University of Manitoba Students’ Union

PRIVACY POLICY

Last Revised: March 2026

In this Privacy Policy, “UMSU“, “we“, “us“, “our” and “ours” means the University of Manitoba Students’ Union, and “you” means (and “your” refers to) anyone who provides personal information to us, and their successors, heirs, administrators, executors and assigns (as the case may be).

We have adopted this UMSU Privacy Policy (this “Privacy Policy“) to explain how we will meet our responsibilities with respect to the information you provide to us.  This Privacy Policy applies to both individuals and organizations from whom we collect personal information.

The principles that form the basis of this Privacy Policy are interrelated and UMSU adheres to all of the principles as a whole.  Each principle should be read in conjunction with the accompanying commentary. As encouraged by the Personal Information Protection and Electronic Documents Act (“PIPEDA“), the commentary in this Privacy Policy has been drafted to reflect privacy issues specific to UMSU.  We will continue to review this Privacy Policy to make sure that it remains current with exceptions, changing technologies, industry standards and applicable laws.

  1. Scope and application

This Privacy Policy applies to personal information, in any form, collected, used or disclosed by UMSU in the course of commercial activities.  It will not typically apply to information directly regarding UMSU’s corporate clients.  However, such information may be protected by other UMSU policies and through contractual arrangements.

This Privacy Policy does not impose any limits on the collection, use or disclosure of the following information by UMSU:

  • information about an individual that is publicly available and is specified by regulation pursuant to PIPEDA;
  • personal information that is not collected, used or disclosed, for commercial purposes;
  • non-personally identifiable information; and
  • the name, title, business address or telephone number of anyone, where the collection, use or disclosure of such information is solely for the purpose of communicating with the person about their employment, business or profession.

The application of this Privacy Policy is subject to the requirements and provisions of PIPEDA, and any other applicable legislation or regulation. If you reside in British Columbia, Alberta or Québec, then the substantially similar provincial privacy law of your province will apply to our handling of your personal information, rather than PIPEDA.  In that case, reference in this Privacy Policy to PIPEDA will be deemed to include your province’s substantially similar privacy law.

  1. Definitions

collection:  The act of gathering, acquiring, recording, or obtaining personal information from any source, including third parties, by any means.

consent:  Voluntary agreement for the collection, use and disclosure of personal information for defined purposes.  The form of consent we seek may vary, depending upon the circumstances and the type of personal information.  In determining the form of consent, we take into account the sensitivity of the personal information and your reasonable expectations.  Consent may be provided directly by you, or by your authorized representative, in accordance with applicable law.

disclosure:  Making personal information available to a third party, for their own purposes independent of services the third party performs for or on behalf of UMSU.

employee:  An employee of, or an independent contractor to, UMSU.  The inclusion of independent contractors within the definition of “employee” is for convenience of reference only, and should in no manner imply that such independent contractors are our employees within the meaning of employment legislation or are in an employee-employer relationship with us.

personal information:  Information about an identifiable individual.

student(s): A student or multiple students registered at the U of M.

third party:  An individual or organization outside of UMSU.

U of M: The University of Manitoba.

U-Pass: A Universal Transit Pass which provides specific access to Winnipeg Transit transportation services in exchange for a fee.

use:  The treatment, handling, and management of personal information by and within UMSU or by a third party on behalf of UMSU and with the knowledge and approval of UMSU.

website: Our website, https://umsu.ca/.

  1. How UMSU works

UMSU seeks to enhance student life and increase the quality of students’ education through consultation, representation, and advocacy. To accomplish this goal, UMSU provides a number of student services, including food and retail, arranging for health and dental insurance, the UMSU Service Centre, U-Pass, and more. The provision of UMSU’s services requires the collection of personal information.

  1. Accountability for our handling of personal information

UMSU is responsible for all personal information under our control and has designated the UMSU Privacy Officer to oversee privacy compliance.  Other individuals within UMSU may be delegated to act on behalf of our Privacy Officer or to take responsibility for the day-to-day management of personal information. UMSU trains and communicates our privacy practices, including this Privacy Policy, with all individuals within UMSU who may have access to personal information.

As appropriate, UMSU implements privacy policies and procedures to properly enforce this Privacy Policy, and we use contractual or other means to provide a comparable level of privacy protection while personal information is being processed or used by a third party. 

  1. Reasons why we collect, use and disclose personal information

UMSU collects personal information from you for the following purposes:

  • staff onboarding;
  • volunteer onboarding;
  • student safety;
  • to provide you with information, products, or services that you request from us, or for services that are otherwise provided to all students by us or on our behalf;
  • to advertise or market services that might be of interest to students;
  • to provide individuals with the UMSU newsletter via email;
  • to carry out our obligations and enforce our rights arising from any contracts with you, including for billing and collection or to comply with legal or regulatory requirements;
  • For election purposes; ensuring students who are providing signatures for candidates are registered U of M students;
  • in any other way we may describe when you provide the information; and
  • for any other purpose with your consent, or as required or permitted by law.

