Privacy Policy

Challengers Cricket Club · Effective 30 April 2026

🏛️Governance status — volunteer-based organization

Volunteer-based. Challengers Cricket Club is a Canada Not-for-Profit Corporation (#1746974-8) under the Canada Not-for-profit Corporations Act. All roles — Director, Officer, Captain, member, player, volunteer, contributor — are volunteer roles. The Corporation does not employ any individual, has not registered as an employer with the Canada Revenue Agency, has never operated a payroll, and has never issued a T4. No wage, salary, fee, or honorarium is paid to anyone for service to the Club.
Voting governs appointments and removals. Officers (President, Vice-President, Secretary, Treasurer) are appointed by Ordinary Resolution of the Board of Directors and may be removed by the same process, with documented good-faith grounds and notice to the officer. Directors themselves can be removed only by Ordinary Resolution of the members at a duly-called special meeting. The Board cannot remove a Director by board vote alone. See By-Laws Article IV.
Informal appointments become formal only after signing. Any individual who has been informally referred to as an officer of the Club becomes a formally appointed officer only upon their e-signed acceptance of the Officer Appointment Letter and the Volunteer Agreement via the Club's Officer Hub. An informal designation that has not been accepted by signing is not a binding officer appointment under CNCA. The published deadline for signing is 30 May 2026; informal designations not accepted by that date lapse and the position is deemed vacant.
Replacement is “in progress” — never automatic. When an officer position becomes vacant (through non-acceptance, removal, or resignation), the Board determines whether and when to appoint a replacement. Replacement appointments are not automatic and may take time to identify a suitable candidate. The Board may leave a position vacant or designate it as “in progress” for as long as is in the best interests of the Corporation. The duties of a vacant officer position may, in the interim, be performed by the remaining officers or by the Board collectively.
Protection against bad-faith motions. No motion to remove a Director or officer, and no motion to recuse a Director from voting, may be entertained without documented good-faith grounds. Mere accusation, threat, or unsupported allegation does not trigger recusal or removal. A pattern of bad-faith motions or knowingly false claims may itself constitute grounds for the originator's removal or expulsion under By-Laws Articles 3.6 and 4.9.

Who we are

Challengers Cricket Club (“the Club,” “we,” “us”) is a Canada Not-for-Profit Corporation (Corporation #1746974-8, incorporated under the Canada Not-for-profit Corporations Act on 12 November 2025), based in London, Ontario, Canada. We operate a cricket club for newcomer Canadians and the wider London community on a strictly volunteer basis. This Privacy Policy explains how we handle personal information.

We are committed to compliance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

We collect only the personal information needed to operate the Club. Specifically:

Member information: name, email address, phone number, emergency contact, date of birth (for age-eligibility), photograph (if voluntarily provided), playing role and stats.
Match data: ball-by-ball scoring, batting/bowling statistics, availability for matches, squad selections (collected through the C3H portal).
Sponsor and donor contact details: name, organization, email, phone (for sponsor relationship management).
Payments: processed through Stripe, Zeffy, or Interac e-Transfer. We do not store credit card numbers or banking details. Payment processors handle that.
Photos and videos: taken during Club activities for blogs, social media, and livestreams (with consent — see the Volunteer Agreement).
Website analytics: standard server logs (IP, page views, referrer). We do not currently use behavioural advertising trackers.

Why we collect it

To organize matches, training, and squad selection
To communicate with members about the Club
To process payments for registration, fees, and sponsorships
To produce season recaps, blog posts, livestreams, and social media content
To report aggregate impact metrics to sponsors and grant funders
To comply with regulatory requirements (e.g. CRA, federal Corporations Canada filings, Ontario extra-provincial filings)
To respond to inquiries from the public, sponsors, and partners

Where it's stored

Firebase / Google Cloud: match data, player availability, squad rosters, training reflections, and the C3H portal data. Servers in Canada or US (Google Cloud regions). Access controlled by Google authentication and Firestore security rules.
Google Workspace: emails, documents, spreadsheets containing member or sponsor information.
Stripe / Zeffy: payment processing data. Payment processors are independent controllers of cardholder data — see their respective privacy policies.
Vercel: hosts the public website (including this page). Receives standard server-side request logs.
Local files: some board members may store backup copies of records on their personal devices, encrypted where reasonable.

Some of these vendors store data outside Canada (most notably the United States). We accept this trade-off to use industry-standard nonprofit-grade tools at zero cost. By providing your information, you consent to it being processed in those jurisdictions.

Who operates this platform

The Club's public website at challengerscc.caand the C3H members' portal are operated on behalf of the Club by Mohammed Saad, who authored the software personally. The infrastructure is split across three layers, each with a clearly defined owner:

Source code — GitHub. The repository containing all source code is in Mohammed Saad's personal GitHub account. The source code is his personal copyright under the federal Copyright Act §13(1).
Production hosting — Vercel. The Vercel project that builds and serves the production website is registered to the Club at challengerscricketclub2026@gmail.com. The Club controls deployment access, environment variables, and domain configuration in Vercel. The Vercel project pulls source from Mohammed Saad's GitHub repository to deploy; if access to that repository is revoked, Vercel can no longer redeploy. Existing deployments at the time of revocation continue to serve until they are next rebuilt.
Member data — Firebase / Google Cloud. The Firebase / Google Cloud project storing all member data (project ID challengers-c3h) is registered to the Club at contact@challengerscc.ca, which holds the Owner role in the Google Cloud Console.

Net effect: the Club controls two of the three infrastructure layers (Vercel hosting + Firebase data); Mohammed Saad personally controls the third (the source code on GitHub). Full details are set out in the Software & IP Ownership Acknowledgement.

