INTRODUCTION
Express Canada (“EXBC”) is committed to keeping personal information accurate, confidential, secure and private. The Express Canada Privacy Code is an embodiment of this commitment.
This Privacy Code is based on the Personal Information Protection and Electronic Documents Act (PIPEDA). It describes how Express Canada subscribes to the principles of the PIPEDA. A copy of the PIPEDA is available at privcom.gc.ca
The Scope Of This Privacy Code
This Privacy Code describe how Express Canada protect personal information in its possession or control. This Privacy Code does not apply to information about business customers who carry on business as corporations, partnerships or in other forms of association. Express Canada does, however, protect the confidentiality of such information in accordance with the law and Express Canada’s own policies. This Privacy Code does apply to personal information of individual owners of sole proprietorships.
Changes To This Privacy Code
In order to ensure that this Privacy Code is kept up to date, we reserve the right to change this Privacy Code from time to time. Any changes will be communicated to you at least 30 days before they take effect. Notice of changes to the Privacy Code may be distributed by email, through Express Canada statements, letters and/or posted on the Express Canada web site, through your online Inbox or any other electronic method used by Express Canada to communicate with you. If you access or choose to continue to be serviced by Express Canada after the effective date of the change, you automatically accept the change.
DEFINITION OF TERMS USED IN THIS PRIVACY CODE
Associates
The client services representatives at Express Canada to whom the public is encouraged to address their initial questions and concerns about a Express Canada product or service. Associates may be reached by email at clientservices@Exbc.ca.
Direct Marketing
Promotions targeted to individuals whose personal information indicates that a certain product may be of interest to them. This includes mail, email and telemarketing initiatives, communications through our Mobile app and other electronic methods provided by us. This does not include statements, statement inserts, and messages in on invoices or receipts, and announcements in electronic bulletin boards, through customer relationship management.
Independent Broker
The individual and/or company through which you have been referred to Express Canada under a referral arrangement between such Independent Broker and Express Canada. The Independent Broker is not an agent, employee, partner or joint venture of Express Canada.
EXPRESS CANADA
“EXBC” is the operating name of Express Canada.
Personal Information
Information about an identifiable individual, but does not include the name, title or business address or business telephone number of an employee of an organization for the purpose of communicating with the individual in relation to their work.
Privacy Office
The department at Express Canada that is responsible for ensuring the protection of individuals’ personal information. The Privacy Office may be contacted by mail at:
PRIVACY OFFICE
Express Canada
10 George St. North, Brampton, ON L6X 1R2
theprivacyofficer@exbc.ca
SUMMARY OF PRIVACY CODE
1. Express Canada’s Accountability
Express Canada is accountable for all personal information in its possession or control, including any personal information transferred to third parties for processing. Express Canada has established policies and procedures to comply with this Privacy Code, and has designated one or more persons accountable for compliance.
2. Identifying The Purposes Of Collecting Personal Information
Express Canada will inform individuals of the purpose for which personal information will be used before or when they consent to its collection.
3. Obtaining Consent
Express Canada will obtain consent before or when it collects, uses or discloses personal information about an individual.
An individual can provide consent to the collection, use and disclosure of personal information about them expressly, implicitly, or through an authorized representative. An individual can withdraw consent at any time, with certain exceptions.
Express Canada will collect, use or disclose personal information without an individual’s consent only in limited circumstances as permitted by law.
4. Limits For Collecting Personal Information
Express Canada limits the amount and type of personal information it collects. Express Canada will collect personal information only for the identified purposes or as otherwise permitted by law.
5. Limits For Using, Disclosing And Keeping Personal Information
Express Canada will use or disclose personal information only for the reasons it was collected, unless an individual gives consent to use or disclose it for another reason.
Under certain circumstances, Express Canada may have a legal duty or right to disclose personal information without consent. Express Canada will keep personal information only as long as necessary for the identified purposes.
Express Canada will keep personal information only as long as necessary for the identified purposes.
6. Keeping Personal Information Accurate
Express Canada will keep the personal information in its possession or control accurate, complete, current and relevant, based on the most recent information available to Express Canada.
