Good Roads/Ontario Good Roads Association is committed to protecting the privacy of the personal information of its members, employees, volunteers, and other stakeholders. This Privacy Policy documents our ongoing commitment to privacy and has been developed in compliance with applicable privacy legislation.
Website: Privacy Policy Update
Revised Cookie Banner/Pop-Up:
Good Roads uses cookies on GoodRoads.ca to improve your experience, understand how the website is used, and provide more relevant content and communications.
We use a simple opt‑in model for cookies:
Cookies used on our website fall into two categories:
You can change your cookie choice at any time by using the “Cookie Preferences” link in the footer of GoodRoads.ca, which will re‑display the cookie banner and allow you to accept or decline cookies again.
Privacy Policy
Last updated: August 14, 2026
Ontario Good Roads Association, operating as Good Roads, respects your privacy and is committed to protecting the personal information entrusted to us.
This Privacy Policy explains how Good Roads collects, uses, discloses, retains and safeguards personal information when you:
Good Roads handles personal information in accordance with the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA, where that legislation applies, and with other applicable privacy requirements.
Personal information is information about an identifiable individual. Depending on the circumstances, it may include a person’s:
Personal information generally does not include business contact information that is collected, used or disclosed solely for communicating with an individual in relation to their employment, business or professional responsibilities, where permitted by law.
Good Roads is responsible for personal information under its control. We have designated a Privacy Officer to oversee our privacy-management practices and respond to privacy questions, concerns and access requests.
Good Roads remains accountable for personal information transferred to service providers for processing on our behalf. We use contractual, administrative and other measures designed to require service providers to protect information and use it only for authorized purposes.
The information we collect depends on how you interact with us.
Information you provide
We may collect information when you:
Information collected automatically
When you use GoodRoads.ca, our systems and authorized service providers may automatically collect information such as:
Some of this information may constitute personal information when it identifies an individual or can reasonably be combined with other information to identify an individual.
Information received from others
We may receive personal information from municipalities, employers, event organizers, partners, service providers or other individuals when they register someone for a Good Roads service, identify an organizational contact or otherwise have authority to provide the information.
Good Roads may collect and use personal information to:
We limit collection to information that is reasonably necessary for the identified purposes.
Good Roads obtains consent for the collection, use and disclosure of personal information unless consent is not required or is otherwise permitted by law.
The appropriate form of consent will depend on the sensitivity of the information and the reasonable expectations of the individual. Consent may be express or implied, depending on the circumstances.
When we request consent, we will make reasonable efforts to explain:
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal may affect our ability to provide a requested service. We will explain the consequences of withdrawal when appropriate.
GoodRoads.ca uses cookies and similar technologies to help our website work effectively and to improve the experience for visitors.
Cookies are small files stored on your browser or device. Some cookies are required for the website to function properly, while others help us understand how the site is being used and how we can improve our content, services and communications.
Essential Cookies
Essential cookies help support core website functions such as security, navigation, accessibility, forms, account sessions and privacy preferences. Because these cookies are necessary for the website to operate, they cannot be turned off through our Cookie Preferences settings.
Analytics Cookies
With your consent, we may use analytics cookies to better understand how visitors use GoodRoads.ca. This may include information such as pages visited, referral sources, website interactions, browser or device information and general location information.
We use this information to identify trends, improve website performance and make our content and services more useful to visitors.
Marketing Cookies
With your consent, we may also use cookies to help us understand the effectiveness of promotional campaigns, links and communications.
These cookies may be provided by Good Roads or by third-party service providers we use to support our communications and marketing activities.
Third-Party Services
Some areas of GoodRoads.ca may include services or content provided by third parties, such as videos, maps, social-media features, event services or registration platforms.
These providers may use their own cookies or similar technologies and may collect information in accordance with their own privacy policies.
Where our website technology allows, optional cookies and third-party technologies will only be activated once you have provided consent.
Managing Your Cookie Preferences
You can accept, decline or manage optional cookies through the cookie banner or the Cookie Preferences link available in the website footer.
You can change your preferences at any time. You may also adjust your browser settings to block or delete cookies; however, doing so may affect how some parts of the website function.
Good Roads may send administrative communications that are necessary to provide a membership, registration, account, transaction or requested service.
We may also send newsletters, educational updates, event information and promotional communications where you have consented or where otherwise permitted by law.
You can unsubscribe from promotional electronic communications by using the unsubscribe link in the message or by contacting us. You may continue to receive transactional or service-related communications where necessary.
