Effective date: [INSERT DATE] · Last updated: [INSERT DATE]
Related: Event Photo & Video Consent Form · Submit a Privacy Request
Ambition Labs respects the privacy of students, families, speakers, volunteers, partners and website visitors.
This Privacy Policy explains what personal information Ambition Labs collects, why it is collected, how it is used and protected, and what choices individuals have regarding their information.
Ambition Labs is a student-founded initiative based in Niagara Region, Ontario. Because many members of our community are under 18, we aim to use privacy practices that are clear, limited, youth-appropriate and responsible.
This policy applies to personal information collected through:
This policy does not control independent websites or platforms linked from the Ambition Labs website. Those services have their own privacy practices.
Personal information is information about an identifiable individual.
Depending on how someone interacts with Ambition Labs, this may include:
Ambition Labs will not intentionally request sensitive personal information unless it is genuinely needed for a clearly stated purpose.
Ambition Labs does not normally need or request:
Payment information, if ever required for a future activity, should be processed by a secure third-party provider and not stored directly by Ambition Labs.
Ambition List
When someone joins the Ambition List, Ambition Labs may collect: first name; email address; grade or recently graduated status; municipality; selected topic interests.
The Ambition List is used to send: event announcements; registration links; event reminders; opportunity updates; occasional Ambition Labs news and resources.
Joining the Ambition List must be optional. Consent to receive emails must be requested separately and clearly.
Event forms
For event registration, interest or waitlists, Ambition Labs may collect: name; email address; grade or age range; municipality; attendance status; accommodation information voluntarily provided; emergency contact information only when reasonably necessary; consent choices relating to communications or media.
Registration information will not be publicly displayed.
Suggestions, surveys and feedback
Ambition Labs may collect responses regarding: topics students want to learn; future-event ideas; event experiences; areas for improvement; opportunities students want to find.
Anonymous responses should remain anonymous unless the person chooses to provide contact information.
Ambition Labs will not publish a response as an identifiable testimonial without separate permission.
Get Involved forms
Forms for speakers, student-team members, venues, partners, sponsors or volunteers may collect: name; email address; organization; role; experience; proposed contribution; availability; links or supporting information voluntarily provided.
Opportunity submissions
Organizations or community members submitting an opportunity may provide: contact name; organization; email address; official opportunity link; eligibility and deadline information; other details needed to verify the listing.
Contact information submitted for verification will not automatically be published.
Ambition Labs may use personal information to: provide requested information; manage the Ambition List; send communications that a person agreed to receive; organize events; manage registrations and waitlists; respond to questions; provide requested accommodations; improve future events; review suggestions and survey responses; verify opportunity listings; communicate with speakers, venues and partners; manage student-team or volunteer interest; maintain appropriate event safety; obtain and manage media consent; protect the website and prevent misuse; meet legal obligations where applicable.
Ambition Labs will not use personal information for a new, unrelated purpose without providing notice and obtaining additional consent when required.
Ambition Labs will explain: what information is being collected; why it is needed; how it will be used; whether it will be shared; whether providing it is optional; how consent can be withdrawn.
Consent language should be written in plain language that students can reasonably understand.
Consent for one purpose does not automatically provide consent for another purpose. For example: registering for an event does not automatically subscribe someone to marketing emails; completing a survey does not automatically permit publication of the response; attending an event does not automatically permit Ambition Labs to publish identifiable photographs; joining an email list does not automatically authorize text messages.
Canada's privacy guidance requires consent to be meaningful: people should understand the nature, purpose and consequences of what they are agreeing to.
Ambition Labs is primarily intended for high-school-aged students.
We recognize that young people deserve privacy explanations they can understand and should be able to ask a parent or guardian for advice when making privacy decisions.
Ambition Labs will: collect only information reasonably needed; use clear, age-appropriate explanations; avoid behavioural advertising directed at students; avoid publishing names, schools or identifying information without permission; request separate consent for photographs and video; avoid creating public membership or attendance lists; allow students or guardians to ask questions; provide a way to withdraw consent where appropriate.
The Office of the Privacy Commissioner generally considers children under 13 unable to provide meaningful consent on their own. Ambition Labs does not intentionally collect personal information from children under 13 without the involvement of a parent or guardian.
If Ambition Labs learns that information was collected from a child under 13 without appropriate involvement, it will review and delete or appropriately address that information.
Ambition Labs will seek clear consent before sending promotional or event-related email communications where consent is required.
Emails will identify Ambition Labs and include a working unsubscribe method.
A person may unsubscribe at any time. Under CASL, unsubscribe requests must be processed without delay and no later than 10 business days, and unsubscribe links must remain valid for at least 60 days after a message is sent.
Ambition Labs should keep records showing: when consent was obtained; how it was obtained; what wording the person agreed to; when consent was withdrawn.
CASL requires senders of commercial electronic messages to obtain consent, provide identifying information and include an unsubscribe mechanism.
Ambition Labs may photograph or record events only under an appropriate media-consent process.
Media consent should be: separate from general event registration; clearly explained; optional where reasonably possible; specific about potential uses; revocable for future uses, subject to reasonable limitations.
Possible uses may include: the Ambition Labs website; Instagram and other official social accounts; event recaps; media releases; promotional materials; press coverage.
Ambition Labs will not intentionally publish a student's full name, school and identifiable image together without additional permission.
Whenever practical, events should provide: advance notice that photography or filming may occur; a clear way to opt out; a designated no-photo area or identifier; instructions for requesting removal from future publications.
Withdrawing media consent may not allow Ambition Labs to retrieve materials already lawfully printed, distributed or republished by independent third parties, but Ambition Labs will stop new uses under its control where reasonably possible.
A separate Event Photo and Video Consent Form should be created. Do not rely only on this Privacy Policy or event signage.
Ambition Labs does not sell or rent personal information.
Information may be shared only when reasonably necessary with: website hosting providers; email-list providers; form providers; event-registration platforms; event venues or organizers where operationally necessary; service providers supporting the website or events; legal, safety or emergency authorities when required or justified; other parties with the individual's consent.
Service providers should receive only the information needed to perform their role.
Ambition Labs remains responsible for personal information transferred to service providers for processing and should use providers with appropriate privacy and security practices.
Ambition Labs may use services such as: Mailchimp for email subscriptions; Formspree for website forms; Eventbrite or another platform for event registration; Netlify for website hosting; analytics or security services if later enabled.
These providers may process information on servers outside Ontario or Canada. When information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction.
The website should link to the relevant third-party privacy policies where practical.
Ambition Labs will not claim that it currently uses a provider unless that provider has been confirmed and configured.
The website may use strictly necessary technologies to: load pages; protect forms; maintain security; prevent spam; remember basic settings.
If analytics are enabled, the website must clearly identify: which analytics provider is used; what information is collected; why it is collected; how users can limit it.
Ambition Labs should prefer privacy-conscious, limited analytics and avoid unnecessary tracking.
Ambition Labs will not use personal information collected from students for targeted behavioural advertising.
Advertising pixels, cross-site tracking or personalized advertising will not be added without first updating this policy and implementing appropriate consent controls.
Ambition Labs will keep personal information only as long as reasonably required for its stated purpose, legal obligations, safety or recordkeeping.
Recommended internal retention schedule:
Information should be securely deleted, destroyed or anonymized when it is no longer required.
Backup copies may remain temporarily until they are overwritten through ordinary system processes.
Ambition Labs will use safeguards appropriate to the sensitivity of the information, which may include: limiting access to people who genuinely need it; strong, unique passwords; multi-factor authentication where available; secure form and email providers; device security; encrypted connections; restricted file sharing; regular removal of unnecessary information; volunteer and team privacy instructions; secure disposal of records.
PIPEDA guidance requires organizations to protect personal information against loss, theft and unauthorized access, disclosure, copying, use or modification.
No online system can guarantee absolute security. Ambition Labs will make reasonable efforts to protect information and respond appropriately to suspected breaches.
If Ambition Labs becomes aware of a suspected privacy incident, it will: contain the issue; identify what information was involved; determine who may be affected; change passwords or access permissions where needed; document the incident; notify service providers where relevant; notify affected individuals when appropriate; report the incident to authorities where legally required; take steps to prevent recurrence.
Where PIPEDA applies, Ambition Labs will follow applicable breach-reporting, notification and recordkeeping obligations.
Individuals may contact Ambition Labs to request: confirmation of whether Ambition Labs holds their personal information; access to their information; correction of inaccurate information; deletion where appropriate; withdrawal of consent; information about how their information has been used or disclosed; removal from future communications.
Ambition Labs may need to verify the requester's identity before responding.
Access may be limited where permitted or required by law, including when disclosure would reveal another person's information.
The PIPEDA principles include individual access and the ability to challenge the accuracy and completeness of information.
A person may withdraw consent, subject to legal, safety or reasonable operational limitations. Examples include: unsubscribing from the Ambition List; requesting that future uses of an image stop; asking Ambition Labs not to retain an optional survey response; withdrawing from a volunteer or partnership process.
Withdrawing consent will not affect uses already lawfully completed before the withdrawal.
Ambition Labs will explain any consequences of withdrawal, such as being unable to manage an event registration without basic contact information.
Ambition Labs may link to third-party programs, volunteer roles, scholarships, events and other opportunities.
A listing does not mean that Ambition Labs controls or guarantees: the third party's privacy practices; the safety or availability of the opportunity; acceptance into a program; the accuracy of information after its last verification date; the third party's website or services.
Students and families should review the privacy policy, eligibility requirements and safety information of the original organization before applying.
Ambition Labs may update this Privacy Policy as its website, events and services develop.
The updated version will show a new "Last updated" date.
If a change significantly affects how personal information is used, Ambition Labs will provide reasonable notice and obtain new consent where required.
Ambition Labs must appoint a person responsible for privacy questions and requests.
Until final contact details are supplied, use placeholders:
Requests should include enough information for Ambition Labs to understand and respond to the concern, but individuals should not send highly sensitive information by ordinary email.
Ambition Labs will make reasonable efforts to investigate and respond to privacy questions or complaints.
Where PIPEDA applies, individuals may also contact the Office of the Privacy Commissioner of Canada if they are not satisfied with the response.
Do not include government identification or highly sensitive information in this form.