Summary of the CBDC Privacy Policy

The Community Business Development Corporations (CBDCs) of Atlantic Canada recognize the importance of privacy and the sensitivity of personal information. We have an obligation to keep confidential all information by which you can be identified. We are committed to protecting any personal information we hold. This Privacy Policy outlines how we manage your personal information and safeguard your privacy.

Your Privacy Rights

Since January 1, 2004, all businesses engaged in commercial activities must comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). The PIPEDA confirms your rights concerning the privacy of your personal information. The CBDCs are responsible for the personal information we collect, use and disclosure to others. To ensure our accountability, the CBDCs have developed this Policy, implemented document security measures and trained our directors and staff about our policies and practices. This Policy recognizes and is in compliance with the following ten Privacy Principles set out in PIPEDA:

1. ACCOUNTABILITY: An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.
2. IDENTIFYING PURPOSES: The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.
3. CONSENT: The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except when inappropriate.
4. LIMITING COLLECTION: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.
5. LIMITING USE, DISCLOSURE, AND RETENTION: Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by the law. Personal information shall be retained only as long as necessary for fulfilment of those purposes.
6. ACCURACY: Personal information shallbe as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
7. SAFEGUARDS: Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
8. OPENNESS: An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
9. INDIVIDUAL ACCESS: Upon request, an individual shall be informed of the existence, use and disclosure of his personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
10. CHALLENGING COMPLIANCE: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals for the organization’s compliance.

What Personal Information do we collect?

Personal information includes any information that identifies you, or by which your identity could be deduced. We need this information primarily in order to provide lending services to our clients.

Why CBDCs need Personal Information.

CBDCs provide services and products to a wide range of clients. In doing so, we may from time to time distribute materials concerning these services and new developments relevant to your business. Our primary purpose for collecting information is in order to assist you. Your personal information is used for purposes including, but not limited to, assistance in the preparation of business plans; business consultations; credit reviews; analysis of loan eligibility; direct payment/ withdrawal; preparation of legal documents; completion of quarterly reports; assessment and determinations as to net worth; determining eligibility for various funding programs and sources, etc.

Use of Your Information

We use your personal information to provide advice and services to you, and to include you in any direct marketing activities. If you no longer have a loan with us, and tell us that you no longer wish to receive information about our services or otherwise, we will remove you from our mailing list.

How do we collect your Personal Information?

We collect information only by lawful and fair means and not in an unreasonably intrusive way. Wherever possible, we collect your personal information directly from you, beginning with the application form and loan and continuing throughout the life of the loan if it is approved.

Sometimes, we obtain information about you from other sources which may include:

• your bank or credit union;
• your insurance company;
• your real estate agent in a property transaction;
• government agencies or registries;
• your employer;
• your lawyer;
• your accountant;
• credit reporting agencies (Trans-Union and Equifax)
• outside Consultants.

Consent

In most cases, we will ask you to provide written consent, to allow the CBDC to collect, use, or disclose your personal information. By signing an application for a loan, we recognize this as your consent to our collecting, using and disclosing the information referred to in the Application in order to process the loan assessment. Normally, we ask for your consent in writing, but in some circumstances, we may accept your oral consent. Your consent may also be implied through your conduct with us.

Disclosure of your Personal Information

The CBDC does not disclose your personal information to any third party to enable them to market their products and services without your written consent. We are required, however, to disclose information to certain government organizations including Atlantic Canada Opportunities Agency (ACOA) and other government organizations. In addition, the CBDC will disclose your personal information when:

• required or authorized by law to do so;
• you have consented to the disclosure;
• It is necessary in order to establish or collect sums owing to us;
• we engage a third party to provide administrative services to us (like computer back-up services or archival file storage);
• the information is already publicly known.

In addition, we will disclose your personal information to third parties in order to facilitate the granting of a loan. An example is a bank officer acting in connection with the loan and the security being taken to support it. In those instances, your consent will be implied by your signing the Loan Application and we will release the information unless you advise us otherwise in writing.

Retention of your Personal Information

The CBDCs receive funding from the Atlantic Canada Opportunities Agency (ACOA) and certain other government organizations. The terms of our agreements with those organizations require that we maintain the information that we collect for a period of not less than 7 years from the date that an application is rejected or the loan, if granted, is repaid.

Updating Your Information

Since we use your personal information to provide services to you, it is important that the information be accurate and up-to-date. If during the course of our dealings, any of your information changes, please inform us so that we can make any necessary changes. If the CBDC holds information about you and you demonstrate that it is not accurate, complete and up-to-date, the CBDC will take reasonable steps to correct any errors.

Is My Personal Information Secure?

The CBDCs take all reasonable precautions to ensure that your personal information is kept safe from loss, unauthorized access, modification or disclosure. Among the steps taken to protect your information are:

• premises security (locked doors and secure file cabinets);
• restricted access to personal information;
• deploying technological safeguards like security software and firewalls to prevent hacking or unauthorized computer access;
• internal password and security policies.

Access to Your Personal Information

You may request access to any personal information held in your file. Summary information is also available on request. We may seek to be reimbursed for copying
charges if you require copies of your personal information.

Can I be denied access to my Personal Information?

Your right to access your personal information is not absolute. We may be required to deny access when:

• denial of access is required or authorized by law;
• granting access would have an unreasonable impact on other people’s privacy;
• the information is protected by solicitor- client privilege;
• your personal information cannot be severed from another’s personal information.

If we deny your request for access to, or refuse a request to correct information, we shall explain why.

Credit Bureaus

To help us make credit decisions about clients, prevent fraud, and check the identity of new clients, we may, on occasion, request information about you from the files of consumer reporting agencies.

Communicating with Us

You should be aware that e-mail is not a 100% secure medium, and you must be aware of this when contacting us to send personal or confidential information.

Changes to this Privacy Policy

Since the CBDC regularly reviews all of its policies and procedures, we may change our Privacy Policy from time to time.

Your Privacy Practices

During the course of considering your application and any subsequent relationship between our CBDC and your business, you may provide us with personal information that is within your control. We rely on you to ensure that you have complied with the provisions of the Protection of Privacy and Electronic Documents Act and any other applicable legislation or requirements before releasing that information to us. By signing below, you are confirming that you have complied with these requirements and are authorized to provide us with the information we require.