Individuals may challenge the accuracy and completeness of personal information about them and have it amended as appropriate.
7. Safeguarding Personal Information
Express Canada protects personal information with safeguards appropriate to the sensitivity of the information.
8. Making Information About Policies And Procedures Available
Express Canada will be open about the procedures used to manage personal information. Individuals will have access to information about these procedures through this Privacy Code, by contacting our Associates or by contacting the Privacy Office. The information will be available in a format that is easy to understand.
9. Providing Access To Personal Information
When an individual requests it, when possible, Express Canada will advise the individual what personal information Express Canada has in its possession or control about the individual, what it is being used for, and to whom it has been disclosed.
When an individual requests it, Express Canada will give an individual access to personal information about them which is in the possession or control of Express Canada. In certain situations, however, Express Canada may not be able to give individuals access to all of their personal information. Express Canada will not give access to information that is considered proprietary, business or trade secret. For greater certainty, Express Canada will not provide access to notes, internal communications, or information/data generated in the course of its business activities that may relate to an individual.
10. Handling Complaints And Questions
Individuals may challenge Express Canada’s compliance with this Privacy Code. Complaints and inquiries should be directed to our Associates or sent to the Privacy Office.
Express Canada’s Accountability
Express Canada is accountable for all personal information in its possession or control, including any personal information transferred to third parties for processing. Express Canada has established procedures to comply with this Privacy Code, and has designated one or more persons to be accountable for compliance.
Senior management of Express Canada will have ultimate accountability for protecting personal information. Senior management has delegated the day-to-day management of procedures involving personal information protection to one or more persons.
Express Canada’s Privacy Office is responsible for overall personal information protection and Express Canada’s compliance with this Privacy Code. In addition, Associates are able to respond to most inquiries about the protection of personal information.
Express Canada will allow the following categories of Express Canada employees to access individuals’ personal information in Express Canada’s control: Sales and Service Personnel; Finance Personnel; Marketing Personnel; Security Personnel; Audit Personnel; IT Personnel; Operations Personnel; Legal and Compliance Personnel; Risk Management Personnel; and Credit and Lending Personnel. Human Resources Personnel will have access to information about Express Canada’s employees.
Express Canada is also accountable for personal information that has been transferred to a third party for processing. Express Canada’s policies for safeguarding personal information transferred to third parties are set out in sections 7.4 and 7.5 of this Privacy Code.
To practise this Privacy Code, Express Canada:
• has established procedures to protect the privacy of personal information;
• has established procedures to receive and respond to questions and complaints;
• gives the public access to this Privacy Code; and
• has trained Express Canada staff to understand and follow Express Canada’s privacy procedures.
Express Canada also oversees compliance with this Privacy Code through regular audits and other compliance procedures. Senior management reports to a committee of Express Canada’s Board of Directors regarding compliance with this Privacy Code.
Identifying The Purposes of Collecting Personal Information
Express Canada will identify the purposes of collecting personal information, before or when consent is provided.
Except as noted below, when an individual applies for a product or service, Express Canada will make the individual aware of the purposes for which Express Canada is requesting the personal information. If Express Canada identifies other purposes for which the personal information may be used, Express Canada will seek the individual’s consent prior to starting these uses. Express Canada will explain that it is the individual’s right to refuse permission for Express Canada to use personal information for any such other purposes. In some cases Express Canada will not explain those purposes or obtain the individual’s consent. (See section 3.4 and section 5.1 for details).
Express Canada will clearly identify the purposes for which it is collecting personal information in writing, verbally (either in person or over the telephone), or by any other means it communicates with individuals.
Individuals can ask for information about the purposes for which Express Canada collects personal information when they phone or visit Express Canada, or write to the Privacy Office.
Unless additional purposes are identified to an individual before or at the time of collection, Express Canada will collect personal information (which may include credit, employment and other financially related information) for the following purposes:
• to help identify new clients;
• to determine the suitability of products or services for an individual or the eligibility of an individual for products and services;
• to set up and manage Express Canada’s products and services offered by approved distributors that meet an individual’s needs;
• to offer products and services to meet those needs;
• to provide ongoing service; and
• to meet legal and regulatory requirements, such as requirements under the Income Tax Act and credit reporting requirements.
