1. Purpose and Scope
1.1 Ohm Shanti Foundation ("Foundation," "we," "us," or "our") solely organizes and represents this charitable event ("Sheri Garba Etobicoke") in Etobicoke, Toronto, Ontario.
1.2 This Policy explains the conditions for pass registration and how the Foundation collects, uses, protects, retains, and disposes of information submitted by attendees, family groups, vendors, partners, and their representatives.
1.3 The Event is conducted for charitable activities. Registration information is used solely by the Foundation for the registration administration and Event-related communications described in this Policy. It is not collected for marketing, advertising, commercial profiling, or third-party promotional purposes.
2. Pass Validity
2.1 Each pass is valid for 12 consecutive calendar days, beginning on the validity start date stated on the pass and ending on the stated expiry date. Both dates count toward the 12-day period.
2.2 The registration confirmation or digital pass will clearly display its validity dates. The period does not begin merely when the registration form is submitted unless that date is expressly identified as the start date.
2.3 A pass may be used only during applicable Event operating hours and for the activities or access categories identified on it. It expires at the end of its stated validity period.
2.4 A family registration covers only the individuals named in that registration. Corrections or changes must be submitted to the Foundation so that its records remain accurate.
3. Fully Digital Registration
3.1 Registration is completed entirely digitally through:
- a. The Foundation's official Event QR code, which opens the digital registration form; or
- b. The Foundation's official Event registration form link.
3.2 Scanning the QR code opens the form; it does not, by itself, submit your registration information. Registration details are collected when entered and submitted through the form.
3.3 The Foundation will identify required fields clearly. Individuals should use only the official QR code or registration link distributed by the Foundation.
3.4 If assistance is required, authorized Foundation personnel may help complete the digital form with the registrant's permission and without retaining separate personal copies.
4. Individual and Family Registration Requirements
4.1 Individual registration. A person registering individually must provide:
- a. First name;
- b. Last name;
- c. A valid email address, which is mandatory; and
- d. A phone number where requested for Event coordination. The form will identify whether this field is required or optional.
Donations are handled by Zeffy on its own site; we receive no card details.
If you register a group, we keep each person's email only to show them the same pass when they sign in.
4.2 Family and Group Registrations: A family group must nominate one (1) designated contact for every five (5) members (or part thereof). Each designated contact is included in the group's total membership count.
4.3 Designated Contact Information: Each designated contact must provide a valid first name, last name, mandatory email address, and telephone number as required under Clause 4.1(d).
4.4 General Member Information: For each other member of a Friends and Family registration, we ask for their first name, last name, and email address. The email address is used only to show that person the same pass in My pass when they sign in with it, and for no other purpose. Telephone numbers are not asked for these individuals.
4.5 Administrative Calculation: To determine the required number of designated contacts for any group size, divide the total number of members by five (5) and round up to the nearest whole number. The allocation applies as follows:
| Total family / group members | Designated contacts providing contact details | Other members providing first and last names only |
|---|---|---|
| 1 to 5 | 1 | Up to 4 |
| 6 to 10 | 2 | Up to 8 |
| 11 to 15 | 3 | Up to 12 |
4.6 Communications and Delivery: Event confirmations, operational updates, and essential transactional communications will be sent exclusively to the designated contacts. Each designated contact is responsible for promptly distributing all relevant information to the family members they represent.
4.7 Third-Party Consent and Data Privacy Protections:
- Adult Members: Any individual submitting personal details on behalf of another adult family member warrants that they have obtained express prior permission to do so and must make this Privacy Policy available to them.
- Minors / Children: Personal information regarding a child under the age of majority must only be submitted by a parent, legal guardian, or an appropriately authorized adult.
- Capacity: Every designated contact must be an adult (having reached the age of majority) who is fully authorized to act in that capacity.
5. Other Information Collected
5.1 Vendor and partner details. Where vendors or partners support the Event, we may collect their organization name, representative's first and last names, email address, telephone number, and information necessary to coordinate their charitable Event participation.
5.2 Direct submissions. We may receive additional information through inquiries, registration corrections, accommodation requests, or other communications submitted directly to the Foundation. We use that information only to address the relevant request or administer the Event.
5.3 Registration records. We may generate a registration reference, pass validity dates, group membership record, and pass issuance or verification status to administer registrations accurately.
5.4 Data minimization. We do not request unrelated personal information. Please do not submit social insurance numbers, health card numbers, financial credentials, or unnecessary identity documents.
