Privacy Policy
Contents
- Introduction
- Scope of This Policy
- Definitions
- Information We Collect
- How We Collect Information
- Why We Use Information
- Legal Bases for Processing
- Grant Records and Disclosure Obligations
- Sharing and Disclosure
- Service Providers
- Cookies and Local Storage
- Retention and Deletion
- Security Safeguards
- Your Rights and Choices
- Access and Correction Requests
- Privacy for Children
- International Transfers
- Automated Decision Making
- Data Breach Notification
- Third Party Sites and Links
- Changes to This Policy
- Contact and Complaints
1. Introduction
This Privacy Policy explains how Super Fed Inc. collects, uses, stores and protects personal information in the course of running its grant wing desk and its related computer systems design work. The website and the desk services are maintained by the developer known as Super FED on behalf of Super Fed Inc., and both the developer and the company take the handling of personal information seriously. The company operates from 1222 Rose Way, Milton - L9E 1P1, Canada (CA), and can be reached by email at respond@superfed.autos or by telephone at +19127614714.
We wrote this document in plain English so that anyone who deals with us, whether an applicant, a grantee, a partner organisation, a funder or a website visitor, can understand what happens to information that concerns them. We have deliberately avoided legal shorthand where a straightforward sentence will do. Where a term has a specific meaning in this policy, it is defined in section three so that the rest of the document can be read without guesswork.
By using this website or engaging the desk, you accept the practices described here. If you do not accept them, please do not use the website and let us know so that we can discuss the matter with you directly. We would rather answer a question than lose your trust.
2. Scope of This Policy
This policy covers personal information handled through this website, through correspondence with the desk by email, telephone or post, and through the grant wing desk services that we operate for clients. It does not cover information that a client organisation holds in its own systems when that organisation acts as the controller of the information, although we describe how we handle such material when we act on a client behalf.
When we operate a grant desk for a funder, the funder generally remains the primary decision maker about the awards and about the personal information in the application files. We act on that organisation instructions and we apply the safeguards described in this policy to everything we touch. If you are an applicant and you wish to exercise a right over your application, you may contact us and we will either assist you directly or direct you to the responsible organisation, whichever is appropriate.
This policy does not apply to third party websites that may be linked from our pages. Those sites have their own privacy practices, and we encourage you to read them before providing any information.
3. Definitions
In this policy, the words below have the following meanings. Personal information means any information about an identified or identifiable individual. The company means Super Fed Inc. The desk means the grant wing desk services described on this website. A client means an organisation that engages the company to operate or design a grant process. An applicant means an individual or organisation that submits an application through a desk we operate. A grantee means a recipient of funds administered through the desk. A partner means an intermediate organisation that passes funds onward. A service provider means a supplier that processes information on the company behalf under a written agreement. The website means the pages published at superfed.autos.
References to you mean the individual reading this policy or the organisation that individual represents. References to we, us and our mean the company. Section headings are provided for convenience and do not affect the meaning of the text beneath them. Words in the singular include the plural and words in the plural include the singular where the context allows.
4. Information We Collect
We collect the information that is necessary to answer an enquiry, process an application, administer an award, vet a partner or report to a funder. The categories below describe the kinds of information that may be involved.
Contact information includes names, job titles, organisation names, postal addresses, email addresses and telephone numbers. Where an enquiry arrives through the contact form, the form opens your email client and the message reaches us as ordinary email, which means the company receives your name, email address, subject line and message text.
Application and grant information includes the content of applications, budgets, supporting documents, governance records, banking references needed for payment, reporting submissions and correspondence about an award. It may include information about the individuals who run an applicant organisation, because grant decisions require an understanding of who is responsible for the funds.
Partner vetting information includes legal standing, governing documents, financial capacity indicators, prior reporting quality and open conditions. It may include the names and roles of directors and officers, because a vetting review cannot be completed without knowing who governs the organisation that will receive funds.
Technical information includes the information that a web server records when a page is requested, such as an internet protocol address, browser type, the page requested and the time of the request. We keep such records only as long as needed for security and troubleshooting. We do not build advertising profiles from this information.
5. How We Collect Information
Most information reaches us directly from you, whether through the contact form, an email, a telephone call, a posted document or a file uploaded to a desk we operate. Some information arrives from a client who has asked us to run a process on its behalf, and some arrives from a partner organisation during a vetting review.