5. Express Canada takes care to explain purposes which are not as obvious as others. The purposes for collecting a name or address are obvious and do not need to be explained, but the purposes for collecting other information may not be as self-evident.
Express Canada may collect, disclose and use personal information for some or all of the following purposes:
• references are used to verify information on an application;
• an individual’s date of birth and other identifying information may be collected and used to verify the identity of a Client, and to protect the Client and Express Canada from error or fraud. Express Canada may also collect and use personal information obtained from credit bureaus, credit reporting agencies, credit insurers and other financial institutions in order to help verify a new Client’s identity;
• a Social Insurance Number is collected because the Income Tax Act and other national or international regulations related to the taxing of nationals require it for an individual’s income tax reporting. In addition, a Social Insurance Number may be used to match credit bureau information and/or protect the Client and Express Canada from reporting errors and/or fraud;
• personal information is exchanged with credit bureaus, credit reporting agencies, credit insurers, and other financial institutions, to maintain the integrity of the credit-granting process and to determine eligibility for financial products and services. In certain cases, individuals have a right to access their personal information in the control of these institutions. Individuals should contact our Associates to find out how to access their personal information in the control of these institutions;
• personal information, including credits or debits to any Account, product or service offered by Express Canada, is used by Express Canada to determine initial and ongoing eligibility for financial products and to notify the Clients of such products by website, mail, email, our Mobile app or any other electronic method offered by Express Canada and used by a Client;
• personal information, including account details, may be collected from or disclosed to an individual’s Independent Mortgage Broker to allow account administration by the Independent Broker;
Subject to 7.4, personal information may be disclosed to investors or potential investors, lenders and government guarantors in order for us to process and fund your mortgage;
• personal information may be collected, used and disclosed to investigate specific transactions or patterns of transactions for the purpose of detecting unauthorized or illegal activities;
• personal information may be collected and used to ensure that a Client’s instructions can be properly verified;
• personal information may be collected, used and disclosed to investigate Client complaints;
• should you open an Account to be operated on behalf of a third party, personal information of that third party will be collected from you in accordance with money laundering legislation;
• personal information may be used by Express Canada and disclosed to its parent or affiliates to satisfy regulatory reporting requirements and international banking standards, including tax reporting;
• personal information may be collected, used and disclosed for the purpose of legal, regulatory and/or governmental requirements in accordance with law;
• personal information may be collected, used and disclosed for the purpose of conducting risk assessments;
• personal information may be collected, used and disclosed to provide specific products or services associated with an Account; and
• personal information may be disclosed to a Joint Account holder to provide Joint Account services.
Obtaining Consent
Express Canada will obtain consent before or when it collects, uses or discloses personal information about an individual. An individual can provide consent to the collection, use and disclosure of personal information about them expressly, implicitly or through an authorized representative.
Express Canada will collect, use or disclose personal information without an individual’s consent only in limited circumstances as permitted by law.
Subject to certain legal and contractual restrictions and reasonable notice, an individual can refuse or withdraw their consent to the collection, use or disclosure of personal information about them at any time.
Express Canada will obtain consent before or when it collects, uses or discloses personal information. Generally, Express Canada will seek consent to use and disclose personal information at the same time it collects the information. In some circumstances, Express Canada may identify a new purpose and seek consent to use and disclose personal information after it has been collected.
Express Canada will explain to individuals in plain language how personal information will be used or disclosed before they give their consent.
Consent to the collection, use and disclosure of personal information can be expressed, implied, or given through an authorized representative of the individual.
Individuals can express consent verbally, such as when information is collected over the telephone, in writing, such as when completing and signing an application, or electronically, such as when applying through a computer.
individuals can imply their consent, for example, by using a Express Canada product or service. In such a case, Express Canada may assume that the individual consents to the use of the personal information.
