Data Retention Policy

(For Donor Personal Information)

Effective Date: February 12, 2026

Summary

St. Mary’s Hospital Foundation collects and uses donor personal information to acknowledge donations, communicate with supporters, and steward donor relationships responsibly.

  • We keep donor information only as long as it is needed for these purposes or required by law;
  • Most donor records are kept for up to 10 years after the last donation or meaningful interaction;
  • Some records, such as pledges or planned gifts, may be kept longer while the commitment remains active;
  • When donor information is no longer needed, it is securely deleted or anonymized;
  • We do not sell donor information, and we respect donor consent and communication preferences.

This policy explains how long we keep donor information and how we ensure it is handled responsibly and securely.

1. Purpose

St. Mary’s Hospital Foundation (the “Foundation”) values the privacy of its supporters and donors and is committed to responsible stewardship of donor personal information. This Data Retention Policy establishes principles and retention periods governing how long donor personal information is retained and when it is securely destroyed. The policy is designed to ensure compliance with:

  • Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25 (formerly Bill 64) and applicable federal privacy principles;
  • Canada Revenue Agency (CRA) guidance applicable to registered charities;
  • Recognized best practices for Canadian non-profit organizations;

This policy applies only to donor-related personal information and does not govern financial or accounting records, (which is addressed separately by the Foundation’s Finance Department or amended to this document.)

2. Scope

This policy applies to all donor personal information collected, used, stored, or disclosed by the Foundation, regardless of format, including information held in:

  • Donor CRM systems;
  • Email marketing and donor communication platforms;
  • Newsletter subscription databases (where donor data overlaps);
  • Volunteer databases (where individuals are also donors);
  • Shared network drives and electronic files.

This policy does not apply to:

  • Patient medical records;
  • Purely financial or accounting records;
  • Anonymous donations where no personal information is retained.

3. Definitions

Personal Information: Any information relating to an identifiable individual, including but not limited to name, contact information, donation history, communication preferences, and consent records.

Donor: Any individual who has made a donation, pledge, or commitment to the Foundation, including one-time and recurring donors.

Inactive (Lapsed) Donor: A donor who has not made a donation or otherwise engaged with the Foundation for a minimum of 1 year.

Retention Period: The length of time personal information is retained before being destroyed or anonymized.

4. Guiding Principles

The Foundation’s approach to donor data retention reflects the same principles outlined in its Privacy Policy, including:

  1. Purpose Limitation – Personal information is collected and retained only for specific, identified purposes such as donor communication, stewardship, and compliance with legal and regulatory requirements.
  2. Consent – The Foundation relies on explicit, informed consent for the collection, use, and disclosure of donor personal information, subject to legal or contractual restrictions.
  3. Privacy by Design and Default – Retention practices are designed to limit the amount of personal information retained and the length of time it is kept to what is strictly necessary.
  4. Data Minimization – Donor personal information that is no longer required is destroyed or anonymized.
  5. Security Safeguards – Personal information is protected throughout its lifecycle through appropriate administrative, technical, and physical safeguards.

5. Consent and Individual Rights

The Foundation obtains explicit, informed consent for the collection, use, and disclosure of donor personal information. Consent may be provided orally, in writing, electronically, or through an opt-in mechanism, consistent with the Foundation’s Privacy Policy.

Donors may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal of consent does not automatically require deletion where retention is otherwise necessary to fulfill legal, regulatory, or documented stewardship purposes; however, such information will be suppressed from active use. Donors retain the rights outlined in the Privacy Policy, including rights of access, correction, deletion (where applicable), portability, and withdrawal of consent.

6. Donor Data Retention Periods

6.1 General Donor Records

Donor personal information (including identity, contact details, donation history, and communication records) will generally be retained for:

  • Up to 10 years from the date of the last donation or meaningful interaction

This period reflects the Foundation’s operational needs, donor relationship management practices, and applicable CRA guidance.

6.2 Lapsed Donors

  • Donors with no donation or meaningful interaction for 1 year may be classified as lapsed;
  • Lapsed donors may continue to be contacted for stewardship and fundraising purposes for up to 10 years of inactivity, subject to consent and communication preferences;
  • Donor personal information will not be retained beyond the 10-year maximum retention period from the date of the last donation or meaningful interaction, unless another retention category applies (e.g., pledges, planned giving) after which they will be destroyed or anonymized unless another retention category applies.

6.3 Pledges, Planned Giving, and Special Commitments

Donor records related to pledges, bequests, planned giving arrangements, or other long-term commitments may be retained:

  • For the duration of the agreement;
  • For an additional reasonable period thereafter to support stewardship, legal, and historical record-keeping requirements.

6.4 Consent and Suppression Records

  • Records documenting donor consent, withdrawal of consent, or communication preferences will be retained as long as necessary to demonstrate compliance and respect donor choices.

7. Storage Locations and Cross-Border Transfers

  • The Foundation primarily stores donor personal information in systems hosted in Canada;
  • Newsletter subscription data may be stored on platforms with servers outside Canada. Where donor data overlaps with these systems, the Foundation ensures appropriate contractual and security safeguards are in place.

8. Secure Destruction and Anonymization

When donor personal information reaches the end of its retention period:

  • Electronic records are securely deleted or anonymized using reasonable technical measures;
  • Paper records, where applicable, are securely destroyed;
  • Destruction is conducted in a manner that prevents reconstruction or re-identification.

This policy is principles-based and allows flexibility in destruction methods, provided outcomes meet security and privacy standards.

9. Roles and Responsibilities

Privacy Oversight

  • The Privacy Officer is responsible for oversight of this policy and its application to donor personal information;
  • For donor data, this role is held by Nathan Clinansmith, Director of Operations and Privacy Officer.

Execution

  • Day-to-day execution of retention and deletion activities is the responsibility of:
    • Aaron Garcia, Data and Digital Administrator, and;
    • Nathan Clinansmith, in coordination with relevant system owners.

10. Exceptions and Legal Holds

Where donor personal information is subject to:

  • A legal requirement;
  • An audit;
  • An investigation;
  • Anticipated or ongoing litigation.

Retention may be extended beyond the standard periods until the matter is resolved.

11. Policy Review and Updates

This policy will be reviewed periodically and updated as required to reflect:

  • Changes in legislation or regulatory guidance;
  • Changes in Foundation operations or systems;
  • Evolving best practices in donor privacy and data governance.

Material changes will be approved by Foundation leadership.

12. Transparency and Public Availability

This Data Retention Policy is available publicly and may be referenced in the Foundation’s Privacy Policy to promote transparency and donor trust.

13. Contact Information

For questions, concerns, or requests related to this Data Retention Policy or your personal information, please contact:

Nathan Clinansmith, CFRE
Director of Operations
St. Mary’s Hospital Foundation 
3830 Lacombe Ave. Suite 1510 Montréal, QC H3T 1M5 
fondation.stmary@ssss.gouv.qc.ca
514-734-2694