Polity reserves the right to change this policy from time to time as industry practice, the law, Polity’s procedures, or public policy may change from time to time. Any changes to this policy shall be uploaded to Polity’s website as soon as reasonably practical.
The following are the principles of fair information practices incorporated into the Personal Information Protection and Electronic Documents Act (Canada) (PIPEDA), Alberta’s and British Columbia’s respective Personal Information Protection Act (PIPA), and Quebec’s Act Respecting the Protection of Personal Information in the Private Sector – together, the “Privacy Laws”.
Every business that carries on “commercial activities”, including Polity, is subject to the application of the Privacy Laws as they relate to the collection, use and disclosure of Personal Information. The Privacy laws only apply to information about human beings.
Polity is required to comply with the Privacy laws in all of its business practices that involve Personal Information about individuals.
Principle 1 – Accountability
All inquiries or concerns regarding the use of Personal Information, including information that has been transferred by Polity to a third party (for example, for processing), must be directed to the CPO, as the first point of contact at Polity. The CPO may also bring in other departments of Polity, as necessary, to assist in resolving the inquiry or concern.
Principle 2 – Identifying Purposes
The purposes for which Personal Information is collected and used must be identified, documented and disclosed to clients at or before the time their information is collected. Polity is only permitted to collect, use, disclose and retain Personal Information to the extent necessary to fulfill the purpose for which the information was collected, or otherwise required by law.
Before Polity may use Personal Information for a purpose not previously identified to the user, the new purpose must be identified and unless the use is required by law, client consent must be obtained before his or her information may be used for the new purpose.
Polity collects Personal Information for the following purposes:
Principle 3 – Consent
Knowledge and consent of users are required for the collection, use and disclosure of Personal Information.
Subject to restrictions imposed by law or under a contract and reasonable notice, consent may, at any time, be withdrawn by a user. Polity must inform a user where there are implications of withdrawing or refusing the user’s consent.
Principle 4 – Limiting Collection
Personal Information is not to be collected by Polity indiscriminately. The amount and the type of Personal Information collected must be limited to that which is necessary for the purpose of the collection identified to the user. Further details on limiting collection are described below in the “Limitation on Collection” section.
Principle 5 – Limiting Use, Disclosure and Retention
Caution should be exercised in regard to the disclosure of Personal Information. In general, Personal Information should be disclosed for the purpose for which it was collected, with the express consent of the client or as required by law. If there is any doubt, Company Personnel should speak to the CPO prior to disclosing Personal Information. In some circumstances, for example, where it is necessary in connection with the provision of a service and the client’s consent has been obtained, Polity may disclose Personal Information to an affiliate or financial service providers, such as banks and others involved in financing or facilitating transactions by Polity or operations of Polity.
Polity may be required by law to disclose Personal Information to taxation and regulatory authorities and agencies. In this regard, Polity may have to file with the appropriate securities commission, a report that includes Personal Information such as the client or users’ name and address. Such information is collected indirectly by securities regulators, under the authority granted to them in securities legislation, for the purposes of the administration and enforcement of the legislation. Personal Information will be retained for a period of seven years following the end of the client relationship. After seven years, all client documentation will be destroyed in a manner commensurate with its sensitivity unless there are securities laws or other legal requirements that require its retention.
Polity may transfer Personal Information to service providers under contract that provide accounting, legal, tax preparation or other similar services. Polity remains responsible for Personal Information while it is in the hands of third-party service providers. Polity will protect the information by requiring in its contractual relationships with its service providers that the service providers afford Personal Information the same level of protection as it is given by Polity.
Principle 6 – Accuracy
Personal Information must be as accurate, complete, and up to date as necessary for the purposes for which it is to be used and will only be routinely updated where necessary for those purposes.
Principle 7- Safeguards
Personal Information will be protected against loss, theft, unauthorized access, use, disclosure, copying, or modification by safeguards appropriate for sensitive information. Personal Information (and confidential information of Polity) will be retained in a designated secure area or electronic database.
Company Personnel are individually responsible for ensuring the confidentiality, appropriate use and protection of all Personal Information to which they have access.
Polity records Personal Information electronically on computer servers where only authorized Company Personnel have access. Polity authorizes Company Personnel and third-party service providers to have access to Personal Information only on a need-to-know basis in order to fulfil their job requirements and obligations.
