Arushiom Foundation Privacy Policy

Last updated: October 17, 2026

1 – Purpose

The Arushiom Foundation (“we”) protects your personal information. This policy explains how we collect, use, share, retain and protect it. It applies to our websites arushiom.org, ca.arushiom.org and store.arushiom.org, and to our activities.

We mainly apply Québec’s Act respecting the protection of personal information in the private sector (Law 25). Depending on where you live, other laws may apply, including:

• the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada);
• the General Data Protection Regulation (GDPR, European Union);
• the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil);
• the Protection of Personal Information Act (POPIA, South Africa).

2 – Information we collect

We only collect the information our activities require:

• Contact details: name, mailing address, phone number, email address, country of residence, language.
• Participation: the details needed for your registration and participation in our sessions, workshops and events.
• Donations and purchases: amount, date and the information needed for the receipt.
• Session questionnaires: answers to the intensity questionnaires completed before and after a session are anonymized. We only keep group results, with no link to your identity.
• Browsing: technical information collected by our websites (IP address, device type, pages viewed); see section 10.

We do not store your payment details. They are processed directly by our payment providers (Stripe, Square, Donorbox).

3 – Purposes and legal bases

• Running our activities and communications (performance of a contract or legitimate interest): managing your registration and participation, and sending you information about our sessions and events.
• Newsletter (consent): sending you our newsletter if you signed up for it.
• Processing donations (performance of a contract): processing your donations, issuing receipts where applicable and managing our relationship with donors.
• Improving our services (legitimate interest): producing statistics about our programs from aggregated or anonymized data.
• Audience measurement and advertising (consent): see section 10.
• Legal obligations (legal obligation): complying with applicable laws, regulations and orders.

4 – Consent

When processing relies on your consent, we ask for it clearly and separately. You can withdraw it at any time; this does not affect processing carried out before the withdrawal.

To change your cookie choices, use the “Manage My Cookies” link at the bottom of every page or below:

To unsubscribe from the newsletter, use the link in any of our emails. For any other request, write to [email protected].

5 – Your rights

Depending on the law that applies to you, you can:

• access your personal information;
• have it corrected if it is inaccurate or incomplete;
• request its deletion;
• request that its processing be restricted, or object to it, including for marketing;
• receive your information in a structured, commonly used technological format (portability);
• withdraw your consent (section 4);
• be informed of any confidentiality incident that presents a risk of serious injury.

To exercise these rights, write to [email protected]. We may ask you to confirm your identity. We respond within 30 days of receiving your request.

6 – Sharing with third parties

We never sell or rent your personal information.

We only share it when necessary:

• Service providers acting on our behalf, including:
  • website hosting and security: Hostinger, Cloudflare;
  • payments and donations: Stripe, Square, Donorbox;
  • email and newsletter: MailerLite, MailerSend;
  • online sessions: Zoom;
  • audience measurement and advertising, with your consent: Google, Meta.
• Event organizers and partners, strictly for the logistics and safety of an event you attend.
• Testimonials: a testimonial is only published with your prior agreement.
• Legal obligations and emergencies: when required by law, by court order, or to protect a person’s health or safety.

7 – Transfers outside Québec

Some of our providers process information outside Québec, notably in the United States. Before sharing personal information with them, we carry out a privacy impact assessment. It checks that the information will be adequately protected.

8 – Security

We take reasonable measures to protect your information against unauthorized access, use or disclosure:

• access limited to the people who need it, bound by a confidentiality undertaking;
• two-factor authentication on administrator accounts and with our providers;
• unique passwords managed with a password manager;
• server access by secure key only;
• encrypted connections (HTTPS) on all our websites;
• firewall and protection against bots and attacks;
• regular software updates;
• regular automatic backups.

No measure offers absolute security. If an incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information.

9 – Retention

We keep your personal information for three years after your last interaction with the Foundation, unless a law requires us to keep it longer (for example, for tax purposes) or you ask us to delete it. It is then deleted or irreversibly anonymized.

Group results from session questionnaires, already anonymized, are kept on our servers to monitor the effectiveness of our programs.

10 – Cookies and similar technologies

Our websites use cookies and similar technologies. Some are essential for the site to work: language, cart, payment, security. Others are optional: audience measurement (Google Analytics) and advertising (Google Ads, Meta).

Optional cookies are off by default. They are only turned on with your consent, given through our banner. You can accept all, reject all or choose service by service, and your choice applies to all three Foundation websites. You can change it at any time with the “Manage My Cookies” link (section 4).

• Essential: WordPress, WPML, WooCommerce, Cloudflare, Stripe, Square, Donorbox, MailerLite (sign-up forms).
• Functional: Google Tag Manager, Google Maps, Cloudflare Turnstile.
• Statistics: Google Analytics.
• Marketing: Google Ads, Meta Pixel.

Details for each service (provider, purpose, cookie retention) are available in the banner, under “Choose my preferences”.

Your choice is remembered for 12 months. To demonstrate your consent, we keep a record of it for 36 months: a pseudonymous identifier and the details of your choices, without your IP address.

11 – Minors

Our online sessions are reserved for people aged 18 and over. Minors may attend our in-person workshops when accompanied by a parent or guardian, who then provides the necessary information. We do not knowingly collect information from a minor under 14 without the consent of their parent or guardian.

12 – Person in charge of the protection of personal information

Louis Brassard
President, Arushiom Foundation
[email protected]

13 – Changes

We may update this policy to reflect changes in our practices or in the law. The date of the last update appears at the top of the page. Any significant change will be announced on our websites. If a change requires your consent, we will ask for it.

14 – Questions, complaints and recourse

For any question or complaint, write to [email protected] first. We will review your request and respond within 30 days.

If you are not satisfied with our response, you can contact the authority in your jurisdiction, including:

• Québec: Commission d’accès à l’information (CAI);
• Canada: Office of the Privacy Commissioner of Canada;
• European Union: the data protection authority of your country of residence;
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD);
• South Africa: Information Regulator.