Privacy Policy

1. Who this policy is from

This website is operated by Ajax Pickering Hospital Foundation, a registered charity in Ontario, Canada, charity number 141132662RR0001. The office is at 580 Harwood Avenue South, Ajax, ON L1S 2J4, Canada.

The Foundation is the organisation responsible for the personal information described here. Questions, requests and complaints about it go to the privacy officer at privacy@win4carcer.ca. The privacy officer is reachable by email.

This policy applies to win4carcer.ca and to the enquiries and account records that reach the Foundation through it. It does not apply to the raffle system that sells the tickets, which is covered in section 5, and it does not apply to the hospital, which is covered in section 3.

2. The law this policy follows

The Foundation applies the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal privacy law that governs organisations in Ontario, together with the ten principles in its Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.

Two other statutes shape how this site behaves. Canada's Anti-Spam Legislation governs the commercial messages the Foundation may send you and is described in section 8. Ontario's Accessibility for Ontarians with Disabilities Act requires this site to meet a published accessibility standard, which affects the way consent choices are presented.

You may complain to the Office of the Privacy Commissioner of Canada, and, in matters that fall to the province, to the Information and Privacy Commissioner of Ontario. Section 12 explains how.

3. This is not a health service

This website is not a channel for health care services and does not collect personal health information. Patient health information at Ajax Pickering Hospital is handled by Lakeridge Health under Ontario's Personal Health Information Protection Act, separately from this site.

Nothing on this site asks for a diagnosis, a treatment history, a health card number or any other health detail, and the Foundation asks you not to put such information into the contact form. If you send health information anyway, the Foundation will not add it to any record: it will answer your enquiry and then delete the message.

The Foundation raises money for equipment at Lakeridge Health — Ajax Pickering Hospital. It has no access to patient records, no role in clinical care and no way to look anything up on a patient's behalf. Requests about hospital records belong with Lakeridge Health.

4. What is collected, and when

The Foundation collects the following through this website, and nothing else.

Contact form

Your name, email address, the subject you choose and the message you write. The form has no server behind it: it composes the message in your own mail application, so the details reach the Foundation as an ordinary email you send yourself. Nothing is stored on this site in the process.

Website account

If you create an account: first name, last name, email address, date of birth, Ontario postal code, language preference, a one-way derivation of your password, your consent record, and whatever you later choose to save — ticket numbers, reminder settings, a spending budget, donation records and the result of the self-assessment.

These account records are held in your own browser's local storage on the device you used. They are not transmitted to the Foundation and the Foundation cannot read them. Clearing your browser data removes them. The Foundation only learns something about your account if you write to it and tell it.

Cookies and analytics

Identifiers set by cookies and similar storage, plus the aggregate measurement described in the Cookie Policy. Nothing beyond the strictly necessary category runs before you choose. Section 7 covers this.

Server logs

The hosting provider records the usual technical details of a request — IP address, time, page requested, browser type — for security and to keep the site running. These logs are not combined with anything else and are not used to build a profile of you.

5. Information the Foundation does not hold

Ticket purchasers' details are handled by BUMP, A Division of Canadian Bank Note, and by the payment provider inside the raffle system, each acting as a separate controller of that data under its own privacy policy.

When you buy a ticket, the purchase happens inside the raffle system run by BUMP, A Division of Canadian Bank Note Company Ltd.. That system takes your name, contact details and payment, issues the ticket number and sends you the confirmation. It does so under its own privacy policy and its own obligations as a gaming supplier registered with the Alcohol and Gaming Commission of Ontario.

No card number, expiry date or security code ever reaches this website. There is no cart here, no payment page and no ticket generation. This website does not sell tickets, does not operate a cart, and never receives or stores card data. All payments are completed inside the AGCO-approved electronic raffle system.

The Foundation receives from the raffle system what it needs to run the lottery under its licence: the record of tickets sold, and the winner's details when a prize has to be awarded. Those records are held by the Foundation offline, not on this website, for as long as the licence conditions require.

6. Why the information is used

Each purpose below is the only reason the matching information is collected.

• Answering you. Contact details from your enquiry, used to reply and to keep a record of what was asked and answered.
• Running your account. Profile details, used to sign you in, show your saved records and apply your language preference.
• Confirming eligibility. Date of birth and postal code, used to confirm you are at least 18 and resident in Ontario before an account is created.
• Sending reminders you asked for. Email address, used only after you confirm it, and only for the reminders you switched on.
• Publishing a result. A winner's first initial, surname, city and winning ticket number, published because rule 21 of the Rules of Play requires it.
• Measuring the site. Aggregate analytics, used to see which pages people rely on, and only with your consent.
• Keeping the site safe. Server logs and the form's spam controls, used to prevent abuse.

The Foundation does not sell personal information, does not rent mailing lists, and does not share your details with other charities.

The legal basis

Under PIPEDA the basis is consent, and the form the consent takes depends on how sensitive the information is and what a reasonable person would expect. Sending an enquiry carries implied consent to a reply. Creating an account, switching on reminders and allowing analytics all require an express action from you: a tick, a toggle, a button. None of them is pre-selected.

Publishing a winner's name, city and ticket number is a condition of entry set out in the Rules of Play and required by the licence. Buying a ticket is acceptance of that condition.

7. Cookies and measurement

The Cookie Policy lists every category in use, with its purpose, the names of the identifiers, how long each lasts and who provides it. In summary: strictly necessary storage keeps the site working and cannot be switched off; preferences, analytics and marketing are all off until you turn them on.