Further reference to “identified purposes” means the purposes identified in this section of this Privacy Policy.

We will indicate the identified purposes to you, orally, electronically or in writing, at or before the time your personal information is collected.  Persons collecting personal information may explain the identified purposes or refer individuals to a designated person within UMSU who can explain these identified purposes.

  1. Collection of personal information

UMSU is a mandatory student organization, meaning all students admitted to the U of M become UMSU members. UMSU arranges for all students to receive certain services, including but not limited to:

(1) a U-Pass; and

(2) health and dental insurance,

through a third party on an opt-out basis. To provide these services, UMSU collects personal information from all students. For student safety, UMSU also collects an emergency contact number from each student.

In most cases, personal information is collected through forms and contracts that you submit to the U of M during the application process. Through agreement with the U of M and UMSU, the U of M provides such information to the Managing Director of UMSU to be used for specific purposes. Sometimes, however, this personal information is collected directly from you when you engage UMSU’s services. When you make inquiries through our website (https://umsu.ca/) or our Service Centre, an employee may collect your personal information, depending on what is required to effectively answer your inquiry or to otherwise provide the services you have requested. When using UMSU’s food or retail services, an employee may collect personal information from you to provide those services.

UMSU will only collect personal information that is necessary for the purposes identified in this Privacy Policy or as otherwise agreed to by you. At times, personal information may be collected for more than one purpose.    

We collect no personal information about you unless you provide that information to us or the U of M. We do not use techniques that collect personal information about anyone without their knowledge. We only collect personal information about individuals when they specifically and knowingly provide it to us or the U of M. As a limited exception to this principle, we may collect personal information without your consent where permitted by PIPEDA and other applicable laws.

You may withdraw consent for the collection, use and disclosure of your personal information at any time, subject to legal or contractual restrictions (for example, all students are required to remain as members of UMSU) and reasonable notice. For more information about withdrawing your consent, you may contact UMSU’s Privacy Officer(s).

  1. Consent for us to contact you about our products and services

The contact information collected by UMSU allows us to inform you about services, events or issues which may be of interest to you.

By being a member of UMSU, you are giving UMSU permission to contact you by way of the information you provide. If you would like to opt-out of receiving this information, please contact UMSU’s Privacy Officer (provided that you cannot opt-out of receiving information we are legally obligated to provide).

  1. Disclosure of personal information

UMSU will not disclose personal information for purposes other than those purposes for which it was collected, except with your consent or as required or permitted by law. UMSU may disclose your personal information:

  • to fulfill the identified purposes (for example, by providing your billing information to a third-party payment processor);
  • when we have your consent, whether express or implied;
  • to meet legal and regulatory requirements; and
  • where required or permitted by law.

In such circumstances, we will not disclose more information than is required for the purpose for which the information is being disclosed. We will also, whenever it is reasonable and practicable to do so, enter into confidentiality agreements with third parties with whom we share personal information or otherwise take measures to safeguard your personal information which are consistent with the sensitivity of that personal information.  

Only our employees or other representatives who require access for legitimate reasons or whose duties reasonably so require, are granted access to personal information. 

We will retain personal information only as long as it remains necessary or relevant for the identified purposes or as required or permitted by law.  We maintain reasonable controls, schedules and practices for personal information management retention and destruction. Personal information that is no longer necessary or relevant for the identified purposes, or is required by law to be retained, is destroyed, erased or made anonymous, as appropriate in the circumstances.

  1. UMSU website

Our website may use various technologies, from time to time, to:

  • help us customize your experience on our website;
  • track your use of our website for advertising, marketing, or promotional purposes;
  • help us determine whether you opened an email message from us; or
  • gather information to deliver information about products and services we think may be of interest to you.

 

The type of information we may collect by automated means includes:

  • your visiting domain name or IP address;
  • the device, browser, operating system type and screen resolution you use;
  • information on actions taken at our website, such as navigation patterns (i.e., pages viewed and downloaded; job postings viewed, etc.) and the date, time, duration and number of times you visited our website;
  • the previous site you visited; and
  • the geographical location (such as the country and city of origin) from where you accessed our website.

 

This information enables us to:

  • customize the services we offer you, to improve our website;
  • estimate our audience size and usage patterns;
  • store information about your preferences, allowing us to customize our website according to your individual interests;
  • speed up your searches;
  • recognize you when you return to our website; and
  • show our advertisements on external sites.

 

When you visit our website, we may collect certain information by automated means such as through the use of cookies, other automated devices and website tracking tools such as Google Analytics. We use Google Analytics to collect information about how our website is used. Google Analytics generates statistical and other information about websites by means of cookies stored on users’ computers. Google may collect, transfer, store, and process this information on its servers located in the United States.

You can read about how Google Analytics collects and processes data here. If you do not want information relating to your visit to our website reported by Google Analytics, you can install the Google Analytics opt-out browser add-on. For more information, see the Google Analytics Opt-out Browser Add-on.

