Privacy Policy

ASSOCIATION OF CONSULTING ENGINEERING COMPANIES — ONTARIO

Approved by the Board of Directors on October 2, 2025.

A. INTRODUCTION

About Association of Consulting Engineering Companies — Ontario
The Association of Consulting Engineering Companies (“ACEC-Ontario,” “we,” “our,” or “us,”) is a not-for-profit corporation in Ontario. Founded in 1975, we advocate for a favourable business climate and promote the profession of consulting engineering. ACEC-Ontario is a member organization of ACEC-Canada and the International Federation for Consulting Engineers (FIDIC), which member companies automatically join upon membership.

Our Commitment
We are committed to protecting the privacy of members, employees, volunteers, visitors to our website, acecontario.ca (the “Website”) and other stakeholders (collectively, “you” or “your”). We are accountable and transparent in how we treat Personal Information. ACEC-Ontario does not sell, rent or trade its mailing lists or other Personal Information.
https://acecontario.ca/

What is Personal Information?
“Personal Information” means information about an identifiable individual, including any information about you or that can be used to identify you, directly or indirectly. For the purposes of this Privacy Policy, Personal Information means any information provided to or collected by ACEC-Ontario about an identifiable individual. We use your Personal Information in accordance with all applicable laws concerning the protection of Personal Information.

Scope of this Privacy Policy
This Privacy Policy applies to any Personal Information provided to or collected by ACEC-Ontario through our Website, by email, facsimile, postal mail, hand delivered, verbally or any other means, in connection with our organizational activities, services, or programs.

Purpose of this Privacy Policy
The purpose of this Privacy Policy is to give you information about what Personal Information ACEC-Ontario collects, why we collect it and how we use it, as well as what happens if you choose not to disclose Personal Information to us. This Privacy Policy is based on the 10 fair information principles outlined in the Canadian Standards Association’s Model Code for the Protection of Personal Information, set out in Schedule 1 of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). We will only collect, use and disclose your personal information in accordance with this Privacy Policy. ACEC-Ontario is accountable for and transparent in how it treats Personal Information.

B. HOW ACEC-ONTARIO COLLECTS PERSONAL INFORMATION
Voluntary Collection of Personal Information:

ACEC-Ontario Privacy Policy
ACEC-Ontario may collect Personal Information about individuals provided voluntarily, either through membership registration, the Website, at an ACEC-Ontario event, or provided to us through other means. Such Personal Information could include:

• Direct interactions – we may collect personal information when you are designated as a representative, volunteer, or participant by a member organization; when you attend an ACEC-Ontario meeting or event; request information from us; subscribe to our publications; or otherwise interact with us by email, telephone, mail, or through our Website. To protect your privacy, you should not submit Personal Information unless you choose to do so.
• Automated interactions – when you use our Website we may automatically collect technical data about your equipment and browsing history using cookies and similar technologies (see section E below for more information). We may also collect certain interaction data through our Association Management System (AMS) and email communications platform. ACEC-Ontario meetings are frequently conducted via a virtual platform and may be recorded for the purposes of transcription and documentation. All meeting attendees are advised by the platform that they are being recorded at the beginning of the meeting.
• Third-party interactions – we may collect Personal Information through third-party service providers that support event registration, payment processing, or employee benefit administration. Where possible, we select providers that offer terms consistent with Canadian privacy requirements. However, we do not control the privacy practices of these third parties and recommend that you review their privacy policies before submitting Personal Information through their platforms.
  
  We may collect Personal Information from members, employees, volunteers and event participants.
  The Personal Information we collect could include:
  
• Personal identifiers such as your name, date of birth, and contact information such as mailing address, telephone number, and email address. Details about our contact with you through email, text message, postal mail, on the phone or in person.
• Dietary restrictions or accessibility needs where appropriate (e.g., when registering to participate in one of our events). We also keep a record of what you have told us about how you like to be contacted (e.g., emails only) and what you would like to receive.
• Information you provide as an employee or volunteer, including résumés, role history, and references, and any screening information required by ACEC-Ontario policy.
• Health and benefit information provided by employees for the purpose of administering benefit entitlements.
• Employee records, including information needed for payroll, statutory compliance, and internal administration.
• Website log files for recording and maintenance of data.
• Information related to registration for or participation in Association events or programs.
• Photographs and, where applicable, audio or video recordings captured at ACEC-Ontario events or virtual meetings.
• Technical information about your device such as your IP address, location or provider and your usage information and how you interact with our Website (such as pages visited and time spent), although browsing in private mode may limit the retention of certain cookie data on your own device. However, we may still collect technical information about your visit during the session. (See section E below for more information).
• Personal information received from third-party service providers (e.g., for event registration, payment processing, or benefits administration).
• Communications we send to you or receive from you, including letters, emails, and digital messages.
• Personal Information you give us that we did not request (such as Personal Information you voluntarily put into an email to us or in a comments box on our Website).
  D. OUR GUIDING PRINCIPLES

C. WHAT PERSONAL INFORMATION IS COLLECTED BY ACEC-ONTARIO

1. Accountability:
   ACEC-Ontario is responsible for Personal Information under our control. ACEC-Ontario has designated a Privacy Officer to oversee our privacy compliance program and to respond to inquiries about our privacy practices. Our Privacy Officer is accountable for ensuring that personal information is collected, used, stored, and disclosed in accordance with this Privacy Policy and applicable law.
   