5.5 Sensitive information. If an accommodation request requires sensitive information, we collect only what is necessary, explain the purpose, obtain appropriate consent, and restrict access to personnel arranging the support.
6. Purposes of Collection and Use
6.1 Information is used exclusively by Ohm Shanti Foundation for:
- a. Confirming individual and family registrations;
- b. Maintaining an accurate list of registered participants;
- c. Issuing and verifying passes valid for the specified 12-day period;
- d. Preparing passes or badges showing only necessary identification details;
- e. Sending registration confirmations and pass delivery messages;
- f. Communicating Event timings, directions, attendance instructions, schedule changes, cancellations, and safety information;
- g. Coordinating participation with designated family contacts, vendors, or partners;
- h. Responding to inquiries, corrections, and requested assistance; and
- i. Handling privacy requests, security incidents, and applicable legal obligations.
6.2 All attendee communications under this Policy will be from, or sent strictly on behalf of, Ohm Shanti Foundation. A service provider acting on our behalf may not use the information for its own communications or purposes.
6.3 Registration information will not be used for marketing campaigns, advertisements, sponsor promotions, commercial solicitation, or unrelated fundraising appeals.
6.4 Registration does not automatically subscribe any individual to future-event announcements, newsletters, or ongoing communications unrelated to this Event. Any such communication requires a separate, appropriate consent process.
7. Consent and Choices
7.1 The digital form will present this Policy, or a clear link to it, before submission and explain the information required and its purposes.
7.2 By knowingly submitting registration information after receiving this notice, you authorize its use for the stated registration and Event communication purposes. This authorization does not extend to unrelated uses.
7.3 Email is mandatory for individual registrants and designated family contacts because it is the official channel for registration confirmation and essential Event communications. It is not mandatory for family members whose first and last names alone are collected.
7.4 You may withdraw consent by contacting privacy@evamb.com, subject to applicable legal or contractual restrictions and reasonable notice. We will explain any consequences. If essential information can no longer be processed, we may be unable to maintain the affected registration or pass.
7.5 No provision of this Policy waives your applicable privacy rights.
8. Confidentiality and Third-Party Restrictions
8.1 All collected registration information is treated as strictly confidential, subject only to the authorized uses, limited pass displays, and lawful disclosures described in this Policy.
8.2 We do not sell, rent, trade, publish, or commercially distribute personal information or attendee lists.
8.3 Vendors, partners, donors, and other participants do not receive attendee contact information merely because they support or attend the Event.
8.4 Access is limited to authorized Foundation personnel and approved service providers who require it to perform specific Event duties. They must comply with confidentiality requirements.
8.5 Any provider supporting the digital form, hosting, or delivery of Event communications must operate under appropriate restrictions requiring:
- a. Use only for the Foundation's authorized purposes;
- b. No independent marketing, sale, or unauthorized disclosure;
- c. Appropriate security and access controls;
- d. Compliance with the Toronto-only storage requirements in Clause 10;
- e. Prompt reporting of suspected privacy incidents; and
- f. Secure return or deletion when the information is no longer required.
8.6 Information may be disclosed without consent only where permitted or required by applicable law. Any disclosure will be limited to the information appropriate to the lawful purpose.
8.7 A pass or badge may display the registered person's name and pass category. Email addresses, telephone numbers, and sensitive information will not be publicly displayed. Registration does not authorize publication of a family or attendee directory.
9. Operational, Physical and Digital Safeguards
9.1 Operational safeguards. The Foundation maintains:
- a. Privacy and confidentiality instructions for staff and volunteers;
- b. Access limited according to assigned responsibilities;
- c. Procedures for registration handling, correction, retention, and deletion;
- d. Reviews of service-provider access and safeguards; and
- e. Removal of access when an individual's duties end.
9.2 Physical safeguards. Although registration is digital, devices and facilities accessing the information are protected through:
- a. Controlled access to registration work areas and hosting facilities;
- b. Supervision of registration devices and secure storage when unattended;
- c. Screen locks and positioning that limits public viewing; and
- d. Restrictions on unauthorized printing, photography, and copying of registration records.
9.3 Digital safeguards. The Foundation uses:
- a. Encrypted connections for digital form submission;
- b. Encryption of stored registration records and backups;
- c. Unique user accounts and strong authentication;
- d. Multifactor authentication for administrative access;
- e. Role-based permissions and access logging;
- f. Security updates and appropriate protection against malicious access; and
- g. Secure backup and deletion procedures.
