TWU Pass Privacy Policy
TWU Pass was designed to simplify your use of the TWU website by allowing you to login once, with one username and password, to gain access to all of TWU's online services. At the same time, we are doing our best to keep your personal information secure, protecting you from online identity theft. This document outlines how we protect and share your information and also provides information on how you can do your part to protect your identity.
What is Identity Theft?
Identity theft is frauduelent use of personal information, such as a Student ID or a password. It has become such a problem on the Internet that several countries, including Canada and the United States, have set up resource websites to help protect the identities of their citizens.
For more information, see:
- Privacy Commissioner of Canada's website: http://www.privcom.gc.ca/
Under "Information for Individuals," you will find plenty of helpful material on how to protect your privacy. - U.S. Federal Trade Commission's website on Identity Theft: http://www.consumer.gov/idtheft/
Steps You Can Take
To protect your TWU Pass account information, always make sure that you are using the official TWU Pass website. You can check this by making sure that the address in your web browser starts with https://pass.twu.ca/ or http://www3.twu.ca/twupass/. If it does not, don't submit your username or password or it may go to a website that wants to steal your login information. If you have any questions or find a suspicious website, feel free to contact the TWU Pass administrator.
How We Collect and Use Information
When you sign up for a TWU Pass account, we collect your first and last name, your email address, and your birthdate to create an account for you to subsequently log in to TWU Pass. If you are part of the TWU community, we may ask for additional information in order to link your account with existing information in our databases. This allows us to offer more services appropriate for you.
Information Linked to Your Account
If you are not part of the TWU community, the only information linked to your account is:
- Your first name and last name
- Your email address
- Your birthdate (for identification and age verification)
- A "PersonID" that uniquely identifies you
For people inside the TWU community, more information may be linked via the "Person ID," which is also known as a Student ID, but applies to non-students as well.
Information Shared by TWU Pass
TWU Pass shares information in two ways. For TWU Websites, TWU Pass shares your name, email address, and PersonID with trusted TWU-based websites, allowing you to log in quickly and easily. For sites outside of TWU's control, TWU Pass can be used as an OpenID provider, but the only information that is passed along is your OpenID URL, which may contain your first and last name. (You have the option to share your name and email address when you log in to the external site, but that is left to your discretion.)
How We Protect Your Information
Storage Protection
For your protection, your password is stored in an encrypted form so that it cannot be retrieved even by the TWU Pass administrator. The rest of your information is stored in a protected database.
Login Failure Protection
If you (or someone impersonating you) type an incorrect username and password combination, this is recorded in our security logs. Multiple failures are automatically flagged and appropriate actions are taken, depending on the type of failure. If your account appears to be under attack, it will be locked for a set amount of time or until you contact the TWU Pass administrator.
Transmission Protection
Every time you log in and every time your personal information is sent between servers, it is encrpyted using SSL, the encryption standard for the Web. This means that hackers potentially scanning the networks will not be able to read any important TWU Pass data sent between computers.