Analytics runs through Google Analytics 4 with consent mode. Until you consent, the analytics and advertising signals are set to denied, no measurement script is requested, and no analytics identifier is written. Where no measurement property is configured, nothing is requested at all.

You can change your mind at any time using the cookie control in the footer of every page. Withdrawing consent stops future collection; it does not delete measurements already recorded in aggregate, which cannot be traced back to you.

8. Email, and how to stop it

Emails are sent by the Ajax Pickering Hospital Foundation, 580 Harwood Avenue South, Ajax, ON L1S 2J4. Every email carries an unsubscribe link.

Canada's Anti-Spam Legislation requires express consent before a commercial electronic message is sent, clear identification of the sender, and a working way to unsubscribe. The Foundation applies all three. The reminder consent is unticked by default. After you tick it, the address stays in a pending state until you confirm it, and nothing is sent in the meantime.

To stop receiving reminders, use the unsubscribe link in any email or turn them off under Draw reminders in your account. A single control turns every reminder off at once. Requests take effect immediately and in any event within ten business days, as the law allows.

Messages that answer something you asked, or that tell a winner they have won, are not marketing and are sent regardless of your reminder setting.

9. Who else sees it

The Foundation uses a small number of suppliers. Each is bound by contract to use the information only for the service it provides.

The Foundation will also disclose personal information where the law requires it: to the Alcohol and Gaming Commission of Ontario in the course of its oversight of the licences, to the Canada Revenue Agency in relation to charitable receipting, or in response to a court order or lawful demand.

Information that leaves Canada

Some suppliers store or process information in the United States. While it is there it is subject to the laws of that country, and a court or public authority there may be able to require access to it. The Foundation limits what crosses the border to the analytics and email categories described above, and requires contractual protection comparable to what Canadian law provides. You can avoid the analytics transfer entirely by declining analytics cookies.

10. How long it is kept

Account records held in your browser last until you delete the account or clear your browser data, whichever comes first. The Foundation has no copy of them and cannot restore them.

Once a retention period ends, records are deleted or anonymised. Winner records are the exception: the licence conditions require the Foundation to keep them, and the published entry on the Winners page stays up as the historical record of the draw.

11. Keeping it safe

The site is served over HTTPS with HTTP Strict Transport Security, and a content security policy restricts what the pages are permitted to load. Account passwords are never stored: what is kept is a one-way derivation produced with PBKDF2-SHA-256 over 210,000 iterations and a random salt unique to each account. The original password cannot be recovered from it, by the Foundation or by anyone else.

Forms carry spam controls that need no third-party script. Access to Foundation systems is limited to staff who need it. Suppliers are chosen partly on their security posture and are bound by contract.

No system is perfect. If a breach occurs that creates a real risk of significant harm, the Foundation will report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as PIPEDA requires.

12. Your rights

You may exercise any of the following. Write to privacy@win4carcer.ca and the Foundation will respond within thirty days.

• Access. Ask what personal information the Foundation holds about you, how it is used and who it has been disclosed to.
• Correction. Ask for anything inaccurate or incomplete to be fixed.
• Withdraw consent. Turn off reminders, decline cookies or ask the Foundation to stop a use you previously agreed to. Some consequences follow: withdrawing the age and residence confirmation, for example, means the account can no longer be held.
• Deletion. Delete your account from Privacy and data inside the account, or ask the Foundation to erase what it holds. Records the Foundation must keep under the licence conditions or tax law cannot be deleted before their period ends.
• Portability. Download everything held in your account as a single file, from the same screen.
• Complain. Raise a concern with the privacy officer first. If the answer does not satisfy you, take it to the Office of the Privacy Commissioner of Canada, or to the Information and Privacy Commissioner of Ontario for matters within provincial jurisdiction. Both accept complaints directly and neither charges a fee.

The Foundation may need to confirm who you are before acting on a request, which usually means replying from the address on the account.

13. Young people

The raffle is licensed for players aged 18 and over. The account area is closed to anyone younger: the date of birth is checked when the account is created, and a date under 18 is refused with nothing saved.

The Foundation does not knowingly collect personal information from anyone under 18. If you believe a young person has given information through this site, write to privacy@win4carcer.ca and it will be deleted.

Ticket buying is subject to the same limit under the Rules of Play: tickets may not be bought for, or in the name of, anyone under 18.

14. If you win

Rule 21 of the Rules of Play requires the winning ticket number, the winner's name and the winner's city of residence to be recorded and announced. Buying a ticket is agreement to that publication in the event the ticket wins. The Foundation publishes a first initial and surname rather than a full first name.

Nothing further is published. Your address, your email, your telephone number and the number of tickets you bought stay out of the public record. A winner who is asked for a photograph or a quotation may decline, and the prize is unaffected.

15. Changes to this policy

The Foundation updates this policy when what it does changes. The date at the top of the page shows when it last did. A change that materially affects how your information is used will be announced on the site before it takes effect, and where the change requires it, consent will be asked for again.

The Foundation keeps superseded versions and will send you the one that applied on a given date if you ask.

16. How to reach the privacy officer

Privacy officer, Ajax Pickering Hospital Foundation
privacy@win4carcer.ca
580 Harwood Avenue South, Ajax, ON L1S 2J4, Canada

General enquiries that are not about privacy go to support@win4carcer.ca.

Last updated 16 June 2026.