Waterloo Undergraduate Student Association Privacy Policy

Effective Date: August 12, 2026 

Last Updated: July 17, 2026 

Scope of This Policy

This Privacy Policy ("Policy") describes how the Federation of Students, University of Waterloo, operating as the Waterloo Undergraduate Student Association ("WUSA," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our digital properties. 

This Policy applies to wusa.ca and all of its current and future subdomains and sub-sites, including but not limited to: 

• wusa.ca (main site, online store, event ticket sales, digital products) 

• clubs.wusa.ca (club discovery, club management, and club administration platform) 

• member.wusa.ca (unified member platform, including the Clubs section, Member Deals, and any future Student Run Services or Societies sections)

This Policy automatically extends to any new WUSA-operated website, application, or platform that we launch in the future, unless we publish a separate policy specifically for that property. We will update this Policy as our platforms evolve rather than maintaining separate policies for each property. 

Who We Are

The Waterloo Undergraduate Student Association is a not-for-profit student organization representing undergraduate students at the University of Waterloo. 

Mailing address: 200 University Ave W, Waterloo, ON N2L 3G1, Canada 

WUSA's platforms operate independently of the University of Waterloo's central IT systems and data infrastructure, except where noted below (e.g., UW's Single Sign-On service). 

Personal Information We Collect

Account and Identity Information

When you sign in to clubs.wusa.ca or member.wusa.ca, we use University of Waterloo Single Sign-On (SSO). Through this process, we receive identity information from UW (such as your name, UW email address ) to authenticate you and create your WUSA account, which is linked to that same UW email address. We do not assign you a separate @wusa.ca email address or credential, and we do not receive your UW password, authentication is handled entirely by UW's SSO service.

Club, Society, and Membership Information

If you join, lead, or interact with a club, service, or (in future) society through our platforms, we collect information such as: 

• Membership and role information (member, executive, president, signing authority) 

• Club activity records (term acknowledgements, event forms, activity status) 

• Reimbursement/cheque request submissions, including receipt images and event details 

• Communications you send to club administrators or WUSA staff 

Order and Payment Information

When you make a purchase on wusa.ca (such as event tickets or digital products) or complete a membership-related payment, our payment processor Moneris collects your payment details (such as credit card number, billing name, and billing address) directly through an embedded, encrypted payment form.

WUSA does not receive, process, or store your full credit card number or other card data. We retain only the transaction record needed for order fulfillment, accounting, and support (e.g., order number, amount, date, and last four digits of your card, where provided by Moneris).

Device and Usage Information 

When you visit our sites, we and our service providers automatically collect certain technical information, including your IP address, browser type, device type, referring/exit pages, and how you interact with our pages ("Device Information"). We collect this using cookies, log files, and similar tracking technologies, described further in Section 5 (Cookies and Tracking Technologies). 

Content You Submit

This includes receipt images, event photos, club logos, marketing materials, forms, and other content you upload or submit to our platforms. 

How We Use Your Personal Information

We use personal information to: 

• Authenticate your account and provide access to club, member, and administrative features 

• Process orders, membership payments, and reimbursement/cheque requests 

• Communicate with you about your account, orders, club activity, or requests 

• Operate, maintain, and improve our platforms (including fraud and risk screening) 

• Generate aggregate analytics about how our sites are used 

• Meet our legal, regulatory, financial record-keeping, and accessibility obligations 

• Send service-related SMS messages where you have opted in (see Section 7) 

We do not use your personal information for behavioural advertising or sell your personal information to third parties. 

Cookies and Tracking Technologies

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.

Our sites use cookies, log files, and similar technologies to collect Device Information and to remember your preferences. 

We display a cookie consent banner on our sites that allows you to review and manage your cookie preferences before non-essential cookies are set. Essential cookies required for the site to function (such as login session cookies) are not subject to this preference control. 

We use the following analytics tools across our properties: 

• Google Analytics — to understand site usage and improve our services. Learn more or opt out at the Google Analytics opt-out page. 

• Microsoft Clarity — for session analytics and usability insights (such as heatmaps and session recordings) to help us improve site design. Fields containing sensitive input are configured to be masked from recording where applicable. How We Share Your Personal Information

How We Share Your Personal Information

We share personal information only as described below: 

• Moneris (payment processing) — to process your payment. Moneris' own privacy practices govern their handling of your payment data. 

