Legal
Privacy Policy
1. Who we are and who to contact
Pembroke Regional Hospital Foundation (“the Foundation”, “we”) is accountable for the personal information handled in connection with this website and the PRH Catch the Ace raffle.
- Privacy Officer / Privacy Contact: privacy@prhffoundation.ca
- General enquiries: info@prhffoundation.ca
- By post: Privacy Officer, Pembroke Regional Hospital Foundation, 705 Mackay Street, Pembroke, Ontario K8A 1G8, Canada
The Privacy Officer is responsible for the Foundation’s compliance with this policy and answers access, correction and complaint requests.
2. What we collect
We collect different information depending on what you do. We have set it out separately so you can see exactly what this website handles and what a ticket purchase adds.
2.1 When you simply browse this website
- Technical information handled by our web server and security infrastructure, including your IP address, browser type, device type, referring page and the pages you request. This is used to serve the site and to protect it against abuse, and is kept in access and security logs.
- Information stored in your own browser, not on our server: your age confirmation and your cookie choices. See the Cookie Policy.
2.2 When you contact us
- Your name, email address, chosen topic and the content of your message.
- Whether you asked to receive the weekly jackpot email.
2.3 When you register and buy tickets
- Name, mailing address, postal code, email address and (optionally) telephone number;
- Date of birth, used to verify that you are 18 or older;
- Your account password, stored only as a salted cryptographic hash;
- Geolocation at the moment of purchase, used solely to verify that you are physically located in Ontario as the AGCO requires — it is not used to track you afterwards;
- Your order: tier, ticket numbers issued, amount paid, draw dates, and whether you chose a weekly membership;
- A payment token returned by our payment provider. The Foundation does not receive or store your full card number, expiry date or security code;
- Your marketing consent, recorded with its date and time;
- If you win: the details needed to verify your identity and pay the prize.
3. Why we collect it
- AGCO-mandated eligibility verification (age and Ontario presence);
- Issuing tickets and purchase confirmations, and administering weekly memberships;
- Contacting winners and processing prize claims;
- Maintaining the audit trail required of an AGCO-licensed electronic raffle;
- Answering your questions and complaints;
- Keeping the site secure and available;
- With separate consent, sending you weekly jackpot updates (see section 10).
We do not sell, rent or trade personal information, and we do not use it for automated decision-making.
4. Legal basis and consent
The Foundation collects, uses and discloses personal information in accordance with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, and follows the fair information principles set out in that legislation: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.
- Consent. We identify the purpose before or at the time we collect information. Completing a purchase, submitting the contact form or ticking a consent box is your consent for the purpose described at that point. Consent for optional purposes — such as marketing email — is always separate, express and never pre-ticked, and may be withdrawn at any time.
- Information required to run the raffle. Some information is necessary to issue a ticket, verify eligibility and maintain the audit trail required by the AGCO under Licence #RAF1555164. If you choose not to provide it, we cannot sell you a ticket.
- Legal and regulatory obligations. Where legislation, a court order or the terms of our lottery licence require us to collect, retain or disclose information, we do so without separate consent, as permitted by law.
Withdrawing consent for optional purposes does not affect records the Foundation must keep to satisfy raffle, charity or tax obligations.
5. Service providers
We use a small number of service providers to run the website and the raffle. Each is bound by contract to protect personal information, to use it only for the purposes we specify, and to provide a level of protection comparable to our own.
| Category of provider | What it receives |
|---|---|
| Web hosting and security | Server and security log data, including IP address and request metadata. |
| Electronic raffle system supplier | Purchase and eligibility data needed to issue tickets, run the draw and maintain the audit trail required by the AGCO. |
| Payment processor | Card and billing details you enter at checkout, processed under PCI DSS. The Foundation receives only a payment token and the transaction result. |
| Email delivery | Your name and email address, to send purchase confirmations, prize notifications and — if you opted in — the weekly jackpot update. |
| Analytics | Aggregate usage statistics, and only if you consent to analytics in the cookie banner. No analytics provider receives your name, address or payment details. |
The Foundation keeps a current register of its processors. To ask which provider fills a given role at any point in time, write to privacy@prhffoundation.ca.
