Privacy policy

1. Who we are

The Business & IT Student Society (BITSoc) represents students in Ontario Tech University's Faculty of Business and Information Technology and operates under the Ontario Tech Student Union (OTSU). This policy applies across the BITSoc website, membership registration and portal, forms, events, partnerships, communications, and related services.

BITSoc is responsible for personal information under its control.

Contact hello@otubitsoc.com with privacy questions, requests, or complaints.

2. Information we collect

Depending on how you interact with BITSoc, we may collect your name, contact details, messages and form responses, event or partnership information, communication preferences, Ontario Tech email address, Student ID, year and area of study, selected associations and interests, and an optional LinkedIn URL. We also keep verification, consent, session, security, and important membership-change records, plus limited request information used to secure the service and prevent abuse.

We do not ask for your Ontario Tech password. Sign-in codes are stored only as keyed hashes and expire after a short period. Session tokens are also stored as hashes rather than in their reusable form.

3. How we use information

We use information to verify eligibility and email control, prevent duplicate records, administer membership, support selected associations, plan programs, operate and secure the portal, answer support requests, and produce statistics that do not identify individual members.

Service messages include a welcome email with a verification code after onboarding, requested sign-in or verification codes, and one verification reminder after 24 hours if an account remains unverified. No second automatic reminder is sent; you can request another code yourself. Optional news and association communications follow your choices. We will not use information for a materially different purpose without notice and consent where required. BITSoc does not sell or rent member information.

4. Consent and communications

Registration requires acknowledgement of membership processing, this privacy policy, and enrolment in BITSoc and selected-community communications. Communications choices are not preselected. You may opt out of news and association communications at any time through the portal or an applicable unsubscribe method without losing your membership.

You may withdraw consent for optional uses at any time. Limited information may still be retained for security, legal, financial, or recordkeeping purposes. If withdrawing required processing means BITSoc can no longer administer your membership, we will explain that first.

5. Sharing and service providers

We limit disclosure to authorized BITSoc or OTSU personnel who need it; selected associations where needed to support your choices; providers operating hosting, database, email, networking, backup, or security functions for BITSoc; and authorities or other parties where legally required or needed to protect rights and safety.

Current infrastructure includes a BITSoc-controlled, self-hosted application and PostgreSQL database, hosting and network providers, and MailerSend. Providers may process limited information in other jurisdictions, where it may be subject to local law.

6. Cookies

The portal uses a strictly necessary secure session cookie to keep you signed in. It is not used for advertising. Short-lived security data may prevent repeated or automated attempts. If non-essential analytics or tracking is introduced, this policy and applicable consent controls will be updated first.

7. Security

BITSoc uses safeguards appropriate to the sensitivity of the information, including restricted access, encrypted transport, application-level Student ID encryption, hashed authentication secrets, private database networking, audit records, backups, and security testing. No system can guarantee absolute security. Contact us promptly if you believe your information has been compromised.

8. Retention and deletion

We keep identifiable information only as long as reasonably needed to administer membership, meet approved recordkeeping needs, resolve disputes, preserve security and audit history, and meet legal obligations. Sign-in challenges expire after 10 minutes and sessions expire after 10 minutes of inactivity, with an absolute maximum of 30 days unless revoked sooner. You may save an unverified registration before confirming your email. Verification revokes earlier unverified sessions, and unverified accounts are not treated as verified members.

Membership and consent history may remain beyond one academic year. Records no longer required are securely deleted or de-identified, while backup copies age out through the applicable rotation.

9. Access, correction, and complaints

You can review routine profile information and communication choices in the portal. You may ask BITSoc to confirm whether it holds your information, explain its use or disclosure, provide access, correct an error, or consider deletion.

Email hello@otubitsoc.com from your Ontario Tech address when possible. We may verify your identity and will explain any permitted or required limitation. Complaints will be reviewed with appropriate BITSoc and OTSU leadership.

10. Incidents and policy changes

BITSoc will assess suspected privacy or security incidents, take reasonable containment and remediation steps, and provide notices or reports where required.

We may update this policy when the service or legal requirements change. Material changes will be highlighted, and renewed consent will be requested when required.