As of January 1, 2004, all commercial businesses in Alberta are required to comply with the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and the provincial Personal Information Protection Act (“PIPA”). These laws apply in addition to and not in replacement of the provincial Freedom of Information and Protection of Privacy Act (“FOIPP”).
At Hopewell, we believe in building relationships with our clients and employees. These relationships are built on trust and respect and we believe that is the way a business should be operated. Part of establishing trust and respect is done by telling you what information we will require from you, how this information will be handled and how this information will be kept safe. We know that your personal information is a valued asset and we want you to know that we will treat it that way.
The purpose of the following document is to inform you of:
- our information handling practices;
- the reasons for these practices;
- security steps in place to protect your information;
- your role in controlling your own personal information; and
- your ability to access your own personal information.
What Is Personal Information?
- Home Addresses
- Social Insurance Number
- Personal Phone Number
- Financial Institution and Bank Account Details
- Credit/Supplier contact information
- Date of Birth
- Employer Contact Information
- Length of time with current employer
- Marital Status
- Spousal Contact Information
- Employer Contact Information for Spouse
- Spouse’s length of time with current employer
- Assets & Liabilities
- Income/ Employee Compensation
- Investment Information (Stocks, Bonds and Real Estate)
- General Information which may include:
- If you’ve ever had an asset repossessed
- If you’ve been party to any claims or lawsuits
- If you’ve ever declared bankruptcy
- If you owe any taxes prior to the current year
Collecting Personal Information
Hopewell collects Personal Information for the following purposes (hereinafter the “Purposes”):
- to establish and maintain commercial relationships with clients, customers and provide ongoing service;
- to manage and develop our business and operations, including employee and personnel matters;
- to meet legal and regulatory requirements;
- to acquire, dispose, lease, finance and manage properties in our portfolio; and
- for any other reasonable purpose to which you consent.
Hopewell collects Personal Information for these Purposes through various means including, but not limited to:
- email and other correspondence that is sent to Hopewell;
- from service providers in connection with the Purposes;
- web site forms;
- verbal discussions; applications for tenancy including credit applications (may collect credit-related or other information about the individual from a third party credit reporting agencies, banks, references, etc);
- leases and other associated agreements entered into with Hopewell;
- commercial agreements entered into with Hopewell;
- video surveillance, swipe cards and other information for general security purposes;
- resumes & personal references provided in applications of employment; and
- employment forms.
Obtaining Your Consent
The main purpose of the PIPEDA and PIPA legislation is to ensure that businesses such as Hopewell obtain an individual’s consent to collect, use or disclose his or her personal information.
Your consent may be expressly given (either orally, electronically or in writing), implied (as a reasonable conclusion from your actions), or deemed (where information is given by you voluntarily or where you do not refuse consent when given a reasonable opportunity to do so). For example, when you agree to a financial check by Hopewell, we will assume that you have provided your consent in relation to all matters reasonably related to same. Otherwise, and generally:
- Hopewell shall use reasonable efforts to ensure that an individual is advised of the Purposes for which the Personal Information will be used or disclosed;
- Hopewell shall use reasonable efforts to seek consent at the same time that we collect the information. However, we may seek consent to use and disclose personal information after it has been collected, but before it has been used or disclosed for a new purpose;
- Hopewell may require individuals to consent to the collection, use or disclosure of Personal Information as a condition of the supply of a service or employment or prior to entering into an agreement if such collection, use or disclosure is required to fulfill the identified purposes;
- In determining whether consent is required and, if so, which form of consent is appropriate, we will take into account both the sensitivity of the Personal Information and the purposes for which we will use the information;
- Hopewell can collect, use and disclose employee Personal Information without the consent of the individual where the collection, use or disclosure is reasonable for the purposes of establishing, managing or terminating an employment relationship between us and the individual; and
- On giving reasonable written notice to Hopewell, an individual may withdraw consent to the collection, use, or disclosure of his or her Personal Information subject to legal or contractual restrictions. Upon notice of withdrawal of consent, we will notify the individual of the likely consequences of withdrawing his or her consent and, except where otherwise required or permitted by law, we will stop collecting, using, or disclosing the Personal Information as requested.
Safeguarding Your Personal Information
Like you, we at Hopewell value your personal information. Part of valuing your personal information is making sure that it is protected and kept confidential. We achieve this by:
- requiring all of our employees to sign a confidentiality agreement;
- taking steps to ensure the security of Personal Information, regardless of the format in which it is held, while in our custody is appropriate to the sensitivity of the information, including physical security measures (such as the use of locked cabinets and storage facilities) and technological security measures (such as the use of passwords and encryption);
- taking appropriate steps to protect Personal Information disclosed to third parties, such as by contractual agreements stipulating the confidentiality of the information and the purpose for which it is to be used; and
- limiting access to Personal Information to only those who reasonably require access.
Updating Your Personal Information
Over the course of our relationship, your personal information may change. It is important that the information we have about you is accurate and current. If your personal information changes, please inform us of the change and any other information you feel is necessary. Also, if your personal information is incorrect, please notify us of the correct information.
We will keep your information as long as is necessary to continue to meet the needs for which it was obtained and any legal requirements we may have; however, once your personal information is no longer needed, we will destroy it.
Controlling Your Personal Information
We believe that part of establishing trust and integrity comes from allowing you to control your own personal information.
As such, we will collect information about you on a voluntary basis; however, in some circumstances, before we collect personal information from you, we will have you complete a consent form which authorizes our collection, use and disclosure of your personal information.
If you have questions or concerns about the handling of your personal information or wish to withdraw your consent, please contact Blair Rafoss, Hopewell's Privacy Officer at: firstname.lastname@example.org
Accessing Your Personal Information
Upon written request, a client or employee of Hopewell (herein collectively a “Client) shall be informed of the existence, use, and disclosure of his or her Personal Information. A Client shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. A Client may be required to provide sufficient information to permit our organization to provide an account of the existence, use, and disclosure of Personal Information. Hopewell may require the Client pay for minimal costs to Hopewell only if Hopewell has informed the individual of the approximate cost and the Client has advised Hopewell that the request is not being withdrawn.
Hopewell will respond to a Client's request with due diligence and in any case not later than thirty days after receipt of the request unless the time limit is extended (for a maximum of thirty days) if: meeting the time limit would unreasonably interfere with the activities of the organization, if the time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet, or if necessary in order to be able to convert the Personal Information into an alternative format. In either case, Hopewell will, no later than thirty days after the date of the request, send a notice of extension to the Client, advising them of the new time limit, the reasons for extending the time limit and of their right to make a complaint to the Privacy Commissioner of Alberta in respect of the extension. If Hopewell responds within the time limit and refuses a request it will inform the Client in writing of the refusal, setting out the reasons and any recourse that they may have under PIPA. The requested information will be provided or made available in a form that is generally understandable. For example, if Hopewell uses abbreviations or codes to record information, an explanation will be provided.
Should any other Personal Information be found to be inaccurate by the Client they may challenge the accuracy of the information by mailing a written notice to the Privacy Officer demonstrating the inaccuracy or incompleteness of the information. When a Client successfully demonstrates the inaccuracy or incompleteness of the information to the satisfaction of Hopewell, the Personal Information will be amended as appropriate. Where appropriate, the amended information will be transmitted to third parties having access to the information in question.
When a challenge is not resolved to the satisfaction of the client, the substance of the unresolved challenge will be recorded by Hopewell. When appropriate, the existence of the unresolved challenge will be transmitted to third parties having access to the information in question.
If you have more questions about your privacy rights in Alberta please visit the website of the Office of the Information and Privacy Commissioner at http://www.oipc.ab.ca/.