By applying for a Express Canada product through an Independent Broker, individuals consent to the disclosure of their Account information and other related personal information to the Independent Broker(s) by Express Canada.
Individuals can also give consent through an authorized representative, such as a legal guardian or a person with a Power of Attorney. This may be necessary, for example, if Express Canada cannot obtain express consent from an individual who is a minor, seriously ill, or mentally incapacitated. Authorized representatives may also include an individual’s Independent Mortgage Broker.
Express Canada may collect, use or disclose personal information without the individual’s knowledge and consent only in limited circumstances as permitted by law. For example,
Express Canada may collect, use and disclose personal information without the individual’s knowledge or consent if it is clearly in the individual’s best interests to do so and consent cannot be sought in a timely manner. An example of such a circumstance is when an individual is seriously ill.
Express Canada may collect, use and disclose personal information without individual's knowledge or consent in certain circumstances where the information is publicly available. An example would be the name, address and phone number of a subscriber to a telephone directory that is available to the public where the subscriber can refuse to have their personal information appear in the telephone directory.
Express Canada may collect, use and disclose personal information without the individual’s knowledge or consent in accordance with law or upon the lawful request of a government institution or part of a government institution. An example would be when a government institution lawfully requests the information for the enforcement of any law of Canada, a province or a foreign jurisdiction.
Subject to certain legal or contractual restrictions and reasonable notice, an individual may refuse or withdraw consent at any time.
Express Canada will inform individuals of the consequences of refusing or withdrawing consent when individuals seek to do so. Refusing or withdrawing consent for Express Canada to collect, use or disclose personal information could mean that Express Canada cannot provide the individual with a product, service or information of value to the individual.
For example, if an individual does not allow Express Canada to obtain a credit history report, Express Canada may not be able to lend money to the individual due to prudent lending practices, or other regulations.
Express Canada, however, will not unreasonably withhold products, services or information from individuals who refuse to give consent or who withdraw consent.
Express Canada is required by law to collect certain types of personal information in order to verify the identity of its Clients. If an individual does not allow Express Canada to collect and use this information, or if the Client later attempts to withdraw their consent, Express Canada may not be able to open an Account or maintain the Account on behalf of that Client.
Withdrawal of consent is not permitted in relation to a credit product where Express Canada must collect and report information after credit has been granted. This is to maintain the integrity of the credit system.
Express Canada will not deny credit to an individual solely because the individual does not provide a Social Insurance Number for this purpose, but Express Canada may be unable to open a Savings Account or sell an individual a GIC or other interest-bearing instrument unless a Social Insurance Number is provided.
Obtaining Consent
Express Canada limits the amount and type of personal information it collects. Express Canada will collect personal information only for purposes it has already identified to the individual or as permitted by law. Express Canada will collect personal information using procedures which are fair and lawful.
Express Canada will collect only the amount and type of information needed for the purposes documented by Express Canada and identified to the individual.
Express Canada will collect personal information about an individual primarily from that individual. Except as permitted by law, Express Canada will only collect personal information from external sources if individuals have consented to such collection.
Limits On Using, Disclosing And Keeping Personal Information Express Canada will use or disclose personal information only for the reasons it was collected, unless consent is given to use or disclose it for another reason.
Under certain exceptional circumstances, Express Canada may have a legal duty or right to disclose personal information without the individual’s knowledge or consent.
Express Canada will keep personal information only as long as necessary for the identified purposes.
Express Canada may disclose personal information without consent when required or permitted by law. Examples of such disclosure include:
• subpoenas, search warrants and other court and government orders;
• debt collection or demands from other parties who have a legal right to personal information; and
• disclosure of personal information to a lawyer (or, in Quebec, a notary or an advocate) who represents Express Canada.
• In any of the circumstances referred to in Principle 5.1, Express Canada will protect the interests of its Clients by making sure that:
• orders or demands appear to comply with the laws under which they were issued, and
Express Canada does not comply with casual requests for personal information from government or law enforcement authorities. When permitted by law, Express Canada may notify individuals that an order or demand has been received.