9.4 No system can guarantee absolute security. The Foundation reviews its safeguards and responds to identified weaknesses and incidents.
10. Toronto-Only Data Residency
10.1 Registration information collected under this Policy will be stored only on servers physically located within Canada.
10.2 This requirement applies to the registration database and any Foundation-controlled or service-provider-held copies, backups, disaster-recovery replicas, and logs containing registration information.
10.3 The Foundation will not authorize storage or replication of registration information outside Canada. Service providers must be configured and contractually required to comply with this restriction.
10.4 Personnel must not download registration databases to personal devices, personal email accounts, or unapproved storage services.
10.5 Emails sent to an attendee's own email account may be stored by that attendee's email provider outside Toronto. The Foundation does not control recipients' email systems and will minimize personal information included in messages.
11. Retention and Disposal
11.1 The pass's 12-day validity period is separate from the period for retaining registration information.
11.2 Registration records will ordinarily be retained for 1095 days after the Event concludes, only as necessary to complete Event administration and resolve related inquiries.
11.3 Records needed for an unresolved complaint, valid access request, security investigation, or applicable legal requirement may be retained longer for that specific purpose.
11.4 When information is no longer necessary, it will be securely deleted or irreversibly anonymized. Protected backup copies will expire under the Foundation's documented backup-deletion schedule.
11.5 Information will not be retained indefinitely for possible marketing or unrelated future use.
12. Access, Correction and Privacy Requests
12.1 You may contact the Foundation to:
- a. Ask whether we hold personal information about you;
- b. Request access to that information;
- c. Ask how it has been used or disclosed;
- d. Correct inaccurate or incomplete details;
- e. Withdraw consent; or
- f. Request deletion, subject to legitimate retention requirements.
12.2 Requests must be directed to privacy@evamb.com. Please include the Event name and sufficient registration information to locate your record, without sending unnecessary sensitive documents.
12.3 The Foundation may verify identity or authority before releasing or changing information. A family contact's registration role does not automatically entitle them to access another adult's private correspondence or additional personal information.
12.4 We will respond to access requests within 30 days. Where PIPEDA applies, any extension or restriction will follow its requirements, including notice of the reason and available complaint rights.
12.5 If information cannot lawfully be disclosed or deleted, we will explain the reason unless prohibited by law. Where possible, we will provide the portion that can be disclosed.
13. Privacy Incident Reporting and Response
13.1 Any suspected or confirmed privacy incident must be reported promptly to: privacy@evamb.com
13.2 Reportable concerns include lost devices, misdirected emails, unauthorized access, exposed registration records, improper sharing, or suspected misuse of attendee information.
13.3 Reports should describe what happened, when it was discovered, and the information potentially affected. Do not attach exposed attendee lists or sensitive records unless a secure submission method has been arranged.
13.4 The Foundation will assess the report, contain the incident, investigate its cause and impact, protect affected records, and implement appropriate corrective measures.
13.5 Reporting an incident to the above email address does not replace any legal obligation to notify affected individuals or a regulator. Where PIPEDA applies and a breach creates a real risk of significant harm, the Foundation will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as soon as feasible, as required by law.
13.6 Where PIPEDA applies, the Foundation will retain records of all breaches of security safeguards involving personal information under its control for at least 24 months after determining that the breach occurred.
14. Privacy Compliance and Accountability
14.1 The Foundation adopts PIPEDA's fair information principles as its privacy standard and complies with PIPEDA and applicable Ontario privacy legislation wherever those laws apply to its activities.
14.2 The charitable nature of the Event does not remove the Foundation's commitments under this Policy. However, PIPEDA's statutory application depends on the nature of the particular activity, including whether it is commercial.
14.3 A designated Foundation representative is responsible for overseeing privacy practices, responding to requests, reviewing complaints, and coordinating incident response.
14.4 Concerns should be directed to:
Privacy Representative
Ohm Shanti Foundation
Privacy email: privacy@evamb.com
Foundation email: admin@ohmshantifoundation.org
14.5 Individuals may also contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) regarding matters within its jurisdiction.
15. Policy Updates
15.1 This Policy will be available through the official digital registration form or its accompanying link.
15.2 Material changes will be communicated appropriately. An updated policy will not, by itself, authorize new purposes requiring consent.
15.3 Registration information collected for this charitable Event will remain subject to the stated confidentiality, purpose limitations, and applicable privacy requirements.
15.4 This agreement is governed by the laws of Ontario and Canada. Any disputes shall be resolved exclusively by the courts in Toronto, Ontario.