Privacy Policy

Last updated: August 17, 2026

1. Introduction

Evidence in Governance and Politics (“EGAP,” “we,” “us,” or “our”) operates the website located at egap.org (the “Site”) on behalf of the Governing Council of the University of Toronto, located at Sidney Smith Hall, Room 594, University of Toronto, 100 St. George Street, Toronto, ON, Canada, M5S 3G3. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit the Site, subscribe to our newsletter, submit a contact form, register as a member, or otherwise interact with us.

This Privacy Policy is intended to comply with the Freedom of Information and Protection of Privacy Act (FIPPA) and, where applicable, Canada’s Anti-Spam Legislation (CASL). If EGAP collects personal information from individuals located outside Canada (e.g., members and researchers around the world), we also aim to handle that information consistently with the general principles described below, and additional local disclosures may be added by counsel as needed.

Users in the European Economic Area (EEA) and United Kingdom (UK): For individuals located in the EEA or the UK, the processing of your personal data is also governed by the General Data Protection Regulation (GDPR) and the UK GDPR. For the purposes of these regulations, the Governing Council of the University of Toronto acts as the Data Controller.

2. Scope of This Policy

This Policy applies to personal information collected through the Site, including:

The public website and its subpages (About, Our Work, Members, Resources, Policy Briefs, Contact, etc.);
The newsletter sign-up form (name and email address, currently processed through Mailchimp);
The Contact page and any general inquiry emails sent to admin@egap.org;
Applications or submissions related to membership, research grants, learning days, current openings, or the community experts roster; and
Cookies and similar tracking technologies used on the Site, managed through our CookieYes consent management platform.

This Policy does not apply to third-party websites linked from the Site, or to information collected offline or through in-person EGAP meetings, which may be governed by separate notices.

3. Information We Collect

3.1 INFORMATION YOU PROVIDE TO US

Contact and subscription details: full name and email address when you subscribe to the EGAP newsletter or submit the Contact form.
Correspondence: any information you include when you email us directly, such as at admin@egap.org.
Membership and applications: information submitted in connection with becoming an EGAP member, applying for research grants, current openings, learning days, or the community experts roster, which may include your name, institutional affiliation, CV/resume, research interests, and similar professional details.
Feedback and session sign-ups: information submitted through Google Forms when you register for, or provide feedback on, EGAP learning days or feedback sessions.

3.2 INFORMATION COLLECTED AUTOMATICALLY

When you visit the Site, certain information may be collected automatically through cookies, log files, and similar technologies, including:

IP address, browser type and version, device type, and operating system;
Referring/exit pages, pages visited, and the date and time of your visit;
Approximate geographic location derived from your IP address; and
Google Analytics identifiers (cookies and similar identifiers used by Google Analytics).

3.3 COOKIES AND SIMILAR TECHNOLOGIES

The Site uses cookies and similar technologies, managed through the CookieYes consent management platform, to operate the Site and, where you consent, to measure performance and improve your experience. Cookies are generally grouped into the following categories, and you can review and change your preferences at any time using the cookie preference banner or the [“Cookie Settings” link in the footer]:

Necessary cookies — required for the Site to function and cannot be switched off (e.g., remembering your cookie consent choices).
Functional cookies — enable enhanced functionality, such as remembering display preferences.
Analytics/performance cookies — help us understand how visitors use the Site so we can improve it. We currently use Google Analytics for this purpose.

For a full, current list of cookies used on the Site, categorized automatically by our cookie scanner, please see our separate Cookie Policy at https://egap.org/cookie-policy/.

4. How We Use Your Information

We use personal information for the following purposes:

To operate, maintain, and improve the Site and its content;
To send the EGAP quarterly e-newsletter and other communications you have subscribed to or requested;
To respond to inquiries submitted through the Contact page or by email;
To process and evaluate applications for membership, research grants, current openings, learning days, or the community experts roster;
To maintain the security and integrity of the Site and prevent misuse; and
To comply with legal obligations and enforce our Terms & Conditions.

We do not sell, rent, or trade personal information to third parties for their own marketing purposes.

5.1 Our Legal Authority for Collecting, Using, and Disclosing Your Information (FIPPA)

As a department of the University of Toronto, EGAP collects, uses, and discloses personal information in accordance with Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA), R.S.O. 1990, c. F.31 — not the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which does not apply to Ontario universities. Under FIPPA:

Collection: personal information is collected only where expressly authorized by statute, used for the purposes of law enforcement, or necessary to the proper administration of a lawfully authorized activity of the University (FIPPA, s. 38(2));
Use: personal information is used only for the purpose for which it was obtained or compiled, or for a consistent purpose (FIPPA, s. 41); and
Disclosure: personal information is disclosed only in the circumstances permitted under FIPPA (s. 42), which include with your consent or as otherwise required or permitted by law.

If you have questions about how your personal information is collected, used, or disclosed, please contact us using the details in Section 15 below.