Principle 8 – Openness
Principle 9 – Individual Access
On request, a client shall be informed of whether or not Polity is holding his or her Personal Information, the use to which it has been put by Polity and the organizations to which it has been disclosed or the type of organizations to which it may have been disclosed where more precise information is not available.
Requests for access must be made in writing. Access to a client or users’s own Personal Information will be provided except where doing so would likely reveal Personal Information about a third party that cannot be severed from the Personal Information. Access may also be withheld where:
More information about gaining access to individual information is detailed in the “Access to and Correction of Information” section, below.
Principle 10 – Challenging Compliance
4. Collection and Protection of Personal Information
Under the Alberta and British Columbia Personal Information and Protection Acts, Personal Information collected about an individual prior to January 1,2004:
The purpose for collecting Personal Information is set out in this policy. Any necessary consents shall be obtained before Personal Information is collected, used or disclosed.
We ask for your express consent for some purposes and may not be able to provide certain services if you are unwilling to provide consent to the collection, use or disclosure of certain Personal Information. Where express consent is needed, we will normally ask clients to provide their consent orally (in person, by telephone), in writing (by signing a consent form), or electronically (by clicking a button).
In cases that do not involve sensitive Personal Information, we may rely on “opt-out” consent.
The amount and type of Personal Information collected by Polity is defined by law and shall be limited to what is necessary to fulfill the identified purpose. Personal Information shall only be used or disclosed for the purposes for which it is collected. Exceptions may be made with the consent of the individual or if authorized or required by law.
Personal Information collected by Polity or on behalf of Polity will be sent to Polity’s head office in Calgary and will be subject to the laws of Canada.
Personal Information collected by Polity may be shared with affiliated companies or third parties retained by Polity, which assist Polity in carrying out various services. Polity carefully scrutinizes and examines third parties to confirm that similar standards are utilized by such third-party companies with regards to collection and use of Personal Information.
Non-Personal Information Automatically Collected from Site
Polity receives and sends data from Polity’s servers and from your browser when you visit our website, including your IP address, the time and information about the page you requested and the website through which you were linked to our site, if any. Polity may use tracking technologies in a variety of ways, including keeping count of return visits to our site, accumulating and reporting anonymous, aggregate data, statistical information on website usage, and determining which features, functionality, or changes to the website, products or services that users prefer.
Your internet browser has a feature called “cookies”, which store small amounts of data on your computer about your visit to our website. Cookies tell us nothing about who you are unless you specifically give us Personal Information. You do not need to have cookies turned on to visit our site. You may also elect to not allow cookies to be collected by selecting certain options on your browser.
Limitation on Collection
Polity will not collect Personal Information unless the information is necessary for one or more of its business activities or in order for the organization to comply with regulatory or legal requirements.
As an employer, we are required to obtain certain information regarding our employees in accordance with Canada Revenue Agency reporting requirements.
Notification Required for Collection
Where Personal Information is to be collected directly from a user, reasonable steps will be taken to ensure the user is aware of the purpose of collection. When Personal Information is to be obtained from third parties such information will be limited to that required for the identified purpose and will be collected by lawful and fair means for purposes directly related to Polity’s activities. An individual may give his or her consent in writing, electronically or verbally.
Withdrawal of Consent
Clients will be given a reasonable opportunity to decline or object to the proposed collection, use or disclosure of their Personal Information. Such withdrawal of consent must be provided to Polity in writing upon receipt of which we will inform the client of the likely consequences to this action.
Limitations on Use or Disclosure
Polity will only use or disclose information regarding our users or employees for the purpose for which it was collected or where a lawful exception applies. Company Personnel of the firm are only authorized to access or use Personal Information in the legitimate performance of their duties and strictly on a need-to-know basis.
Disclosure of Personal Information
Polity is regulated by a number of governmental and regulatory organizations. From time to time these bodies may demand that we produce, or make available for inspection, documents and information that clients have provided us for the following regulatory purposes:
We also have relationships with other non-regulatory organizations that require us to share or make available information regarding clients and/or their accounts. Specifically, we are required to share and/or provide information to the following organizations:
Use or Disclosure Without Consent
Polity may use or disclose Personal Information about a user without consent under the following circumstances:
Care of Personal Information and Accuracy of Information
Polity will use its best efforts to ensure that Personal Information is relevant, accurate, complete and up to date for the purpose for which it is to be used. Where Personal Information is collected directly from an individual, it will be presumed to be accurate and complete at the time of collection, unless there is other information which suggests it is not. Personal Information will be updated as required by the regulatory authorities.