Payments may be processed by third-party payment-service providers. Good Roads may receive limited transaction information, such as the payer’s name, contact information, transaction amount, payment status and a payment reference number.
Good Roads does not store complete payment-card numbers. Payment providers handle payment information under their own terms and privacy practices.
Good Roads does not sell or rent personal information.
We may disclose personal information:
Service providers may include website hosts, cloud-service providers, registration platforms, learning-management systems, email-distribution services, analytics providers, payment processors, event-technology providers and professional advisers.
We require service providers to use personal information only for authorized purposes and to provide safeguards appropriate to the sensitivity of the information.
Good Roads and its service providers may process or store personal information outside Ontario or outside Canada, including in the United States.
When information is processed in another jurisdiction, it may be subject to the laws of that jurisdiction and may be accessible to courts, law-enforcement agencies, regulators or national-security authorities in accordance with applicable law.
Good Roads uses reasonable contractual, administrative and technical measures to protect personal information handled by service providers, regardless of where it is processed.
You may contact the Privacy Officer for additional information about Good Roads’ use of service providers outside Canada.
Good Roads may use mobile applications, online platforms or digital services to support conferences, courses and events.
Depending on the service and your selections, these platforms may process information such as:
Before using an event application or platform, participants should review the applicable notices and privacy settings. Information made visible through networking or participant-directory features may be seen by other authorized users.
Good Roads retains event-platform information only for as long as reasonably necessary for the identified purposes, subject to legal, operational and contractual requirements.
Good Roads may photograph, livestream, film or record activities at conferences, courses and other events for documentation, education, communications, archival and promotional purposes.
We will provide reasonable notice when photography or recording is expected. Where appropriate, we may use signage, registration notices, announcements, designated photography areas or individual consent forms.
Images or recordings may appear on Good Roads websites, social-media accounts, publications, presentations, advertisements or other communications.
Individuals who do not wish to be prominently photographed or recorded should notify Good Roads before or during the event. We will make reasonable efforts to accommodate the request, although we may not be able to prevent incidental inclusion in crowd or background images.
Separate express consent should be obtained for testimonials, featured interviews or uses involving sensitive circumstances.
Good Roads uses physical, administrative and technical safeguards appropriate to the sensitivity of the personal information in its custody or control.
Safeguards may include:
No system or method of electronic transmission is completely secure. Good Roads nevertheless takes reasonable measures to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, modification or disposal.
Good Roads maintains procedures for responding to suspected or confirmed privacy and security incidents.
Where a breach of security safeguards creates a real risk of significant harm, Good Roads will notify affected individuals and report the breach to the Office of the Privacy Commissioner of Canada as required by PIPEDA. Good Roads will keep a record of every breach of security safeguards, whether or not it is reportable, for at least 24 months, as required by law.
Good Roads retains personal information only for as long as reasonably necessary to:
Retention periods vary depending on the type of information and the reason it was collected.
When personal information is no longer required, we securely delete, destroy or anonymize it, subject to applicable legal and operational requirements.
Good Roads takes reasonable steps to ensure that personal information is accurate, complete and up to date when it is used to make a decision about an individual or disclosed to another organization.
You are encouraged to update your account information or contact us when your information changes.
You may request access to personal information Good Roads holds about you. You may also ask us to correct information that is inaccurate or incomplete.
To process a request, we may need to verify your identity. We will respond within the time required by applicable law.
Access may be limited or refused where permitted or required by law, including where the information:
When access is refused, we will explain the reason, subject to legal restrictions, and advise you of available complaint options.
GoodRoads.ca may contain links to websites, applications or social-media platforms operated by other organizations.
Good Roads is not responsible for the privacy, security or content practices of third-party services. You should review the privacy policy of a third-party service before providing information to it.
Information posted publicly on social media or other public forums may be viewed, collected and used by others.
You may contact the Good Roads Privacy Officer to:
Good Roads will investigate privacy complaints in a fair and timely manner and will take appropriate steps where a concern is found to be justified.
Privacy Officer
Ontario Good Roads Association
1525 Cornwall Road, Unit 22
Oakville, Ontario L6J 0B2
Canada
Email: Rachel@GoodRoads.ca
Telephone: 905-630-0542
You may also contact the Office of the Privacy Commissioner of Canada regarding a privacy concern.
Good Roads may update this Privacy Policy to reflect changes to our services, technology, practices or legal obligations.
