Draft – internal review. This policy is pending confirmation by Anita Tong (legal and privacy) and Selby Mong (data and systems) before publication. Do not publish until both have signed off.
Privacy
Privacy at Harness Good
Effective date: [Date] · Version 2.0
We are an independent Canadian research and granting organization. When you give through Good Rises, our technology partner, your gift comes to us, and so does the information that makes it work: your name, your gift, and the causes you chose. This page explains what we collect, why, how we protect it, and the choices you have. We have written it in plain language.
We do not sell your information. We do not rent it, trade it, or hand it to the for-impact organizations you support unless you ask us to. Those are commitments, and the rest of this page is how we keep them.
Who we are, and how giving works here
Harness Good is a registered Canadian charity. When you give, you give to us, and we alone decide where the money goes. We issue your official donation receipt and grant the funds onward to the cause you chose.
We do not build our own technology. We buy it, at fair market value, from the company that builds and operates Good Rises. The platform, the Good Score, and the Good Rises name are theirs. The assessment, the granting, and the choice of where dollars go are ours. Harness Good is not a subsidiary of Good Rises or the company behind it, and an independent board governs every dollar.
For your privacy, what matters is this: Good Rises handles your information on our behalf, on our instructions, and under a written agreement, and it is not permitted to use that information for its own purposes. We remain accountable to you for it.
What we collect
We collect what we need to accept your gift, receipt it, send it where you chose, and keep you informed.
What you do
What we collect
You give
Your name and contact details, the mailing address a tax receipt requires, your gift amount and history, the cause you chose, and payment information (handled by our payment provider).
You tell us what you care about
The causes and outcomes you say matter to you, so we can match for-impact organizations to your values.
You hear from us
Your email and your communication preferences.
You visit our site
Device and browser information, and information from cookies (see below).
Some information is sensitive: a health cause you support, for example, or anything about a child. We collect it only where we need to, protect it accordingly, and ask for your express consent where the law requires.
Why we use it
We use your information to:
accept your gift, issue your receipt, and grant the funds to the cause you chose;
match for-impact organizations to the causes and outcomes you tell us you care about;
keep you informed, with confirmations and, where you have agreed, updates on what your giving achieved;
keep our site secure and working, and prevent fraud; and
meet our obligations as a registered charity.
On matching, one thing is worth saying plainly. We use what you tell us about your values to help you find good work to support. We will never tell you what to care about. That is yours.
We do not use your information for a new purpose that does not fit the one you gave it for, without telling you and, where needed, asking first.
Who touches your information
We share your information only where it is needed, and only with:
Good Rises, our technology partner, which runs the giving, receipting, and payment experience on our behalf, and the payment provider that processes your card;
the cause you chose, which receives your gift. It does not receive your contact information unless you ask us to share it;
researchers or partners, and only as de-identified or aggregate information that cannot identify you, under the conditions the law requires; and
anyone the law requires, such as a court order or a tax obligation.
We do not sell, rent, trade, or exchange donor or mailing lists. If you ask to stay anonymous, your name and gift amount stay out of our communications, listings, and reports.
We may also publish anonymized, aggregated figures about giving, to report to the sector and help for-impact organizations understand giving trends. These cannot identify you.
Household accounts
You can set up a connected household account and share your giving with the people in it. This happens only if you choose it and give your express permission. When you do, the other people in your household account can see your giving history and the causes and outcomes you care about. When you choose to leave a household account, we make sure that information is no longer shown there.
Your choices and rights
You are in control of your information. You can:
see the information we hold about you, and get a copy in a portable format;
correct anything that is wrong or out of date;
change how we contact you, or stop hearing from us, using the unsubscribe link in any message or by writing to us. Fundraising and newsletter messages are opt-in and separate from the messages we must send to process your gift; and
ask us to delete your information, or in some cases to stop sharing it. We keep only what the law requires us to keep, such as receipt records.
To exercise any of these, write to us at the address below. We will reply within the time the law allows, generally 30 days, and we may check your identity first.
Keeping your information safe
We protect your information with safeguards matched to how sensitive it is: access limited to the people who need it, encryption in transit, staff held to confidentiality, and care in choosing the vendors who handle information on our behalf. Card payments run through a PCI-DSS-compliant provider, so full card numbers do not rest on our systems. No system is ever perfectly secure, and we will not pretend otherwise, but we work to keep the risk low and to act quickly if something goes wrong. If a breach ever creates a real risk of serious harm, we will tell you and the appropriate regulator, and we keep a record of every breach.
How long we keep it
We keep your information only as long as we need it, or as long as the law requires. As a registered charity, we keep donation and receipt records for the periods the Canada Revenue Agency sets: receipt copies for at least two years, and the supporting records for six years. When we no longer need information and no rule requires us to keep it, we destroy it or strip it of anything that could identify you.
Where your information is handled
Your information is handled in Canada and, for some services, in the United States, because our payment processing runs through a US-based provider. Wherever it goes, we stay accountable for it and use contracts to hold it to a comparable standard of protection. For people in Quebec, we complete the privacy assessment Quebec law requires before information moves outside the province. Information held in another country may be subject to that country’s laws.
Cookies
Our site uses cookies to work, to keep your session secure, and, where you allow it, to understand how the site is used. You can manage cookies through our banner or your browser. [List the cookie and analytics tools in use, and their retention periods.]
Changes, and how to reach us
We will update this page as our work changes, with a new date at the top.
If you have a question or a concern about your information, write to our Privacy Officer at privacy@harnessgood.com. We take it seriously, and we will work with you.
If we cannot resolve it together, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or, if you are in Quebec, the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.
A French version of this page is available for people in Quebec.