   If you have questions about this Privacy Policy, how your personal information is handled, or how to exercise your privacy rights, you may contact ACEC-Ontario’s Privacy Officer at:
   Title: Executive Director
   Email communications@acecontario.ca
   
2. Identifying Purposes:
   ACEC-Ontario identifies the purposes for which Personal Information is collected at or before the time the information is collected.
   
   We use the Personal Information we collect to manage our operations and for various purposes associated with the programs and services we provide. We collect, use, and disclose Personal Information only for purposes that a reasonable person would consider appropriate in the circumstances.
   
   The main purposes for which we generally use Personal Information are:

• To manage and administer our operations and governance activities.
• To register and support participation in events, programs, and conferences.
• To process payments and issue receipts.
• To maintain contact records and manage communication preferences.
• To maintain up-to-date records of volunteers, organizational members, and event participants.
• To respond to inquiries and provide requested information.
• To track and verify registration, attendance, and participation at events and meetings.
• To administer access to ACEC-Ontario systems, websites, or platforms.
• To manage employee and volunteer relationships, including human resources, benefits, and internal administration.
• To perform data management, internal audits, and quality assurance activities.
• To analyze operational performance and improve services.
• To meet legal, financial, audit, and compliance requirements.
• To detect and prevent fraud or misuse of our systems or services.
• To protect the rights, safety, or property of ACEC-Ontario, its members, volunteers, employees, or the public.
• For any additional purposes communicated to you at the time of collection and for which consent has been obtained (where applicable).
• For purposes permitted or required by law.
  We do not collect more Personal Information than we need to achieve these purposes. If we want to collect, use or disclose Personal Information for a different purpose, we will tell you what that purpose is in writing and obtain your consent, unless the law authorizes us to do so without consent.

1. Consent:
   We only collect, use and disclose your Personal Information with your knowledge and consent. Your consent may be expressed orally, electronically or in writing or it may be implied. We are committed to obtaining meaningful consent and use clear explanations and plain language to make sure that our consent processes are understandable and user friendly.
   
   Express consent means that a person has clearly and explicitly agreed to the collection, use or disclosure of their Personal Information. Express consent may be expressed orally, electronically or in writing. Implied consent means a situation in which, even though a person has not given express consent, we assume that they have consented to the collection, use or disclosure of their Personal Information based on what they do or do not do. For example, if you register for an ACEC-Ontario event or program, we can reasonably conclude that you consent to our collection and use of the Personal Information you submit for that purpose.
   
   You have the right at any time to withdraw or cancel your consent to the collection, use or disclosure of your Personal Information by contacting ACEC-Ontario’s Privacy Officer. Withdrawals of consent only take effect from the date of cancellation. They cannot be retroactive. We will let you know if your withdrawal could have any consequences, such as no longer receiving event announcements and other Association communications.
   
2. Limiting Collection:
   ACEC-Ontario will only collect Personal Information for the purposes identified in this Privacy Policy. If we want to collect information for a different purpose, we will tell you what that purpose is in writing and obtain your consent.
   
   We will not collect, use or disclose more Personal Information than is reasonably necessary to meet the identified purposes. We will limit our collection of Personal Information to that which is necessary for the purposes identified by ACEC-Ontario. We collect Personal Information only by fair and lawful means.
   
3. Limiting Use, Disclosure and Retention:
   ACEC-Ontario will only use or disclose Personal Information for the purposes for which it was collected, unless we have your consent to use it for a different purpose or if we are required by law. If we want to use or disclose your Personal Information for a new purpose, we will advise you of this purpose in writing and obtain your consent.
   
   We keep Personal Information only as long as necessary to achieve the purposes for which it was collected although we may retain certain Personal Information indefinitely if we are required to do so by Canada Revenue Agency or by our insurers. If you have made a request to access Personal Information, we will keep that Personal Information for as long as is necessary to allow you to fully seek any remedies (exhaust any recourse) that you may have under federal and provincial legislation.
   We do not disclose or share Personal Information more widely than is necessary to achieve the purposes for which it was collected.
   
