Purpose
This system processes personal information for one purpose only: door-to-door canvassing and get-out-the-vote work for this campaign — planning routes, recording what happened at each door, and re-planning from those results. It is never used for ad targeting, never sold, and never traded with anyone outside this campaign. The roster carries no field for ethnicity, religion, health, age or gender, so none of those is ever inferred from a name or an address; a person's level of support records only the attitude they stated themselves, never a score synthesised from outside data.
Basis: PIPA s. 10 · PIPA s. 11 · PIPA s. 14 · OIPC campaign activity guidance 2026-04
What is held
Two sides. Voter side: name, address, phone, email, language preference, opt-out flag, voted flag, voting station, plus each record's source, purpose, time of collection and consent tier; a door-result row records only the time, the person who logged it, and the outcome. A phone number or email address can only be stored under express consent — enforced by a database constraint, not by anyone remembering to filter. At the door only what the person you speak to says is recorded: never anything about other people in the household, and never an inference drawn from what is visible — ethnicity, religion, health, whether there are children at home, none of it enters the roster, because the roster has no field for any of it. Team side: your sign-in name (the lead signs in with an email address), display name, role, what you typed and what you did. This system never sends anything to a voter — outbound material stops at draft, and once approved it is exported as a file for a person to send by hand. There is exactly one network egress in the whole codebase: the machine-to-machine translation of a typed sentence (it exists only where the deployer configures a key), and what leaves is the redacted sentence, never the roster and never the approval pool.
Basis: PIPA s. 11 · OIPC campaign activity guidance 2026-04 · OIPC investigation report P19-01
Audit trail
Your actions leave a trace. Opening any voter's detail writes an access row (who, when, which voter number, from which screen); approvals, exports, role grants, erasures and opt-outs each write an audit row; what you type is redacted and then stored; the calls you make enter the decision history. Traces record numbers, never names — copying a name into a trace would undo an erasure. Trace tables are append-only: no code path edits or deletes a row.
Basis: PIPA s. 34 · OIPC investigation report P19-01
Retention and deletion
The deletion path is in the system, not just in this notice: an administrator can erase one voter — name replaced by a placeholder, phone and email cleared, address unlinked, consent tier back to unknown, get-out-the-vote draft bodies replaced by a placeholder, opt-out set true; the door-event rows are left untouched, so the counts stay honest while those rows no longer carry a name — a record a decision was based on has to be kept for at least a year under the retention rule, so those rows stay and the name does not. An opt-out can be registered on its own: it takes effect immediately, leaves a trace, and keeps that person off every later get-out-the-vote list. The deadline for destroying the roster as a whole is derived from the campaign calendar, and carrying it out stays a manual, human call — the system never destroys anything by itself, and the retention period is never open-ended.
Basis: PIPA s. 35 · OIPC investigation report P19-01
Your rights
Access, correction, and withdrawal of consent — all three are raised with the organization's privacy contact (next section). An answer to an access request carries three things: your personal information, the ways it has been used, and who it was disclosed to — this system sends nothing outward, so the answer to the third is none. The consequences of withdrawing are stated up front: it takes effect immediately, leaves a trace, and keeps you off every later get-out-the-vote list; door-event rows already written stay, and they carry no name. Inside this system there are exactly three automated paths: registering an opt-out, erasing one voter, and looking up who opened a given voter number and when. Access and correction requests are answered by people at the organization; they are not self-served here.
Effect of withdrawal: withdrawing consent also withdraws acceptance of the terms of use; the account is deactivated and the fact is recorded.
Basis: PIPA s. 9 · PIPA s. 23 · PIPA s. 24 · OIPC investigation report P19-01
Privacy contact
Not set — privacy contact: Not set. This comes from the organization's own settings; the system never fills it in for you. It has to be someone who can actually answer a question, and it has to be public.
Basis: PIPA s. 4(3) · PIPA s. 10
Version and effect
Version 4 · in effect 2026-09-02. Each of the eight sections in this notice carries the basis it was drafted from — 14 verified sources in all, listed on the basis line under each section, with the address and retrieval date of each kept in the source table in the code. When this text changes version you are asked to agree again at your next sign-in — consent to an older version never stands in for a newer one. This text is not legal advice and makes no claim of compliance.
Basis: PIPA s. 6 · PIPA s. 7 · OIPC campaign activity guidance 2026-04
Terms of use
The organization and its members are responsible for personal information collected, used and disclosed through this system, within what BC PIPA permits. Uploaded lists always pass through an import declaration; the operator records the declaration and does not verify it. The operator keeps reasonable security arrangements and destruction duties for data in its custody.
Basis: PIPA s. 7 · OIPC campaign activity guidance 2026-04