Other third parties, including Facebook, may use cookies, web beacons, and other storage technologies to collect or receive personal information from the Website to provide measurement services and targeted ads. Note that UMSU does not provide any interest-based advertising or create advertising profiles of users. Users can update their advertising preferences and limit cookies used by their browsers and third parties by updating settings.

Opting out of a network does not mean you will no longer receive online advertising. It does mean that the network from which you opted out will no longer deliver ads tailored to your web preferences and usage patterns.

  1. Accuracy of personal information

We make reasonable efforts to ensure that personal information we collect, use or disclose is as accurate, complete and up-to-date as necessary for the purposes for which it is to be used. Please be advised, however, that UMSU uses and relies on information from the U of M, the accuracy of which we cannot control.

If you find any errors in our personal information holdings (including information provided by the U of M), we should be informed so that we can make the appropriate corrections. We will convey these corrections to the U of M, where we are able and it is reasonable to do so, in the case of personal information which is not under our control. For personal information that remains in dispute, we will make note in our records of your opinion as to accuracy of the relevant personal information. 

  1. Security of personal information

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to prevent any unauthorized access, disclosure, copying, use, or modification of personal information. Safeguards include securing physical documents and technological measures by way of secure access and encryption. We store all information you provide to us behind firewalls on secure servers.

Individuals with UMSU, including employees, are authorized to access personal information based only on their need to deal with the information for the reason(s) for which it was obtained. Safeguards are in place to reduce the risk that information will be disclosed or shared more widely than is necessary to achieve the purpose for which it was gathered. We also take measures to maintain the integrity of this information and to prevent its being lost or destroyed.

We use measures to protect personal information disclosed to third parties by contractual agreements stipulating the confidentiality of the personal information and the purposes for which it is to be used.  

  1. Openness concerning our policies and procedures

We are open about the policies, procedures and practices we use to protect your personal information. Information about these policies, procedures and practices are made available to you either electronically or in writing.

  1. Access to your personal information

You may access any personal information that we have concerning you, and which has been collected, used or disclosed for a commercial purpose, by sending a written request to the UMSU Privacy Officer. UMSU may advise you in advance if there is a minimal charge to conduct a search of our records and will respond within 30 days, or advise that the request for access is subject to an extension as authorized by PIPEDA.

To protect your privacy, you may be required to provide sufficient identification, in order to permit us to account for the existence, use and disclosure of certain personal information and to authorize access to such information. Any such information will only be used for this purpose.

We may not be able to provide personal information to you if doing so would violate the privacy of a third party or if certain personal information is subject to legal privilege, contains information proprietary to us or a third party, is too costly to retrieve, or cannot be disclosed for other legal reasons.  If we are unable to provide access to all or part of your personal information, we will explain our reasons for such a decision.

Where you have been provided with access to your personal information, you will be able to challenge the accuracy and completeness of your personal information and have it amended as appropriate. 

Personal information that is disclosed to third parties by us will be subject to the general laws applicable in the jurisdiction in which the third party conducts business. As a result, and in certain limited situations, we may not be legally permitted to account for certain collections, uses or disclosures of personal information. In most circumstances, however, we will provide an account of the collection, use and disclosure of personal information and, where reasonably possible, we will state the source of the personal information. In providing an account of disclosure, we will provide a list of organizations to which we may have disclosed your personal information when it is not possible to provide an actual list. 

  1. Data Received from Third Parties

We may receive personal information from the U of M as part of our delivery of services to students. This information may include:

  • Student’s name;
  • Student numbers;
  • Student emails; and
  • Enrollment status (full time vs part time).

We use this information for the purposes outlined in this Privacy Policy and in accordance with our data sharing agreement with the U of M. We limit our use and disclosure of this information to those purposes, except as permitted or required by applicable law or with your consent, and we take reasonable steps to help ensure that personal information is used and disclosed consistently with these purposes.

  1. Challenging compliance with privacy laws

All questions or concerns regarding our privacy practices should be directed to UMSU’s Privacy Officer. 

We will investigate all complaints concerning compliance with this Privacy Policy and if a complaint is found to be justified, we will take appropriate measures to resolve the complaint including, if necessary, amending our privacy policies and procedures.  We will inform you of the outcome of the investigation regarding your complaint.

  1. Language

You and UMSU have requested and agree that this Privacy Policy and all documents related to this Privacy Policy be drawn up in English. Les parties ont demandé que cette convention ainsi que tous les documents que s’y rattachent soient rédigés en anglais.

  1. Contact Us

If you have any questions or concerns about this Privacy Policy or about UMSU’s information handling practices, please contact us at:

Kayla Young – Human Resources & Payroll Manager

Phone number: 204-4747126

Email: kyoung@umsu.ca

Please also visit the Office of the Privacy Commissioner of Canada’s website at https://www.priv.gc.ca/en/.