   We may share Personal Information in accordance with this Privacy Policy with the parties set out below for the following purposes:

• Other organizations in connection with our events and activities, subject to agreements requiring them to follow appropriate privacy practices.
• Third-party service providers, such as those who provide us with IT and system administration services, data analytics services, Website management, credit card and payment processing services (see Section 7 a) below) , e-commerce services, research services, project, conference, and event management services, telemarketing services, social media services, direct mail services, database management services and after hours calls management services.
• Professional advisors, such as lawyers, auditors, bankers and insurers who provide us with legal, accounting, auditing, banking and insurance services.
• Government, regulatory authorities, law enforcement, dispute resolution bodies, courts and similar entities to comply with any legal or regulatory obligation, to detect and prevent crimes or to assert or defend legal rights and interests.
• Any persons or entities where we have a legitimate business reason for doing so, such as to manage risk, to process payments to you or to someone on your behalf or to perform or carry out the terms of any contract between us subject to requirements to follow appropriate privacy practices.
• To the transferee if we transfer, sell or dispose of all or substantially all of our assets or operations.
• To anyone we reasonably believe is your agent.
• To other third parties if we have told you about them and you have given us your consent.
  We require all third parties to respect the security of your Personal Information and to treat it in accordance with all applicable legal requirements. Our third-party service providers are required to enter into contractual agreements with us that prevent them from using your Personal Information for their own purposes and require them to use your Personal Information only for specific purposes in accordance with our instructions and all applicable legal requirements.

1. Accuracy:
   ACEC-Ontario has adequate processes and safeguards in place to keep Personal Information as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. We will not routinely update Personal Information, unless such a process is necessary to fulfil the purposes for which the Personal Information was collected. ACEC-Ontario members are responsible for updating their ACEC-Ontario profile to ensure all their information is accurate. To change or modify any Personal Information previously provided to ACEC-Ontario, contact the Privacy Officer.
   
2. Safeguards:
   We will take reasonable steps to keep Personal Information in both paper and electronic format protected against loss, theft, snooping, data scraping, hacking or people collecting, disclosing, copying, using or changing it without authorization. We use security safeguards appropriate to the sensitivity of the information. Our methods of protection include:

• Physical measures — such as areas of restricted access and locked filing cabinets.
• Organizational measures — such as employee training on privacy issues, and limiting access on a “need-to-know” basis.
• Technological measures — such as passwords and encryption to protect the Personal Information in ACEC-Ontario’s custody from hackers and malicious intruders.
• ACEC-Ontario aims to inform all employees, volunteers as well as third-party service providers of the importance of maintaining the privacy and security of Personal Information. We require all third-party service providers to enter into contractual agreements that require them to respect the security of your Personal Information and to treat it in accordance with all applicable legal requirements.
  While we are committed to protecting your Personal Information, our security practices and technology measures cannot guarantee absolute security of Personal Information and we cannot ensure or warrant the security of any information you provide to us. You can reduce risk to your own Personal Information by using strong passwords, keeping your passwords confidential and following other Personal Information security best practices.
  a) Third Party Processors
  ACEC-Ontario uses a number of third-party payment processing service providers, which may change from time to time according to our needs. A list of these service providers and access information for their respective privacy policies is available on request by contacting the Privacy Officer.

1. Openness:
   ACEC-Ontario will make available to individuals specific information about our policies and practices relating to the management of Personal Information, including by posting this Privacy Policy on our Website. If you have any questions about this Privacy Policy, including how to exercise your legal rights, or if you would like specific information about how we manage Personal Information, please contact the Privacy Officer.
   
2. Individual Access:
   If you make a request to the Privacy Officer, we will inform you of the existence, use, and disclosure of your Personal Information and we will give you access to your Personal Information, if we have collected any. We will respond to your request within the time periods provided for under applicable laws.
   
3. Challenging Compliance:
   You can challenge the accuracy and completeness of the Personal Information and have it changed or corrected as appropriate if there is an error or omission by contacting the Privacy Officer. We will respond to your request within the time periods provided for under applicable laws. If we identify a gap in compliance, we will take appropriate steps to remedy the situation, including changing our policies and practices if necessary.
   
   E. INFORMATION COLLECTED THROUGH ONLINE TECHNOLOGY
   
   A cookie is a small text file that is placed on your device when you visit a website and can last either for the duration of your visit (a “session cookie”) or for repeat visits (a “persistent cookie”). We use the word “cookie” in this Privacy Policy to refer to all files that collect information in this manner.
   We only use cookies that are strictly necessary for the operation and functioning of our Website. Some of the cookies we use may be necessary for security purposes, to authenticate you and enable you to use our Website. Other cookies may not be essential but may make it easier for you to use the Website (such as by identifying you, remembering your preferences and helping you navigate the Website). We do not use cookies to help us analyze the use and performance of the Website or for advertising or tracking purposes.
   