The current version will be posted on GoodRoads.ca with its effective date. Where a change is significant, we may provide additional notice where required.
Continued use of a service after a policy update does not by itself constitute consent to a new collection, use or disclosure of personal information where additional consent is legally required.
Good Roads Privacy Breach and Crisis Communications Plan
Plan owner: Privacy Officer
Executive lead: Executive Director
Communications lead: Manager, Communications and Marketing
Review cycle: Annually and following any significant incident
This plan outlines how Good Roads will respond when personal information is lost, accessed, used, disclosed or altered without authorization.
The priorities are to:
A breach may include:
All suspected breaches must be reported immediately, even when the full circumstances are not yet known.
The following individuals should form the core Breach Response Team:
Privacy Officer
Executive Director
Information Technology Lead or Provider
Communications Lead
Legal Counsel
Good Roads may also involve Human Resources, Finance, Membership, Education, Events, insurers and relevant vendors.
Step 1: Report and activate
Anyone discovering a suspected breach must immediately contact:
Employees must not independently contact affected individuals, journalists or external parties unless authorized.
Step 2: Contain the breach
Immediate containment may include:
Containment should occur without destroying information that may be needed for the investigation.
Step 3: Establish the facts
The Breach Response Team should determine:
Unconfirmed information should be clearly identified as preliminary.
Good Roads should assess:
The Privacy Officer, with legal and technical advice, should document whether the breach creates a real risk of significant harm.
Under PIPEDA, the assessment must consider both the sensitivity of the information and the probability that it has been, is being or will be misused.
When a breach creates a real risk of significant harm, Good Roads should, as soon as feasible:
PIPEDA requires both regulatory reporting and affected-person notification when the real-risk-of-significant-harm threshold is met.
Legal counsel should also determine whether Good Roads has obligations to notify:
All communications should be:
Timely: Communicate once enough information is available to provide useful and accurate guidance.
Accurate: Use verified facts and clearly identify preliminary information.
Transparent: Explain what happened, what information was involved and what Good Roads is doing.
Empathetic: Recognize the concern and inconvenience experienced by affected people.
Consistent: Ensure employees, executives, Board members and vendors use the same approved information.
Accessible: Use plain language and provide accessible formats upon request.
Privacy-conscious: Do not reveal additional personal information through the response.
Good Roads should not speculate, minimize the incident or assign blame before the investigation is complete.
Level 1 — Limited incident
A small and contained incident involving low-sensitivity information.
Possible response:
Level 2 — Significant incident
An incident affecting multiple people or involving information that could result in phishing, embarrassment, financial harm or account compromise.
Possible response:
Level 3 — Crisis-level incident
A major cyberattack, ransomware event, widespread system compromise or breach involving highly sensitive information.
Possible response:
The response level may change as more information becomes available.
Depending on the incident, communications may be required for:
Affected individuals should generally hear directly from Good Roads before, or at the same time as, a broader public announcement.
Every breach communication should answer:
“Good Roads recently identified a privacy and security incident involving one of our systems or services. Upon discovering the incident, we took immediate steps to contain it and began an investigation with appropriate technical and privacy advisers.
Our priority is protecting the individuals who may be affected and determining the nature and scope of the incident. We will communicate directly with affected individuals and notify the appropriate authorities where required.
The investigation is ongoing. We will provide further information when confirmed. Questions may be directed to Rachel Swiednicki, at Rachel@GoodRoads.ca.”
This statement must be adapted to the circumstances and approved before release.
A notice to affected individuals should explain:
The notice should use direct language and avoid vague expressions such as “some information may have been affected.”
Employees should be instructed not to speculate or provide independent comments.
All media inquiries should be directed to the Communications Lead. The Executive Director or another designated spokesperson should provide public comments.
A standard employee response may be:
“Good Roads is actively reviewing the matter. To ensure you receive accurate and current information, please direct your inquiry to Rachel Swiednicki, Rachel@GoodRoads.ca.”
The Communications Lead should maintain:
Good Roads must create a record of every breach, including incidents that do not require notification.
The record should document:
PIPEDA regulations require breach records to be retained for 24 months after Good Roads determines that the breach occurred.
Following the incident, Good Roads should complete a formal review addressing:
Each corrective action should have an assigned owner and completion date.
Significant incidents should be reported to the Board, including the cause, impact, response, cost, lessons learned and corrective measures.
Before a breach occurs, Good Roads should maintain:
