1. Purpose 

1.1 The purpose of this policy (the “Policy”) is to describe the manner in which Redion Canada will ensure compliance with applicable laws as they relate to protection and privacy of personal information.  

2. Definitions 

2.1 In this Policy, the following terms shall have the following meanings: 

(a) “Person” means any individual, partnership, corporation, governmental body, or unincorporated organization;  

(b) “Personal Information” means information about an identifiable individual, and includes information that would satisfy the definition of “personal information” in PIPEDA or the “substantially similar” provincial private sector privacy legislation to which Redion Canada is subject, which is processed by Redion Canada for the purposes of carrying on its business.  

(c) “OPC” means the Office of the Privacy Commissioner of Canada; 

(d) “PIPEDA” means the Personal Information Protection and Electronic Documents Act (Canada), as amended from time to time; 

(e) “Privacy Laws” means PIPEDA and applicable Canadian provincial privacy legislation to which Redion Canada is subject;  

(f) “Privacy Principles” means the principles set out in Schedule 1 of PIPEDA which are: Accountability; Identifying Purposes; Consent; Limiting Collection; Limiting use, Disclosure and Retention; Accuracy; Safeguards; Openness; Individual Access; and Challenging Compliance, which are more particularly described in Appendix “A”. 

2.2 For the purposes of this Policy, “processing” includes, but is not limited to, the collection, receipt, access, use, transfer, disclosure, management, back-up, modification, retention, receipt, creation, disposal and otherwise handling of Personal Information by Redion Canada’s employees. “Process” and “processed” shall have the same meaning. 

3. General Obligations 

3.1 Redion Canada shall process Personal Information in compliance with all applicable Privacy Laws, including the Privacy Principles. Without limiting the foregoing, Redion Canada shall offer all reasonable cooperation in the event of any requests or instructions concerning Personal Information issued by the Office of the Privacy Commissioner of Canada or any other Canadian governmental or regulatory authority having jurisdiction to enforce, administer or adjudicate with respect to the Privacy Laws applicable to Redion Canada.  

3.2 Redion Canada shall promote a culture that respects privacy and confidentiality and ensure that all employees and contractors are trained on the organization’s obligations to protect privacy and respect individual privacy rights regarding Personal Information processed by  Redion Canada. 

3.3 Redion Canada shall establish procedures applicable to the collection, use and disclosure of Personal Information at Redion Canada to ensure that all employees and contractors are aware of their obligations with respect to Privacy Laws and guide them in complying with these laws. 

4. Collection of Personal Information 

4.1 Redion Canada collects Personal Information as necessary to provide its products and services. Depending on the products or services requested, this may include collecting individuals’ name, contact information (mailing address, email address, phone number), birth date, assets, insurance needs, claims history, driver license number, health information, marital status, Personal Information (name, contact information) of beneficiaries (if any) and other information shared during exchanges with Redion employees or agents. If Redion Canada requires additional information to provide its products or services, we will identify that information and explain why it is required. 

4.2 In most cases, Redion Canada will collect Personal Information from individuals directly. In some cases, Redion Canada may collect Personal Information indirectly via third parties, such as consumer reporting agencies, government bodies, and insurance adjusters, so long as we have an appropriate legal basis, such as consent.  

5. Use of Personal Information 

5.1 Redion Canada shall not use any Personal Information except for the purposes of carrying on its business. Redion Canada may use Personal Information for the following business purposes: 

• Verify the identity of customer; 
• Provide customer with the product and services requested, which may include, without limitation, providing quotes, assessing and underwriting insurance, receiving payment, adjudicating and settling claims, and notifying customers of changes to our products or services;   
• Communicate with customers respecting such product and services in addition to their inquiries or complaints;  
• Provide customer service; 
• Engage in marketing endeavours; 
• Assess website effectiveness and enhance website security and useability; 
• Improving insurance products; 
• Detect, prevent, and supress fraud and other illegal activities; and 
• Any other purpose as authorized or required by law, or for which Redion Canada has obtained consent. 

6. Sharing Personal Information 

6.1 Redion Canada may transfer Personal Information to third party service providers who assist in providing our products and services. Redion Canada remains accountable for the processing of Personal Information by such service providers, and will ensure by contact that they protect the Personal Information in accordance with Privacy Laws.  

Redion Canada may disclose Personal Information to its parent company, affiliates (some of which may be located outside Canada), governmental organizations, regulatory bodies, law enforcement agencies and others on the basis of consent or as permitted or required by law. Where disclosures are required by law, Redion Canada may, if permitted by law, elect to notify concerned individuals of the pending disclosure of their Personal Information to permit the concerned individuals an opportunity to seek a protective order or other appropriate remedy. In the event Redion Canada is not able to, or does not, provide the concerned individuals with prior notice, Redion Canada may, if not prohibited by applicable law, advise the concerned individuals subsequent to such disclosure. Redion Canada will disclose only such information as is required, in the opinion of its counsel, and will use commercially reasonable efforts to obtain confidential treatment for Personal Information that is so disclosed.  

6.2 Redion Canada may also disclose Personal Information in the context of a proposed or completed business transaction, such as a merger or acquisition, or a disposition of some of all of its assets, in accordance with parameters set out in Privacy Laws. 