Express Canada may notify individuals by telephone, or by letter to the Client’s usual address.
Express Canada may want to use personal information in its possession or control to market products and services to individuals, either directly through Express Canada or through its existing subsidiaries or affiliates or approved network of Independent Mortgage Brokers. Express Canada will obtain the individual’s consent before using or disclosing personal information for this purpose.
When an individual applies for a product or service and provides personal information, Express Canada will advise the individual that his/her personal information may be used by Express Canada to market other products and services to the individual.
Express Canada will collect health records only for specific purposes explained to Clients, such as establishing the effective date of an individual’s Power of Attorney document or for Mortgage insurance purposes. Subject to anything herein, it will not disclose health records to subsidiaries or affiliates, and vice versa. For example, Express Canada will not use an individual’s health records collected by a subsidiary to help assess a loan application.
If personal information has been used to make a decision about an individual, Express Canada will keep the personal information long enough for the individual to have access to it after the decision has been made.
In the event Express Canada provides personal information to a third party service provider for processing located in a foreign jurisdiction, Express Canada is bound by the laws of the jurisdiction and may disclose personal information in accordance with those laws.
Express Canada will destroy, erase or make anonymous any personal information no longer needed for its identified purposes or for legal requirements.
Keeping Personal Information Accurate
Express Canada will keep the personal information in its possession or control accurate, complete, current and relevant, based on the most recent information available to Express Canada.
Individuals may challenge the accuracy and completeness of personal information about them and have it amended as appropriate.
Express Canada will make reasonable efforts to minimize the possibility of using inaccurate, incomplete or outdated personal information to make a decision about the individual.
Express Canada will update personal information only if it is necessary for the purposes for which it was collected.
Express Canada will make reasonable efforts to keep personal information in its possession and control accurate and current if the information is used on an ongoing basis, unless limits on the need for accuracy are clearly set out by Express Canada.
Express Canada will also rely on individuals to keep certain personal information relating to them accurate, complete and current. If an individual demonstrates to Express Canada that personal information relating to them is inaccurate, incomplete, out of date or irrelevant, Express Canada will revise or delete the personal information. If necessary, Express Canada will disclose the revised personal information to any third parties to whom Express Canada disclosed wrong or outdated information in order to permit them to revise their records.
If Express Canada does not agree to revise personal information as requested by the individual, the individual may challenge Express Canada’s decision. Express Canada will make a record of this challenge, and, if necessary, disclose the challenge by the individual to any third parties to whom Express Canada has disclosed the personal information.
Safeguarding Personal Information
Express Canada will protect personal information with safeguards appropriate to the sensitivity of the information.
Express Canada will safeguard personal information in its possession or control from loss or theft and from unauthorized access, disclosure, duplication, use or modification.
The safeguards employed by Express Canada to protect personal information will vary depending on the sensitivity, amount, distribution, format and storage of the personal information. Express Canada stores most of your information electronically. Recent paper records containing individuals’ personal information are stored in files kept onsite at our Toronto head office, and older records containing individuals’ personal information may be stored at an offsite storage facility. Express Canada will give the highest level of protection to the most sensitive personal information.
Express Canada will safeguard personal information in its possession or control through security measures.
For example:
• orders or demands appear to comply with the laws under which they were issued, and
• physical security, such as secure locks on filing cabinets and restricted access to offices;
• organizational security, such as controlled entry in data centres and limited access to relevant information; and
• electronic security, such as passwords, personal identification numbers and encryption.
Express Canada may transfer personal information to third parties for processing, including printing cheques, market research, data processing services, collection, government guarantors, service agents or for other goods and services. Express Canada will require these third parties to safeguard all personal information in a way that is consistent with Express Canada’s measures and/or as regulated by law.
When Express Canada contracts with third parties, they are given only the information necessary to perform the services as set out in the contract. The third parties are prohibited from storing, analyzing or using the personal information transferred by Express Canada for any other purpose. The third parties are required to protect personal information transferred by Express Canada in a manner that is consistent with privacy policies and practices established by Express Canada.