A small amount of technical information is generated automatically when a page is requested, as described in section four. We do not use tracking scripts to follow visitors across other websites, and we do not sell visitor information to anyone.
Where information about a third party is provided to us, for example a reference or a director name in a governance record, we ask the provider to confirm that it is entitled to share that information. We treat all such material with the same safeguards that apply to information you provide about yourself.
6. Why We Use Information
We use personal information to respond to enquiries, to assess applications, to issue review letters, to schedule and reconcile disbursements, to complete partner vetting, to prepare reports and to maintain the audit trail that connects all of these steps. Each use is tied to a concrete purpose connected to the grant wing desk.
We also use information to operate and improve the website, to protect the desk against fraud or misuse, to meet record keeping obligations and to comply with the law. Where we design a filing run for a client, we may use aggregated and de identified observations about workflow patterns to improve our methods, but we never use identifiable grant information for that purpose.
We do not use personal information for marketing unless you have asked us to send you information, and we do not send marketing to applicants or grantees. If you receive a message you did not expect, please tell us and we will investigate.
7. Legal Bases for Processing
Where Canadian privacy law applies, we process personal information with consent, or as permitted for a purpose that a reasonable person would consider appropriate in the circumstances. Consent may be express or implied by the nature of the relationship, and it may be withdrawn at any time subject to legal or contractual restrictions and reasonable notice.
Where other privacy laws apply, our legal bases may include the performance of a contract, the pursuit of legitimate interests that do not override your rights, compliance with a legal obligation, or your consent. When we rely on legitimate interests, we assess the impact on individuals and we keep that assessment available for review.
Where we process information on behalf of a client, the client is responsible for establishing its own legal basis and for providing any required notices to applicants and grantees. We support that work by supplying accurate descriptions of how the desk handles information.
8. Grant Records and Disclosure Obligations
Grant administration creates records that must be kept and sometimes disclosed. A funder may be obliged to publish the names of recipients and the amounts awarded, and an auditor may be entitled to inspect the audit trail. We design the desk so that these obligations are met without exposing more personal information than necessary.
Where a disclosure is required by law, by a funding agreement or by a regulator, we will make it, and we will tell the affected individuals where we are permitted to do so. Where a client asks us to disclose information to a funder or an auditor, the request is handled under the client instructions and the same proportionality principle applies.
Anyone dealing with the desk should understand that a grant file is not a private correspondence. It is a record with a life of its own, and the policy below on retention and access reflects that reality honestly.
10. Service Providers
We rely on a small number of service providers for email, hosting, document storage and payment execution. Each provider is selected with care and is bound by a written agreement that requires it to protect information, to use it only for the service it provides and to notify us of any incident that could affect the information entrusted to it.
Service providers are not permitted to use personal information for their own marketing or to share it with further parties without our instruction. We review provider security practices periodically and we change providers where the evidence supports a change. A list of provider categories is available on request.
12. Retention and Deletion
We keep information only for as long as we need it for the purpose for which it was collected, for the retention period required by a funding agreement, or for the period required by law. Grant records are typically retained for the period specified by the funder, which is often several years after an award closes, because audits can reach back into earlier cycles.
When a retention period ends, we delete or anonymise the information. Where deletion is not immediately possible because information is held in a backup, we isolate it and ensure that it is not used for any purpose until the backup cycle removes it.
You may ask us to delete information sooner than the retention schedule allows. We will honour the request where no legal or contractual obligation requires us to keep the record, and we will explain the reason if we cannot.
13. Security Safeguards
We protect personal information with a combination of technical and organisational measures. Access to grant records is role based, changes to award amounts require a second reviewer, and every action is recorded in the audit trail window described on the services page. Records are stored on systems that are kept current with security updates, and access credentials are managed so that they are not shared between individuals.
Our staff and contractors receive training on handling personal information, and they are bound by confidentiality obligations. Physical documents that pass through the Milton office are kept in a controlled area and are filed in the order in which they were handled so that a missing item can be traced.
No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we take proportionate measures, that we review them, and that we will tell you plainly if something goes wrong.
14. Your Rights and Choices
You have the right to be told how your information is used, the right to request access to the information we hold about you, the right to ask for corrections, and the right to withdraw consent where consent is the basis for processing. You also have the right to ask questions about our practices and to make a complaint to a privacy regulator.