• Google Analytics and Microsoft Clarity — for site analytics, as described in Section 5. 

• alttext.ai — an automated third-party service we use to generate descriptive alt text for images on wusa.ca to support accessibility (AODA) compliance. Images processed through this tool may include product, event, or club-related photos. 

• University of Waterloo — solely for Single Sign-On authentication. 

• AWS (Amazon Web Services) — we use AWS Simple Email Service (SES), hosted in the Canada (Central) region, solely to send and receive email. AWS does not host or store our application data or databases. 

• Legal and safety purposes — we may disclose personal information to comply with applicable law, respond to a valid legal request (such as a subpoena or court order), or protect the rights, property, or safety of WUSA, our members, or others. 

We do not share, sell, or disclose your personal information for any other party's independent marketing purposes. 

On-Premises AI Document Processing (Planned) 

WUSA may use an on-premises AI tool, hosted entirely on WUSA-controlled infrastructure, to help read and extract information from documents you submit through our platforms, for example, receipts, contracts, forms, PDFs, or other files uploaded in connection with reimbursement requests, club administration, or other WUSA processes. 

This capability is not yet active as of the date of this Policy. If and when we activate it, the following will apply: processing will happen entirely on WUSA-controlled servers in Canada, and submitted documents and any data extracted from them will not be transmitted to any external AI vendor or cloud AI service. A human reviewer will always review and approve any request informed by this processing, no decision affecting you will be made by automated means alone. We will update this Policy before this feature goes live.

SMS Communications

If you opt in to receive text messages from WUSA (the "WUSA SMS Service"), we use your mobile number solely to provide and support that service (e.g., work-related communications or system notifications). Message frequency varies based on your usage. 

We do not share, sell, or disclose mobile phone numbers, SMS opt-in data, or consent records with third parties, except with processors strictly necessary to transmit the messages on our behalf, and those processors may not use your data for any other purpose. 

You may opt out at any time by replying STOP to any message. You will receive a one-time confirmation and no further messages unless you reply START to opt back in. 

Where Your Information Is Stored

Our application servers and databases are hosted on-premises in Canada, on infrastructure located at the University of Waterloo (UW provides physical rack space and network connectivity only — UW does not have access to the data itself). The only exception is outbound/inbound email, which is processed through AWS SES in the Canada (Central) region. 

Your personal information is not transferred outside of Canada except where a third-party service provider we use (such as Moneris, Google, Microsoft, or alttext.ai) processes data as part of their own service, in accordance with their respective privacy policies.

Data Retention

• Financial and order records (including transaction records, cheque/reimbursement requests, and related supporting documents) are retained for a minimum of seven (7) years, in line with Canada Revenue Agency (CRA) record-keeping requirements. 

• Other account and profile information is retained for as long as your account is active, or until you request deletion, unless a longer retention period is required by law or necessary to resolve disputes or enforce our agreements.

Your Rights

Under Canadian privacy law (including the *Personal Information Protection and Electronic Documents Act* (PIPEDA) and, where applicable, Quebec's *Law 25*), you have the right to: 

• Request access to the personal information we hold about you 

• Request correction of inaccurate or incomplete personal information 

• Withdraw consent for certain uses of your personal information, subject to legal or contractual restrictions 

• Request deletion of your personal information, subject to our retention obligations above 

• Make a complaint about our handling of your personal information 

To exercise any of these rights, contact us using the information in Section 14. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, for Quebec residents, the *Commission d'accès à l'information*.

Accessibility

WUSA is committed to complying with the Accessibility for Ontarians with Disabilities Act (AODA) across our digital properties, including in how we present and collect information described in this Policy.

Children's Privacy

Our platforms are intended for use by University of Waterloo undergraduate students and are not directed at children. We do not knowingly collect personal information from children under the age of 13.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the updated Policy on this page with a revised "Last Updated" date. Your continued use of our sites after changes are posted constitutes acceptance of the revised Policy.

Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or would like to exercise any of the rights described above, please contact us at: 

Email: it@wusa.ca 

Mail: Waterloo Undergraduate Student Association, 200 University Ave W, Waterloo, ON N2L 3G1, Canada