   Our cookies may collect the following types of information:

• the frequency, date and time of your visits to our Website.
• All major browsers allow you to disable cookies. You can disable cookies by changing the setting of your Internet browser. If you disable cookies, you may be unable to use or access some features on our Website.

F. LINKS TO THIRD PARTY WEBSITES

Our Website may provide links to third-party websites. Clicking on those links may allow third parties to collect or share information about you. We cannot control these third-party websites and we are not responsible for the actions or policies of such third parties. You should check the privacy policies of third parties when visiting their website or when providing any Personal Information to them.
We may receive Personal Information when you interact with our content on third-party sites or platforms, including social media. This may include data such as registration information, comments or feedback, “likes” or shares, profile data or the fact that you viewed or interacted with our content. If you voluntarily post or submit any information on these platforms, your Personal Information may be automatically included in the posting and may be collected and used by others.
We provide access to a separate online platform for Continuing Professional Development (CPD): https://engineeringcpd.ca/ (the “CPD Platform”), which is hosted in the United States and is not owned or controlled by ACEC-Ontario. The CPD Platform is owned by Decatur Professional Development, LLC and governed by their own privacy policy and terms of use. Any Personal Information submitted through the CPD Platform is collected by Decatur Professional Development and may be subject to foreign laws, including access by U.S. government authorities. We encourage you to review their privacy policy before submitting any Personal Information, available at https://engineeringcpd.ca/privacy-policy/.
To protect your privacy, be cautious when sharing Personal Information on third-party sites, including social media platforms.

G. PROTECTING THE PRIVACY OF CHILDREN AND YOUTH

We understand that Personal Information relating to children and youth is particularly sensitive, especially the younger they are. Consistent with the position of the Office of the Privacy Commissioner of Canada, we will not knowingly collect Personal Information from children under the age of 13 unless we have the consent of their parents or guardians. We collect the minimum amount of Personal Information of children and youth necessary to achieve our purposes.
If you are a child or youth, YOU SHOULD REVIEW THIS PRIVACY POLICY WITH YOUR PARENTS OR GUARDIANS to make sure that you understand and consent to everything in it. IF YOU ARE UNDER THE AGE OF 13, you should not access our Website or provide us with any Personal Information unless your parent or guardian has consented. If we discover that we have collected
Personal Information from a child under the AGE OF 13 without parental consent, we will delete that Personal Information.

H. COMPLIANCE WITH CANADA’S ANTI-SPAM LEGISLATION

ACEC-Ontario complies with the requirements of Canada’s Anti-Spam Legislation (“CASL”), as amended from time to time at all times, including when: sending emails or texts from an ACEC-Ontario account, email address or domain name, obtaining consent from recipients to send emails or texts, managing and responding to requests to unsubscribe and documenting and retaining records of consent. ACEC-Ontario does not send commercial electronic messages (“CEMs”) to any person unless it has express or implied consent from the recipient, the CEM includes identification and contact information for the sender and the CEM has an unsubscribe mechanism. To ensure compliance with CASL, ACEC-Ontario updates its volunteers and staff regarding CASL requirements and keeps records of consents and requests to unsubscribe. Complaints regarding the sending of CEMs and requests to unsubscribe from CEMs should be directed to the Privacy Officer.

I. OTHER JURISDICTIONS

Some or all of the Personal Information we collect may be transferred to third-party service providers in the course of our normal operations or activities including, without limitation, being stored on servers in cloud-based environments or transferred through other technological measures to trusted third parties to assist us in serving you. Some of our service providers are located outside of Canada and therefore Personal Information may be stored or processed in jurisdictions outside of Canada. As a result, this information may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to laws in those jurisdictions.

ACEC-Ontario is not established in the European Union or any other jurisdiction that, either now or in the future, enacts data privacy laws that operate beyond the limits of the enacting state (“Enacting Jurisdictions”). ACEC-Ontario does not offer services to individuals in the Enacting Jurisdictions and does not knowingly monitor the behaviour of individuals in the Enacting Jurisdictions. ACEC-Ontario does not knowingly collect or process Personal Information from individuals located in the Enacting Jurisdictions. Individuals located in the Enacting Jurisdictions should not access our Website or provide us with any Personal Information. If you have any questions or concerns about our privacy practices or procedures in relation to other jurisdictions, please contact the Privacy Officer at the coordinates provided above.

J. CHANGES TO PRIVACY POLICY

We may make changes to this Privacy Policy from time to time, such as in response to developments and changes in privacy law or to reflect technological changes or new functionalities. When we post changes to this Privacy Policy on our Website, we will change the “last updated” date at the top of this Privacy Policy. If possible, we will post notices of significant changes before they take place. Your continued use of the Website after any changes are made signifies your agreement with the terms of the revised Privacy Policy. Please refer to the latest update date noted above to know when we last updated this Privacy Policy.