Data Privacy policy

Effective date: July 15, 2026

1. About this policy
The Leaside Business Park Association (“LBPA,” “we,” “us”) is a non-profit, volunteer-led organization representing businesses, property owners, and professionals in the Leaside Business Park. For the purposes of this policy, “personal information” means information about an identifiable individual. Most of the personal information we collect relates to individuals acting in their professional or business capacity.

This policy explains what personal information we collect, why, who we share it with, and the choices and rights you have. It covers our outreach, communications, and business directory, and reflects our obligations under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL). The LBPA is responsible for personal information under its control and has designated a Privacy Officer to oversee compliance with this policy.

2. Who this policy applies to
This policy applies to personal information we collect from the businesses and people we serve — including members, business contacts, event attendees, subscribers to our communications, volunteers, and website visitors. It also applies to everyone who handles personal information on our behalf, including staff, board and committee members, contractors, and service providers.

3. What we collect
We collect only the personal information reasonably necessary to carry out the purposes described in this policy. Most of the information we collect consists of business contact information. Typically, this includes information commonly found on a business card.

We may also collect information you give us when you subscribe to Traffic Alerts or our newsletter, provide at events or through forms, and basic technical information collected automatically when you visit our website (see “Cookies and website analytics”).

We collect information directly from you, in person (including through outreach and canvassing), by phone, by email, through our website, and at events, and, where appropriate, from publicly available business listings. We take reasonable steps to ensure the information we collect remains accurate, complete, and up to date for the purposes for which it is used.

4. Why we collect it and how we use it
We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances and that are consistent with this policy or otherwise permitted by law including:
– Maintaining the business directory
– Maintaining accurate business contact records
– Providing Traffic Alerts
– Providing newsletters and communications
– Responding to enquiries
– Organizing events
– Administering memberships (if applicable)
– Meeting funding obligations
– Improving our website
 
5. Consent and your choices
We collect, use, and share personal information with your consent, except where the law permits or requires us to act without it. You can withdraw your consent, opt out of our business directory, or unsubscribe from our emails at any time by contacting us. Our directory lists business-level information only; we do not list an individual’s name or personal contact details without that person’s consent.
Where appropriate under applicable privacy legislation, we may rely on implied consent, particularly where the information relates to an individual acting in a business or professional capacity and the purpose is reasonably expected.

Email communications (CASL): We send emails such as Traffic Alerts and newsletters only to people who have agreed to receive them, or where otherwise permitted under Canada’s Anti-Spam Legislation. Every email identifies the LBPA and includes an easy way to unsubscribe.

6. Who we share it with
We do not sell personal information, and we do not share it for anyone else’s marketing. We share personal information only in these limited situations:

Service providers who help us operate – for example, the provider that powers our Traffic Alerts platform, our email/newsletter service, and our website host. They may use the information only to provide services to us and are required to protect it.

Project funders and partners – where a project we run is funded by others (such as the City of Toronto and the Government of Canada / FedDev Ontario), we may be required to provide reporting and project documentation. Information provided to a public body may be subject to access-to-information and privacy legislation, including the Municipal Freedom of Information and Protection of Privacy Act.

Legal requirements – where we are required to disclose information by law or in response to a lawful request from a public authority.

Before sharing personal information with service providers, we require appropriate contractual or other safeguards designed to ensure that the information is protected and used only for authorized purposes.

7. Where your information is stored
Some of our service providers may store or process information outside Canada, including in the United States, in which case the information may be subject to the laws of those countries. Before engaging service providers located outside Canada, we assess appropriate contractual and organizational safeguards to help protect personal information.

8. Use of Digital Platforms
LBPA uses secure third-party technologies, such as customer relationship management systems, website hosting services, email communication platforms, and other digital tools, to support its operations. These service providers are permitted to use personal information only for authorized purposes and are expected to protect it through appropriate safeguards.

9. How we protect it
We use appropriate physical, technical, and administrative safeguards to protect personal information against loss, theft, and unauthorized access, use, or disclosure. Examples of these safeguards include access controls, password protection, secure cloud services, encryption where appropriate, and confidentiality obligations for volunteers, contractors, and service providers. We limit access to those who need it, and people who handle personal information on our behalf are required to follow this policy. We review our safeguards periodically.

10. If there is a data breach
If a breach of security safeguards involving personal information creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by law, and we will keep records of breaches as required. We will investigate suspected privacy incidents promptly, take reasonable steps to contain and mitigate their impact, and implement measures intended to reduce the likelihood of recurrence.

11. How long we keep it
We keep personal information only as long as we need it for the purposes in this policy, to maintain our relationship with you, or as required by law or our funding agreements. If a business opts out of the directory, we remove its listing promptly. Records connected to funded projects may need to be retained for the period required under applicable funding agreements, legal obligations, audit requirements, or operational needs (which may be six years or longer where required). When information is no longer needed, we securely delete or anonymize it.

12. Cookies and website analytics
Our website uses cookies and similar technologies to help the site function and to understand how visitors use it. You can control cookies through your browser settings, and, where required, we ask for your consent through the notice shown on our website. Our website may also use third-party analytics services to help us understand how visitors use the site and improve its performance.

13. Your rights
You have the right to:
– Ask what personal information we hold about you and to access it;
– Ask us to correct information that is inaccurate or out of date;
– Request that we delete or anonymize your personal information where appropriate, subject to legal, contractual, funding, and record-retention obligations.;
– Withdraw your consent, opt out of the directory, or unsubscribe from our communications; and
– Ask questions or raise a concern about how we handle your information.

To exercise any of these rights, contact us below. We will respond within a reasonable time and in accordance with applicable law. If you have concerns about our response, we encourage you to contact us first so we have an opportunity to address them. If you remain dissatisfied, you may contact the Office of the Privacy Commissioner of Canada.

14. Changes to this policy
We may update this policy from time to time to reflect changes in our operations, legal requirements, or best practices. The current version will always be posted on our website with its effective date.

15. How to reach us
Questions, requests, and concerns about this policy or your personal information can be directed to:

Leaside Business Park Association
225 Wicksteed Avenue, East York, Ontario, M4H 1G5
Email: services@leasidebusinesspark.com