SUMMARY

This notice explains what personal data we collect, why we collect it, the GDPR bases we rely on, how long we keep the data, who we share it with, and how you can exercise your rights.

1. WHO WE ARE

• Controller: 8231800 Canada Inc., a federally incorporated Canadian company that operates the Youth Empowerment & Skills for Success (YESS) programme.

• Registered office: 84 Ch. du Lac Serpent Notre-Dame-du-Laus, QC J0X 2M0, Canada

• Privacy contact / Data Protection Officer: media@ilinniapaa.ca | +1 (819) 767-2252

2. WHAT DATA WE COLLECT

IDENTITY DATA – name, date of birth, Social Insurance Number (SIN)

CONTACT DATA – e-mail, phone, address, province/territory, postal code

DEMOGRAPHIC DATA – gender, language preference, rural/urban/remote tag

SPECIAL-CATEGORY DATA (with explicit consent) – Indigenous identity, visible-minority status, disability status, LGBTQ2SIA+ identification

EDUCATION & EMPLOYMENT – highest education level, résumé, employment history

PROGRAMME DATA – chosen cohort, attendance, work-placement records, stipend payments

TECHNICAL DATA – IP address, browser/device info, essential security cookies

3. LAWFUL BASES FOR PROCESSING

• Contract – eligibility assessment, enrolment, stipends

• Legal obligation – statutory reports to Employment and Social Development Canada (ESDC)

• Explicit consent – optional demographic indicators

• Legitimate interest – website security and basic analytics

4. HOW WE USE YOUR DATA

• Determine eligibility, create training plans, arrange work placements, issue stipends

• Meet ESDC funding-agreement reporting duties

• Provide training services (e.g., psychometric profiling when you opt in)

• Communicate about schedules, supports and follow-up

• Secure and improve website performance

5. SHARING & INTERNATIONAL TRANSFERS

We share data only with:

1. ESDC (Government of Canada) – funding body/auditor

2. Payroll/HR providers in Canada – wage and stipend processing

3. Webflow Inc. (USA) – website hosting

4. Insights Learning & Development Ltd. (UK) – psychometric profiles

5. Email/SMS platforms (if you opt in)

All transfers outside the EEA/UK rely on EU Standard Contractual Clauses or GDPR Art 49 public-interest derogations. We never sell or rent data.

6. STORAGE & RETENTION

Participant files – 7 years after programme completion

Payroll records – 6 years after the calendar year of payment

Psychometric profiles – 18 months (or sooner on request)

Security logs – 90 days, then anonymized

Data are held on encrypted servers in Canada or the USA with role-based access controls.

7. YOUR GDPR RIGHTS

Access • Rectification • Erasure • Restriction • Portability • Objection • Withdraw consent • No automated decisions with legal effect.

E-mail privacy@ilinniapaa.ca; we respond within 30 days. You may also complain to your EU/UK authority or the Office of the Privacy Commissioner of Canada.

8. CHILDREN

The programme serves youths aged 15–30. We do not knowingly collect data from anyone under 15. Parents/guardians may request deletion of a minor’s data.

9. AUTOMATED DECISION-MAKING

No eligibility or stipend decision is made solely by automated means; all assessments receive human review.

10. COOKIES & SIMILAR TECHNOLOGIES

Only essential cookies are used for session security, load-balancing and anonymous analytics. A banner lets you accept, reject, or customize any non-essential cookies.

11. DATA SECURITY

TLS-encrypted transfer, AES-256 at rest, multi-factor staff access, annual penetration testing, processor SCCs, and a 72-hour breach-notification commitment.

12. CHANGES TO THIS POLICY

Policy updates will appear on this page with a new “Last updated” date and, for material changes, e-mail notice.