6. Where your information is stored and processed
The Foundation’s records are held at its office in Pembroke, Ontario, and this website and its raffle data are hosted in Canada.
Some service providers, or their sub-processors, may process or store personal information outside Canada — for example where a payment network, email delivery service or security provider operates infrastructure in another country. Where that happens, the information may be accessible to the courts, law enforcement and national security authorities of that jurisdiction under its laws. We use providers that offer comparable protection and we limit what is transferred to what the service actually needs.
To ask where a particular category of your information is processed, contact privacy@prhffoundation.ca.
7. How long we keep it
| Category | Retention period |
|---|---|
| Raffle tickets, ticket stubs and records of unsold tickets | One (1) year from the draw date. |
| Supporting raffle records — draw records, winner records, financial reconciliation, licence reporting | Four (4) years, or longer where AGCO terms and conditions require it. |
| Purchaser account details (name, address, email, phone, date of birth) | For as long as the account is active, and then for the retention period of the raffle records that reference it. |
| Geolocation check at purchase | Only the pass/fail result is retained with the raffle record. Precise coordinates are not stored. |
| Payment tokens and transaction results | Seven (7) years, to satisfy charity accounting and audit obligations. Full card numbers are never held. |
| Winner information used in publicity | Published results are kept indefinitely as part of the public archive; supporting identity records follow the four-year rule above. |
| Marketing consent records and email subscription data | Until you unsubscribe, plus three (3) years to evidence consent under CASL. |
| Contact-form correspondence | Only as long as needed to answer you and to record the outcome, normally no more than twenty-four (24) months. |
| Web server and security logs | Normally no more than ninety (90) days, unless retained for an active security investigation. |
When a retention period ends, records are securely destroyed, erased or anonymised.
8. Safeguards
- The site is served exclusively over HTTPS, with security headers and a strict content security policy.
- Payment processing is PCI DSS compliant; the Foundation never receives or stores full card numbers.
- Account passwords are stored only as salted cryptographic hashes.
- Access to raffle records is limited to the Foundation staff who need it, and is logged.
- No third-party analytics or marketing script loads before you consent.
- Physical records are held in a locked office at Pembroke Regional Hospital.
No system can be guaranteed perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.
9. Disclosure to regulators and others
We disclose raffle records to the Alcohol and Gaming Commission of Ontario (AGCO) and other licensing authorities where required by the terms of Licence #RAF1555164 and applicable law, and to the Canada Revenue Agency where charity reporting requires it. We may also disclose information where compelled by a court order, subpoena or other lawful requirement, or where necessary to investigate fraud or a breach of the Rules of Play.
10. Marketing consent (CASL)
Weekly jackpot update emails are sent only with your separate, express, opt-in consent — the sign-up box is never pre-checked. Every message identifies the Foundation as sender, gives our mailing address, and contains an unsubscribe link honoured within 10 business days, in accordance with Canada’s Anti-Spam Legislation (CASL). Purchase confirmations, prize notifications and other transactional messages are not marketing and are sent regardless of your marketing preference.
11. Winner publicity
If you win, your first name, city and (with your agreement) photograph may be used in winner announcements on this site, the Weekly Winners Archive and Foundation social channels, as described in the Rules of Play and required by AGCO winner-publication rules. If publication would put you at risk, tell us and we will withhold your city.
12. Your rights
- Access. You may ask what personal information we hold about you, how it is used and to whom it has been disclosed.
- Correction. You may ask us to correct information that is inaccurate or incomplete.
- Withdrawing consent. You may withdraw consent for optional purposes at any time, subject to legal and contractual restrictions and reasonable notice.
- Deletion. You may ask us to delete information we are not required to keep for raffle, charity or tax purposes.
Write to privacy@prhffoundation.ca. We respond within 30 days and will tell you if we need more time. There is no charge for a routine request.
13. Complaints
If you are not satisfied with how we have handled your personal information, contact the Privacy Officer at privacy@prhffoundation.ca. If we cannot resolve it together, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
14. Changes to this Privacy Policy
We update this policy when our practices, our providers or applicable requirements change. The version number, effective date and last-updated date at the top of this page always reflect the current text. Material changes are announced on this website before they take effect.
See also our Cookie Policy, the Rules of Play and our Accessibility Statement.