5.2 Legal Basis for Processing under GDPR (For EEA/UK Individuals)

If you are located in the EEA or UK, we rely on the following lawful bases under the GDPR to process your personal data:

Consent: When you explicitly opt-in to receive our quarterly e-newsletter or agree to non-essential tracking cookies. You can withdraw your consent at any time.
Performance of a Contract: When processing is necessary to manage your EGAP membership, evaluate your grant applications, process registrations for learning days, or review applications for current openings.
Legitimate Interests: When processing is necessary for our legitimate academic and operational interests, provided they do not override your fundamental rights. This includes maintaining the security and integrity of the Site, responding to general emails sent to admin@egap.org.
Legal Obligation: When we must comply with legal or regulatory requirements.

6. How We Disclose Your Information

We disclose personal information only as described in this Policy or as otherwise required by law. This may include disclosure to:

Service providers, such as our email/newsletter platform (currently Mailchimp), website hosting provider, translation plugin provider (WPML), and any analytics or cookie-consent providers (currently CookieYes), who process personal information on our behalf under appropriate confidentiality and data-protection commitments;
Affiliated researchers and institutions, where necessary to administer membership, grants, or collaborative research activities, and only to the extent needed for that purpose;
Legal and regulatory authorities, where required to comply with a legal obligation, protect our rights, or respond to a valid legal request; and
A successor organization, in the event of a reorganization, merger, or transfer of EGAP’s operations, subject to equivalent privacy protections.

Our podcast hosting provider (currently BuzzSprout, for the Governance Loop Podcast) and our forms provider (currently Google Forms, used for learning day and feedback session sign-ups) also process limited personal information on our behalf under similar confidentiality and data-protection commitments.

7. Cross-Border Data Transfers

Some of our service providers (for example, Mailchimp and certain hosting or analytics providers) may store or process personal information on servers located outside Canada, including in the United States. When personal information is transferred outside Canada, it may be accessible to courts, law enforcement, and national security authorities of that jurisdiction under their applicable laws. By using the Site and providing your personal information, you acknowledge this possibility. We take reasonable steps to require our service providers to protect personal information to a standard consistent with FIPPA, including through contractual safeguards.

8. Data Retention

We retain personal information only as long as reasonably necessary to fulfil the purposes described in this Policy, including to satisfy any legal, accounting, or reporting requirements. For example, newsletter subscriber information is retained until you unsubscribe; membership and application records are retained for the duration of the relationship plus seven (7) years. When personal information is no longer needed, we will securely delete, destroy, or anonymize it.

9. How We Protect Your Information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, appropriate to the sensitivity of the information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

Subject to certain exceptions and limitations under FIPPA, you have the right to:

Request access to the personal information we hold about you;
Request correction of inaccurate or incomplete personal information;
Opt out of non-essential communications, such as by unsubscribing from our newsletter; and
Ask questions about our privacy practices or file a complaint (see Section 16 below).

To exercise these rights, please contact us using the details in Section 15. We may need to verify your identity before responding and may take a reasonable time to respond as permitted by law.

If you are located in the EEA or the UK, you also have the following additional rights under the GDPR:

Right to Erasure (“Right to be Forgotten”): The right to request that we permanently delete your personal data when it is no longer needed for the purposes it was collected.
Right to Restrict Processing: The right to ask us to temporarily suspend processing your data (for example, if you believe the data is inaccurate, while we verify it).
Right to Data Portability: The right to request a digital copy of the personal data you provided to us in a structured, commonly used format.

11. Children’s Privacy

The Site is intended for a general professional and academic audience and is not directed at children. We do not knowingly collect personal information from children under the age of 13 (or the applicable age of majority/consent in the relevant jurisdiction). If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. Third-Party Links

The Site contains links to third-party websites and resources (for example, member institutions, the EGAP GitHub-hosted coursebook, social media platforms, and external policy briefs). This Policy does not apply to those third-party sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

13. Social Media

EGAP maintains public profiles on platforms such as Bluesky, X (formerly Twitter), and LinkedIn. Any interaction you have with EGAP through these platforms is also governed by that platform’s own privacy policy and terms of use, in addition to this Policy where applicable.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised Policy on this page with an updated “Last Updated” date. We encourage you to review this Policy periodically.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact:

University of Toronto Privacy Office — privacy@utoronto.ca
EGAP — Evidence in Governance and Politics
Sidney Smith Hall, Room 594, University of Toronto, 100 St. George Street, Toronto, ON, Canada, M5S 3G3
Email: admin@egap.org

16. How to File a Complaint

As the University of Toronto is a public institution subject to FIPPA, if you are not satisfied with our response, you have the right to file a complaint with the Information and Privacy Commissioner of Ontario (IPC):

Website: ipc.on.ca
Address: 2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
Toronto area: 416-326-3333
Toll-free: 1-800-387-0073

For EEA/UK Individuals: You also have the right to lodge a complaint with your local Data Protection Authority (DPA) in the European country where you reside, work, or where the alleged infringement occurred. (UK residents may complain directly to the Information Commissioner’s Office at ico.org.uk).