CASL and privacy for a club that emails parents

Quick answer

Marketing email to parents needs consent, a clear sender and a working unsubscribe link; invoices and class messages about something a family already bought generally do not. Consent is either express (they asked) or implied (they bought from you recently, or wrote to you recently), and implied consent runs out. Children’s medical and emergency details are personal information, so collect only what you need, show it only to the people who need it, and keep it safe.

This is general information written by a software company, not legal advice. Check your own situation against the legislation, the regulators’ published guidance, or a lawyer. Everything below about software describes what Gympillar is built to do, not a guarantee that your club is compliant.

On this page

• What CASL asks of a commercial email
• Express consent and implied consent
• What the email side of Gympillar does about it
• Text messages are stricter in practice
• Children’s information and PIPEDA
• Where to go from here
• Questions clubs ask

What CASL asks of a commercial email

Canada’s anti-spam law, usually shortened to CASL, covers commercial electronic messages: an email or text that encourages someone to take part in a commercial activity. A “spring term opens Monday, here is the timetable” newsletter qualifies. The published basics are three things, and a message needs all of them:

1. Consent from the person you are writing to, before you send.
2. Identification: who is sending it, a mailing address, and a way to reach you.
3. An unsubscribe mechanism that works, is easy to use, and is honoured promptly.

The consent half is where the real decisions sit, so that is most of this guide.

Express consent and implied consent

Express consent means the person actively asked. A parent ticks a box on your sign-up form and confirms the email you send back. A parent signs a paper sheet at the front desk that says they want your newsletter. Express consent does not expire, though the person can withdraw it at any time.

Implied consent is narrower and temporary. The two situations most clubs rely on are an existing business relationship and an enquiry:

• Someone bought from you, or was enrolled with you, within the last two years.
• Someone asked you a question about your classes within the last six months.

Those windows are the commonly published ones, and they are why a mailing list that is “everyone who ever filled in a form” is a problem: a family that registered a child three years ago and left may no longer be a safe address to send a promotion to. The practical habit is to write down, for each address, how you know them and the date.

Invoices and class messages are a different category

A message about something a family has already bought, such as an invoice, a cancelled class or a make-up credit, is generally not treated like a promotion. It still has to be accurate and identify the club, but it is not asking someone to consent to a newsletter.

What the email side of Gympillar does about it

Gympillar has an email marketing area for a club’s own list: contacts, templates, campaigns, automations and sign-up forms placed on your website. It is a newer part of the product, so ask in a demo whether it is switched on for your club and what the monthly sending allowance is on your plan. These are the parts that exist to keep consent honest:

• Every contact carries a basis. Express, existing relationship or enquiry is recorded per contact, with the date it counts from and, for imports, a note saying how you obtained it. Expiry for the implied bases runs from that date, never from the day you uploaded the list.
• Families join by sweep, with an expiry. A household’s address is added under the existing-relationship basis, and the clock runs from what the family bought, not merely from being on file. An expired contact is not sendable, and the screen says why.
• Sign-ups use double opt-in. A person who joins through a form is not subscribed until they press the button in the confirmation email. That upgrades them to express consent. The page cannot be worded to say “you’re subscribed” before that, and a stranger typing someone else’s address cannot subscribe them.
• The footer is required, not optional. Each campaign carries the club’s name, a postal address that you type in yourself (it is never filled in silently from your business address, which for many small clubs is somebody’s home), why the person is receiving it, and the unsubscribe link. A design cannot remove it.
• Unsubscribing is honoured and outlives the contact. The link works from the email even after a contact is deleted, and the opt-out is kept as a hash so a later import or sync cannot add the address back. Only the person can lift it. The unsubscribe page says invoices and class messages continue.

None of that decides your legal position. It means how you got an address, and when, is recorded rather than remembered. Imports work the same way: you state the date and how the permission was obtained, and permission already past its window is refused. The registration and sign-up tools are where most of those consents are first collected.

Text messages are stricter in practice

A phone number is not permission to text. In Gympillar, texting is off for every message until a club switches it on, and a household’s consent is recorded as a moment (the box on the registration form, or staff recording what a parent said) rather than a yes/no flag, because the date is the evidence. If a parent replies STOP, that is honoured across every club on the platform that holds the number, so they do not have to say it twice.

Children’s information and PIPEDA

PIPEDA is the federal privacy law for private-sector organizations, and several provinces have their own. Its published principles, in short, are: get meaningful consent, collect only what you need for a stated purpose, keep it safe, keep it only as long as you need it, and let people see and correct their own information. For a club, the sensitive material is a child’s date of birth, allergies, medical notes, emergency contacts and photographs.

Who sees what

Gympillar’s staff roles are owner, admin and coach. A coach sees the classes they teach and the children on those registers, not every child in the club, because a roster carries medical notes and emergency contacts and there is no reason a coach in one room needs another room’s. A manager can also be scoped to a single building. Owners and admins must use a second factor (an authenticator app) to sign in, and coaches are exempt.

Asking for less, earlier

A club that wants to speak to a family before offering a place does not have to collect a medical history first. The contact-first registration form asks who the child is and how to reach the parent, and the medical notes, emergency contacts and signed waivers are requested later, once a child actually has a place. A club should not hold health information about children who never enrolled.

Photos and papers

Permission to publish a child on your website and permission to send a coach’s photos to other families in the class are two separate answers, and a yes to one does not open the other. Family photos are stored privately and delivered through the family’s account, never by public link.

Access and erasure

Families see their own records, and correct their own phone number and address, from their account. When a family asks for its records to be removed, a club owner or admin can request that from the family record: the household is switched off straight away and the erasure runs after a thirty-day grace period, which can be reinstated before it runs. Your own privacy policy and terms are documents you edit in the website builder, and the platform ships a starter version of each for you to adapt, which you should have reviewed for your province.

Where to go from here

If you are still mailing parents from a spreadsheet, moving from spreadsheets covers what to carry across and what to leave behind. For how a family registers in the first place, see class registration and waitlists, and the full list of guides has the rest.