Some choices are built into the desk. If you no longer wish to receive a particular kind of message from us, tell us and we will update the record. If you are an applicant and you prefer to correspond through your organisation rather than as an individual, tell us and we will adjust the channel.
Exercising a right will never lead to retaliation. We treat every request as a normal part of running an accountable desk.
15. Access and Correction Requests
To make an access or correction request, write to respond@superfed.autos or to Super Fed Inc., 1222 Rose Way, Milton - L9E 1P1, Canada (CA). Include enough detail for us to identify the records you mean, such as an application number, an award reference or the dates of your correspondence. We may ask for proof of identity before releasing records, because we will not hand personal information to someone who has not established that they are entitled to it.
We respond within the time allowed by applicable law, and where we need more time we will tell you why and when to expect a reply. If we refuse a request in whole or in part, we will explain the reason and describe the complaint route available to you.
There is normally no charge for making a request. If a request is unusually complex, we will discuss any cost with you before proceeding.
16. Privacy for Children
The desk is designed for organisations and for adults acting on their behalf. We do not knowingly collect personal information from children under thirteen through this website, and the contact form is not intended for use by children. Where a grant programme serves young people, any information about them is collected through the applicant organisation with the consent of a parent or guardian, and the necessary safeguards are documented in the programme file.
If you believe that a child has provided personal information to us directly, please contact respond@superfed.autos and we will remove the information promptly.
17. International Transfers
We are based in Canada and we generally process information within Canada. Where a service provider or a client requires information to be handled in another country, we take reasonable steps to ensure that the receiving organisation provides a comparable level of protection and that the transfer is lawful. Where a funding agreement specifies a location, we follow it.
Information held abroad may be accessible to authorities in that country under its laws. We mention this openly, because pretending otherwise would be misleading. If a transfer matters to your programme, raise it with us during discovery and we will build the arrangement around it.
18. Automated Decision Making
The desk uses rules and systems to check completeness, to schedule runs and to flag exceptions, but it does not make award decisions by algorithm. Decisions about grants are made by people, and the reasons are recorded against the file. Where a system flags a file for attention, a person reviews the flag before any outcome is reached.
Where a client asks us to introduce a scoring aid, we require that the aid is transparent, that a person remains responsible for the decision, and that the applicant can ask for the reasoning behind a result. The audit trail records the aid that was used and the person who decided.
19. Data Breach Notification
If we become aware of a breach of security that creates a real risk of significant harm, we will assess it promptly, contain it, and notify the affected individuals and the relevant regulator as required by law. We will also notify the client on whose behalf the desk was operating, and we will describe what happened, what information was involved and what we are doing about it.
After a breach we review the cause and strengthen the safeguards that failed. A record of the incident and the remediation is kept so that future reviews can learn from it.
20. Third Party Sites and Links
Our pages may link to websites run by other organisations, including funders, partners and regulators. We do not control those sites and we are not responsible for their privacy practices. When you leave our site, the privacy policy of the destination site applies, and we encourage you to read it.
If you reach our site from a link on another site, that site may have collected information about your visit before you arrived. That collection is governed by its own policy, not by this one.
21. Changes to This Policy
We review this policy from time to time and we update it when our practices change or when the law requires it. When we make a material change, we will update the date at the top of this page and, where the change affects current applicants or grantees, we will tell them directly.
Continued use of the website after a change takes effect means that you accept the revised policy. If you do not accept a revision, please contact us so that we can discuss the implications for your relationship with the desk.
22. Contact and Complaints
If you have a question about this policy, a request about your information, or a complaint, you can reach the company by email at respond@superfed.autos, by telephone at +19127614714, or by post at Super Fed Inc., 1222 Rose Way, Milton - L9E 1P1, Canada (CA). Please include enough detail for us to identify the matter and the records involved.
We aim to acknowledge every privacy message within two working days and to resolve it as quickly as the facts allow. If you are not satisfied with our response, you may complain to the privacy regulator in your jurisdiction. In Canada, that is the Office of the Privacy Commissioner. We will cooperate fully with any such review.
This policy forms part of the terms on which the website and the desk are offered, together with the Terms of Service linked in the footer. Thank you for taking the time to read it.