Privacy Policy

Plastic Bank Foundation (Canada) is committed to fully complying with the EU’s General Data Protection Regulation (GDPR).

What is Plastic Bank Foundation (Canada)’s policy concerning EU GDPR compliance?
Plastic Bank Foundation (Canada) is committed to full compliance with the EU’s General Data Protection Regulation (GDPR) in all aspects of business. Plastic Bank Foundation (Canada) operates with Data Protection by Design and by Default as a philosophy while maintaining a robust GDPR compliance system and internal data security auditing process.

Plastic Bank Foundation (Canada) is committed to holding the six data protection principles to the highest standards. They are:

1. Lawfulness, fairness, and transparency
2. Purpose limitation
3. Data minimization
4. Accuracy
5. Storage limitations
6. Integrity and confidentiality

Plastic Bank Foundation (Canada) is fully GDPR compliant and takes an extreme compliance approach to meet the strictest standards required by our partners and users based in the EU

1. Plastic Bank Foundation (Canada) only uses physical opt-in, consent-based data capture for legitimate business reasons.
2. Our privacy policy is accessible at all data inputs and transparently includes all of the GDPR requirements and reasonings for collecting, storing and using the data.
3. We maintain a robust GDPR compliance system and an internal auditing process. The proper GDPR policies and documentation are in place along with the proper GDPR security and data protection measures. This includes state-of-the-art blockchain encryption, Hyperledger Fabric smart contracts, IBM server and multi-cloud storage, and a custom-designed resilience system with multiple servers on multiple continents.
4. Age of consent is appropriately verified through special tools built into our website and application that automatically adjust the required age based on each user’s country. Our school programs utilize in-app, family accounts, with the consent of a parental guardian.
5. We utilize Data Protection Impact Assessments and Legitimate Interest Assessments to document the risk mitigation steps and reasonings to compliantly collect, store, and utilize data.
6. We maintain an updated GDPR compliant cookie protocol only used to optimize the user experience of new and returning visitors to our website.
7. We have a storage limitation and retention period policy to anonymize data after 5 years since the last date of user activity or upon request from a discontinued user.

Our GDPR Continuous Improvement Routines
Shaun Frankson, has been appointed as our Data Protection Officer, to proactively oversee Plastic Bank Foundation (Canada)’s GDPR compliance. We utilize a GDPR committee consisting of Shaun Frankson, as well as other invited internal and external guests, to conduct an annual GDPR audit with quarterly GDPR compliance update meetings.

Plastic Bank Foundation (Canada)’s last annual GDPR audit was completed on April 14, 2020, by Shaun Frankson.

In an effort to continuously maintain and improve our GDPR compliance, Plastic Bank Foundation (Canada) maintains the following documents and policies:

• An Updated Data Privacy Agreement accessible through all data collection points
• Official GDPR Policy
• GDPR Compliance Audit Logs
• Historical Data Privacy Archives
• Updated Cookies Policy
• Data Flow Chart
• Data Asset Registry
• GDPR Meeting Tracker
• Data Security Strategy
• Data Protection by Design Outline
• Age of Consent List and System Tracker
• PIPEDA Breach Reporting Criteria
• (DPO) Data Protection Officer Responsibilities
• Legitimate Interest Assessment Forms
• Data Protection Impact Assessment Forms
• Employee Data Privacy Policy
• Data Subject Access Request Log
• Data Processor Compliance Agreement