Protection of Information
Polity will take reasonable steps to protect the Personal Information it holds from misuse or loss and from unauthorized access, modification or disclosure.
Polity will document security, storage and disposal requirements for all Personal Information for which it is responsible. In documenting these requirements Polity will take into consideration the sensitivity of the information, its form and volume, its frequency of use and retention period, the circumstances of its use and storage, and any legal or regulatory requirements.
Polity maintains third party agreements with those companies whose employees have access to our premises and/or Personal Information we collect as a result of our relationship with them (i.e. cleaners, identification verification service, etc.). Polity carefully selects third party service providers, with which we share this information, and ensures that they have similar privacy standards which comply with the Privacy Laws.
Retention and Disposal of Information
Polity will document retention and disposal requirements for all Personal Information for which it is responsible, taking into consideration the sensitivity of the information, its form, the circumstances of its use and any legal or regulatory requirements.
When Personal Information is no longer required to be kept, such information will be destroyed or made anonymous in a controlled and secure manner in order to prevent any unauthorized persons having access to that information. Personal Information which is the subject of a complaint, inquiry or legal process will not be destroyed until the resolution of that process.
5. Access to and Correction of Information
Individuals are entitled to inquire whether Polity holds Personal Information concerning them and, if so, to be advised of its use and disclosure. Individuals are also entitled to obtain a copy of the information we have on file. Most of the information can be assessed by logging into their online account. If additional information is required, written request has to be submitted.
How to Request a Copy of Personal Information
To obtain a copy of their Personal Information, clients must submit a written request to Polity’s CPO. In this regard, the request may be sent by Canada Post mail to:
Polity Media Inc.
Attention: Privacy Officer.
Suite 201 239 – 10th Avenue S.E.
Calgary, AB T2G 0V9
Time Limit for Response
Polity will respond to a written request for access, acknowledging the request within 14 business days. If a request is straightforward, Polity will provide a copy of the information on file within 14 business days or, if the request is more complicated, within 30 business days.
There may be circumstances under which we may not be able to provide clients with certain information. For example, the information may have been destroyed or, in our opinion, it is too costly, or we are unable to retrieve the information. In some cases, your request for Personal Information may be denied or access may be restricted as permitted or required by law (information which is subject to legal privilege, information related to third-party or confidential commercial information).
Polity will not charge individuals a fee for access to Personal Information concerning them, unless requests are considered unnecessarily frequent or extensive.
Correction of Information on File
Any individual may challenge the completeness or accuracy of Personal Information concerning them and request that the information be corrected. To amend any information we have on file, clients must submit a written request detailing the changes to be made. Our CPO will acknowledge the request and provide written confirmation that the changes or amendments have been made
6. Reviews and Complaints
An individual who believes his or her privacy may have been interfered with or compromised by Polity may initiate a complaint requesting a review of the matter.
How to Initiate a Complaint
Individuals will be required to submit a written complaint to our CPO who will consider the complaint and attempt to resolve it. Our CPO, or another authorized individual, will reply to the individual within 45 working days. If the complaint is not resolved in a manner acceptable to the individual, the firm will advise of:
Appeal to the Privacy Commissioner
As noted above, an individual who is not satisfied with Polity’s handling of his or her privacy complaint may ask the Privacy Commissioner to review any decision, act or failure of Polity. The Privacy Commissioner has powers to investigate and make a determination on the complaint.
How to Request a Review or Initiate a Complaint
To ask for a review or to initiate a complaint an individual must submit a written request to the Commissioner within 30 days from the day he or she was notified of the firm’s decision. Please note that a longer period may be allowed by the Commissioner.
Notifying Others of a Review
Upon receipt of such a request, the Commissioner must give a copy of the written request to the organization concerned.
Inquiry by the Privacy Commissioner
If a matter under review or relating to a complaint is not referred to mediation, settled pursuant to mediation or resolved, then the Commissioner may conduct an inquiry and decide all questions of fact and law arising in the course of the inquiry. The individual making the complaint and the organization concerned will be given an opportunity to make representations to the Commissioner and be represented by a lawyer at the proceeding.
7. Limitation on Unenforceable Provisions