure.
    A person may withhold or withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. TCC
    will explain foreseeable consequences, which may include being unable to provide a requested ministry, program, service,
    benefit or tax receipt. Withdrawal does not affect actions already taken on valid consent or require destruction of information
    that TCC must or may lawfully retain.

  • 3.5 Disclosure
    TCC does not sell or trade personal information, donor lists, membership lists or fundraising lists. Disclosure is limited to
    identified purposes, consent or law, including:
  • Employees, volunteers, leaders or committees who need the information for authorized responsibilities
  • Service providers, including payroll, donation and payment processors, audit, insurance, legal, technology, screening,
    communications and mailing providers
  • Government, law-enforcement, child-protection, emergency or other legally authorized bodies
  • An appropriate representative in an emergency
  • Authorized investigations, proceedings, insurance matters, debt collection or protection of legal rights
  • A disclosure requested or authorized by the individual Service providers will receive only the information reasonably necessary to perform their services and will be expected to use
  • reasonable safeguards. Some providers may process or store information outside Manitoba or Canada, where it may be subject
  • to the laws of that jurisdiction. TCC will provide appropriate notice and assess relevant privacy and security risks.
  • 3.6 Safeguards
  • TCC will protect information against loss, theft and unauthorized access, use, disclosure, alteration or destruction. It will assess
  • privacy risks when introducing or materially changing programs, technologies, systems or processes.
  • Safeguards proportionate to sensitivity and volume may include:
  • Physical controls such as secure records, restricted areas and access controls
  • Organizational controls such as confidentiality commitments, training, need-to-know access, role-based permissions,
    supervision and approved records-handling procedures
  • Technical controls such as individual accounts, strong authentication, encryption, backups, security logging and timely
    removal of access
  • Privacy-conscious communications, including verifying recipients and concealing email addresses when appropriate
  • Continuing confidentiality obligations after a person’s role ends
    Employees and volunteers must use approved systems and storage locations for TCC records, must not share credentials, and
    must promptly report suspected loss, misdirection, unauthorized access or any other privacy concern to the Privacy Officer.
    Personal information must not be displayed publicly or shared internally unless authorized and reasonably necessary.

  • 3.7 Retention and secure destruction
    Retention will reflect operational, legal, tax, audit, insurance, safeguarding, employment, archival and historical requirements.
    Information will be kept only as reasonably necessary or legally justified.
    When information is no longer required, TCC will securely destroy it or remove identifying details. Paper records will be
    cross-cut shredded or securely destroyed. Electronic records will be securely deleted through approved processes, recognizing
    that copies may temporarily remain in routine backups. Destruction may be suspended for a complaint, investigation, audit,
    legal hold or anticipated proceeding.

  • 3.8 Privacy incidents and breach response
    Actual or suspected privacy incidents must be reported immediately to the Privacy Officer, who will coordinate containment,
    evidence preservation, assessment, documentation, mitigation, recovery and required notifications.
    TCC will assess the sensitivity of the information, probability of misuse, number and circumstances of affected individuals, and
    potential consequences. Where required, TCC will notify affected individuals, the Office of the Privacy Commissioner of Canada
    or another authority as soon as feasible. Where PIPEDA applies, TCC will retain required breach records and report breaches
    that create a real risk of significant harm.

  • 3.9 Privacy Officer
    The Privacy Officer is the primary contact for privacy matters and supports implementation, monitors access and safeguards,
    coordinates training, reviews service-provider protections, responds to incidents, and handles access, correction and complaint
    requests. Administrative duties may be delegated, but oversight remains with the Privacy Officer and ultimate accountability
    with TCC’s leadership and Board of Directors.

  • 3.10 Access and correction
    An individual may submit a written or electronic request to learn whether TCC holds their personal information, obtain access to
    it, understand how it has been used or disclosed, or request a correction. TCC may request information reasonably necessary
    to verify identity and locate records. Verification information will be used only for that purpose.
    TCC will respond within a reasonable time and any period required by law. Where PIPEDA applies, TCC will normally respond
    within 30 days, subject to a lawful extension. Access will generally be provided at no cost.

TCC may limit or refuse access where information:

Must or may otherwise be withheld under applicable law
Where access is limited or refused, TCC will provide the reason and available recourse unless prohibited by law. If information
is inaccurate or incomplete, TCC will correct it as appropriate and, where necessary, notify parties that received the incorrect
information. If a requested correction is not made, TCC may annotate the record with the unresolved request.


3.11 Children and youth
TCC takes additional care with information about children and youth. We will collect only information reasonably needed to
provide programs, maintain safety, communicate with parents or guardians, and meet legal or safeguarding responsibilities.
Consent will be obtained from a parent, guardian or authorized representative where appropriate, considering the young
person’s age and capacity. We do not knowingly use children’s information for behavioural advertising or sell it.


3.12 Questions and complaints
Individuals may ask the Privacy Officer about compliance. TCC will record and promptly acknowledge the matter, review it fairly
and impartially, communicate the outcome and reasons, and take appropriate corrective action where justified.
If a person is not satisfied with the Privacy Officer’s response, they may request an internal review by TCC leadership and then
the Board of Directors. This does not limit any right to contact the Office of the Privacy Commissioner of Canada or another
body with jurisdiction.


Privacy contact
For access, correction, questions, complaints or withdrawal of consent:
Email: connect@tccwpg.com
Mail: Transformation Community Church, 167 Lombard Avenue, Suite 500, Winnipeg, Manitoba, Attention: Privacy Officer


3.13 Policy review and training
The Privacy Officer will periodically review this policy and recommend revisions. The current approved version supersedes
earlier versions. TCC will provide role-appropriate privacy training to employees, ministry leaders and volunteers.