For PIPEDA purposes:

Challengers Cricket Club is the data controller — we decide what personal information is collected, why, and how long it is retained. The Firebase / Firestore project that stores it is registered to and administered by the Club.
Mohammed Saad is the data processor — he operates the platform on the Club's instructions and may not use member data for any other purpose. He does not own the data, the Firebase project, or any administrative claim on personal information stored there. His access is operational only and may be revoked at any time by board resolution.
Mohammed Saad is contractually prohibited from using Club member data to train artificial intelligence models, demonstrate to other clubs, or build commercial products. Member data may not be re-used in any future commercial offering — by him or by any corporation he owns — without each member's explicit consent and a separate Data Processing Agreement.
Sub-processors used to deliver the platform (each subject to their own privacy practices): Vercel (production hosting; account registered to the Club at challengerscricketclub2026@gmail.com; serves the deployed front-end and proxies API requests; does not hold member data — that lives in Firebase), Google Cloud / Firebase (Club-owned project administered through contact@challengerscc.ca; database, authentication, file storage), Stripe (payments), Zeffy (donations, when active), YouTube (video hosting).

A formal Software Licence Agreement (which includes data processing terms) between the Club and Mohammed Saad is being executed and will be e-signed by the directors via the C3H Pavilion governance module. Until then, this Privacy Policy and the IP Ownership Acknowledgement constitute the public record of the arrangement.

Conflict of interest disclosure

Mohammed Saad is both a co-founding director of Challengers Cricket Club and the personal author and copyright owner of the platform that operates the Club's website and members' portal, and acts as the data processor on the Club's instructions. This is a related-party arrangement and a conflict of interest under the Club's Conflict of Interest Policy.

The conflict has been declared in writing to the Board. Mohammed Saad has abstained, and will continue to abstain, from any board vote concerning: (a) the Club's licence to use the platform; (b) the Software Licence Agreement; (c) variations or amendments to the data processing relationship; (d) any board resolution affecting the IP Ownership Acknowledgement; or (e) the IP and data clauses of the By-Laws (Articles XIV and XV).

The Corporation's ownership of all member data is constitutionally entrenched in By-Laws Article XV (“Member Data and Club-Owned Cloud Infrastructure”). That Article makes explicit that the Firebase / Google Cloud project storing all personal information is registered to and administered by the Club through the contact@challengerscc.ca Google Workspace account, and that no Director, Officer, member, or developer holds any administrative claim on personal information stored there.

Interim Privacy Officer. Mohammed Saad is the Privacy Officer named below as an interim arrangement until the Secretary role is formally accepted via signed Officer Appointment Letter. Once a Secretary is in place, Privacy Officer responsibilities will transfer accordingly. This arrangement, including any conflict of interest implications, is disclosed for transparency.

Who we share it with

We do not sell or rent personal information. We share it only as follows:

With the Club's board, captains, and authorized volunteers — for operational purposes only.
With payment processors (Stripe, Zeffy, Interac) — when you pay for something.
With league administrators (e.g. CricClubs, Cricket Ontario) — when required to register a player or team.
With sponsors and grant funders — only in aggregate form (e.g. “the Club has 70 active members”), not individual data, except where you have explicitly consented.
With law enforcement or regulators — when legally required (e.g. court order, CRA audit).

How long we keep it

Active member data: for the duration of membership plus 3 years (for historical record and dispute resolution).
Match data and statistics: retained indefinitely as part of the Club's historical record.
Financial records: 7 years (per Canadian tax record-keeping rules).
Photos and videos: retained indefinitely for the Club's archive, unless removal is requested.
Server logs: 90 days.

After retention periods elapse, we delete or anonymize personal information.

Your rights

Under PIPEDA you have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Withdraw consent for the use of your information (subject to legal or contractual restrictions).
Request deletion of your personal information (where retention is not legally required).
Be removed from photos/videos we have published, where reasonably possible.
File a complaint with the Office of the Privacy Commissioner of Canada if you believe we've mishandled your information.

To exercise any of these rights, email contact@challengerscc.ca. We will respond within 30 days.

Security

We use industry-standard practices to protect personal information: Google authentication for Club portals, Firestore access rules, HTTPS everywhere, password-protected admin accounts, and 2-factor authentication where supported. No system is perfectly secure — we cannot guarantee absolute protection, but we will notify affected individuals if we become aware of a material data breach.

Cookies and analytics

The website uses minimal cookies (mainly for sign-in session management on the C3H portal). We do not use third-party advertising trackers. Server-side logs collect aggregate visit data (page views, referrer, country) for security and operational purposes.

Children's privacy

The Club is currently for adult players (18+). If we ever offer programs for minors, additional consent procedures will apply, and parental consent will be required for any data collection from those under 13.

Changes to this Policy

We may update this Privacy Policy from time to time. The current version is always posted at challengerscc.ca/legal/privacy. Material changes will be communicated to members by email.

Contact

Privacy questions, requests, or complaints:

Mohammed Saad — Privacy Officer
Challengers Cricket Club
contact@challengerscc.ca

Document version: v1.1 · Effective 8 May 2026 · Pending pro-bono lawyer review.
v1.1 (2026-05-08) — adds explicit Conflict of Interest disclosure section (Mohammed Saad as Director + author + data processor); cross-references By-Laws Articles XIV (Software/IP) and XV (Member Data and Club-Owned Cloud Infrastructure); discloses interim Privacy Officer arrangement pending formal Secretary onboarding; aligns with the federally-incorporated CNCA framework.
v1.0 (2026-04-30) — initial Privacy Policy adopted by the Board.