Privacy Policy

Status: Adopted by the co-op. Last reviewed: 28 August 2026.

Fish Creek Water Co-op Ltd. ("the co-op", "we") collects and keeps personal information about members, applicants and people who ask to hear from us. This policy says what we collect, why, who sees it, and how you get at your own record. It applies to this website, to the members area, and to the paper and email records the board keeps.

We handle personal information under Alberta's Personal Information Protection Act (PIPA). Where a matter falls to federal law instead, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and our commercial electronic messages follow Canada's Anti-Spam Legislation (CASL).

1. What we collect

From a membership applicant: name, the name of any co-applicant, email address, telephone number, service address or legal land description, mailing address if it differs, and your relationship to the property (owner, tenant, prospective purchaser).

From a member, in addition: membership number, share and fee payment history, the e-transfer address you are reimbursed at if you have given one, your parcel's location for service planning, board terms served, meeting attendance, and how you voted only where the vote was recorded as a named vote.

From a newsletter subscriber: name and email address, plus the date, time and the exact wording of the consent you agreed to. We keep the wording itself rather than a tick box, so that changing the wording later cannot rewrite what you agreed to.

From anyone using the site: your browser sends an IP address and a user agent with every request. Our provider, Cloudflare, aggregates these into daily counts of visitors and page views. We read the counts. We do not build a profile of an individual visitor and we do not use advertising or cross-site tracking.

From a member signing in: a session cookie, the time of the sign in, and a record of failed sign in attempts. This is a security measure: it is how account lockout and abuse detection work.

2. Why we collect it

• To decide on a membership application and to keep the membership roll the Rural Utilities Regulation requires us to keep.
• To bill fees and levies, to reimburse expenses, and to keep the financial records an annual review or audit needs.
• To run general meetings: notice, quorum, eligibility to vote.
• To plan and build the water system: an engineer, the county and a funding body all need to know where the service points are.
• To tell you what is happening, by newsletter and by notice of meeting.
• To keep the members area secure and to know who changed what.

We do not sell personal information. We do not rent it, trade it, or hand it to anyone for their own marketing.

3. Who sees it

• The board and its officers, to the extent their role needs. Access inside the members area is granted by permission, not by seniority, and every sensitive action is written to an audit log.
• Foothills County and other approving authorities, where an application, easement or approval requires the parcels and owners to be identified.
• Engineers, hydrogeologists and contractors retained by the co-op, limited to the service locations and site contacts they need to do the work.
• Grant and funding bodies, in the aggregate, and individually only where a funding agreement requires it.
• Service providers who process data on our behalf. They act on our instructions and may not use your information for their own purposes:
  • Cloudflare, Inc. (United States): website hosting, database and file storage, form abuse protection (Turnstile) and aggregate traffic counts.
  • Zoho Corporation (servers in Canada; the company operates from India and the United States): the co-op's email, carrying invitations, receipts and notices to the address you gave us.
  • Cakemail Inc. (Canada): newsletter delivery. Only your email address and which mailing you receive are sent to Cakemail, never your name.
  • Google LLC (United States): search statistics about the public pages. Google tells us what people searched for, not who they are; no member information goes to Google.
• Anyone, where the law compels disclosure or where you have told us to.

Some of these providers store or process information outside Canada, as noted above. PIPA (s.13.1) requires us to say so and to name someone who can answer questions about it: that is the Privacy Officer, at the address in section 10. The co-op remains responsible for personal information in its providers' hands.

4. Consent

Applying for membership, subscribing to the newsletter and creating a members area account are all acts of consent for the purposes described above. You may withdraw consent at any time, in writing, subject to legal and contractual limits: we cannot forget the membership roll of a co-operative you belong to, and we cannot delete a financial record that an audit will need.

Every newsletter carries a one click unsubscribe. Unsubscribing removes you from the mailing list and nothing else: it does not affect your membership.

5. How long we keep it

• Membership and share records: as long as you are a member, and for seven years after membership ends.
• Financial records: six years from the end of the tax year they relate to, per the Canada Revenue Agency's requirement.
• Minutes, resolutions and the register of members: permanently. These are the co-op's corporate record.
• Applications that are refused or withdrawn: two years.
• Newsletter subscriptions: until you unsubscribe. An unsubscribed address is kept in a suppressed state so that a later import cannot mail you again.
• Sign in and security logs: twelve months.

6. Security

Passwords are never stored: only a salted, iterated hash of them. The site is served over HTTPS only. Access inside the members area is by permission, and sensitive actions are logged with who did them and when. Backups are encrypted and never contain credentials.

No system is perfect. If a breach creates a real risk of significant harm we will notify the affected people and the Office of the Information and Privacy Commissioner of Alberta, as PIPA requires.

7. Cookies

We set one cookie: the session cookie that keeps a signed in member signed in. It is removed when you sign out. Cloudflare Turnstile, which protects our forms from automated abuse, may set a short lived token of its own. We run no advertising, analytics or social media cookies.

8. Your rights

You may ask what personal information we hold about you, ask for a copy, and ask us to correct anything that is wrong. Write to the address below. We will answer within 45 days as PIPA requires, and we will tell you in advance if a fee applies (normally none will).

If you are not satisfied with our answer you may complain to the Office of the Information and Privacy Commissioner of Alberta.

9. Changes

We will update this policy as the co-op changes. The version you are reading is the current one, and its last review date is at the top of the page.

10. Contact

Privacy questions, access requests and complaints go to the co-op's Privacy Officer, care of:

Fish Creek Water Co-op Ltd. Northwest Foothills County, Alberta info@fishcreekwater.co

The board designates the Privacy Officer by resolution; until then the board answers collectively through the address above.