Express Canada may disclose personal information to businesses such as credit bureaus, credit insurers and lenders with the individual’s consent. Express Canada relies on the added protection of credit reporting legislation to ensure that credit bureaus protect personal information which is disclosed to them.
Express Canada will use care when disposing of or destroying personal information in order to prevent unauthorized access to the information.
Making Information About Policies And Procedures Available To Individuals
Express Canada will be open about the procedures used to manage personal information. Individuals will have access to information about these procedures through Express Canada’s Privacy Code, by contacting our Associates or by writing to the Privacy Office. The information will be available in a format that is easy to understand.
Express Canada will make this Privacy Code available to the public.
Copies of this Privacy Code will be provided to all new Clients; and/or
an electronic version of this Privacy Code is available on Express Canada’s website at exbc.ca.
Information about this Privacy Code will be available in a format that is easy to understand.
Express Canada may make information about its procedures available in a variety of ways, depending on the nature of the services individuals are using and the sensitivity of the personal information.
Express Canada may make brochures available on premises, mail, or email information to its Clients, establish a toll-free telephone service or provide online access.
Access To Personal Information
When an individual requests it, Express Canada will advise what personal information Express Canada has in its possession or control about the individual, what it is being used for and to whom it has been disclosed.
When an individual requests it, Express Canada will give the individual access to personal information about them which is in the possession or control of Express Canada. In certain exceptional situations, Express Canada may not be able to give individuals access to all of the personal information about them.
An individual has the right to know, on request, what personal information about the individual Express Canada has in its possession or control, a right to access that personal information and to know to which third parties Express Canada has disclosed that information, subject to the requirements of any law, regulation or contract limiting same. Individuals may direct their requests by telephone to the Associates or, in writing, to the Privacy Office.
Express Canada has established procedures for responding to requests for access to personal information. Express Canada will respond to requests within a reasonable period of time. Individuals must be specific about the personal information that may be in Express Canada’s possession or control. In the unlikely event that Express Canada determines that there will be a cost to the individual in granting such access, Express Canada shall inform the individual of the costs permitted by law prior to granting such access.
Subject to any limitation contained in this Code or Express Canada’s Account Terms and Conditions, Express Canada will identify from whom it collected the personal information, to whom it has disclosed the personal information, and how and when the information was disclosed. Express Canada will take this data from its records, and will provide it to the individual.
In some cases, Express Canada may not provide access to personal information that is in its possession or control. For example, this may occur when:
• providing access to personal information would be likely to reveal personal information about a third party;
• providing the personal information could result in a threat to the security of another individual;
• disclosing the information would reveal confidential commercial information;
• the personal information is protected by solicitor-client privilege;
• the information is the result of arbitration or other formal dispute resolution process; or
• the information has been collected for the purposes of a legal investigation.
Express Canada will not record in individual files when personal information was disclosed to third parties for routine purposes.
For example:
• reporting to the Canada Revenue Agency (T5 and other reports);
• regular updating of credit information to credit bureaus;
• indicating to third parties when cheques are returned for NSF (not sufficient funds).
Express Canada denies the individual’s request for access to personal information, Express Canada will advise the individual of the reason for the refusal. The individual may then appeal Express Canada’s decision to the Privacy Commissioner of Canada.
Handling Individuals’ Complaints And Questions
Individuals may challenge Express Canada’s compliance with this Privacy Code. Express Canada has policies and procedures to receive, investigate, and respond to individuals’ complaints and questions.
Express Canada has policies and procedures to receive, investigate, and respond to individuals’ complaints and questions relating to privacy. Individuals are advised to direct their complaints and questions by telephone to the Associates or in writing to the Privacy Office.
Express Canada will investigate all complaints. If it finds a complaint justified, Express Canada will attempt to resolve it. If necessary, Express Canada will modify its policies and procedures to ensure that other individuals will not experience the same problem.
If individuals are not satisfied with the way Express Canada has responded to their complaint, they can contact the Office of the Superintendent of Financial Institutions, the external ombudsman for Express Canada the Federal Privacy Commissioner.