6.3 In some cases, Redion Canada may share Personal Information with third parties located outside of the province in which the customer resides, or even outside of Canada. In these cases, Redion will take appropriate steps to comply with the requirements of Privacy Laws, as may be applicable. Where Personal Information is shared with third parties in another jurisdiction, it will be subject to the laws and governmental authority of the receiving jurisdiction. 

7. Security Safeguards for Protecting Personal Information 

7.1 Redion Canada shall take all reasonable steps to protect Personal Information from loss, theft and unauthorized access, disclosure, copying, use, or modification. This includes implementing administrative, technical, and physical safeguards that are appropriately tailored to the sensitivity of the Personal Information in question. Such safeguards may include:  

(a) Restricting Access: Redion Canada shall restrict access to Personal Information to Redion Canada employees, agents, and third party service providers who have a legitimate business need for that Personal Information for the purpose of carrying on Redion Canada’s business. Before granting such access, Redion Canada shall advise each such individual of the sensitive and confidential nature of the Personal Information and the obligation to comply with Privacy Laws and the applicable provisions of this Policy;  

(b) Storage of Personal Information: Redion Canada shall ensure that Personal Information is, at all times, stored in a secure manner and kept physically independent from all other databases, information and records (as appropriate). “Physically independent” may mean a separate server or a logical partition within the same server;  

(c) Training: Redion Canada shall ensure that all individuals engaged in carrying out Redion Canada’s business (whether directly engaged by Redion Canada or indirectly engaged through third parties) who may have access to Personal Information have been trained in privacy compliance processes consistent with those referred to in this Policy; 

(d) Contractual Obligations: Redion Canada shall ensure that all agreements with individuals and third parties who may have access to Personal Information contain obligations to protect Personal Information of Redion Canada’s customers in compliance with Privacy Laws and this Policy. Redion Canada will ensure that it has a right to audit its third parties’ compliance with this Policy; 

(e) Technical controls: Redion Canada shall implement technical controls to protect Personal Information, such as firewalls, encryption, and robust password practices. 

8. Retention of Personal Information 

8.1 Redion Canada will retain Personal Information only for as long as necessary to satisfy the purpose for which it was collected. Redion Canada will securely destroy, delete or render anonymous, in accordance with generally accepted best practices, Personal Information no longer required for an identified purpose or a legal requirement in accordance with the Privacy Laws.  

9. Individuals’ Rights 

9.1 Individuals may enjoy the following rights under Privacy Laws: 

i) Right of access: Individuals have the right to request information about the existence, use, and disclosure of their Personal Information, and to request access to the Personal Information that Redion Canada has collected about them;

ii) Right of correction: Individuals have the right to request correction of Personal Information that is inaccurate or incomplete for the purposes for which it is to be used. In doing so, they may be required to provide information demonstrating the incorrectness or incompleteness of the Personal Information that Redion Canada has on record. Where appropriate, the amended Personal Information will be transmitted to third parties that have access to the information in question. If Redion Canada concludes that correction is not warranted, it will annotate the Personal Information to indicate that the request was made but not implemented;

iii) Right to withdraw consent: Individuals may “opt-out” or withdraw their consent for the processing of their Personal Information at any time, subject to legal and contractual obligations and reasonable notice. Redion Canada will inform individuals seeking to exercise this right of the anticipated consequences, such as the inability to receive Redion Canada’s products or services, before processing the request; 

iv) Right to unsubscribe from marketing communications: Individuals can opt-out of receiving Redion Canada’s electronic marketing communications through the “unsubscribe” mechanism included in such correspondence or by contacting the Data Privacy Officer; however, they will still receive transactional messages, including information about their account, claims, and inquiries;

v) Right to challenge Redion Canada’s compliance: Individuals can raise questions or concerns, or lodge complaints, about Redion Canada’s compliance with this Policy or applicable Privacy Laws with the Data Privacy Officer. If, after that, they are still not satisfied with Redion Canada’s response, they may file a complaint with the appropriate privacy regulator in their jurisdiction; and

vi) Right to data portability: Individuals in Quebec may, in certain circumstances and subject to statutory limits, request that specific computerized Personal Information they provided to Redion Canada be provided to them in a structured, commonly used technological format, or be transmitted to a third party authorized by law to receive it. 

9.2 All rights can be exercised by writing to Redion Canada’s Data Privacy Officer using the contact information provided below. Redion Canada is obliged to respond to such requests within legislated timeframes (typically 30 days, subject to permissible extensions). If Redion Canada determines that it has a legal basis to deny a request (for example, where the information is subject to legal privilege, or where it would reveal Personal Information of another individual), it must respond in writing explaining its grounds for refusal and inform the individual of their options for challenging that decision. 

9.3 When making a request, the individual will be required to provide sufficient detail to enable Redion Canada to ascertain their identity and the specifics of what is being requested.

10. Contact 

10.1 The Data Privacy Officer may be contacted as followed: 

By Mail: 

Data Privacy Officer 
Redion Canada 
Suite 1200, 70 York Street 
Toronto, Ontario  
M5J 1S9 

By email: 
Privacycompliance.ca@redion.com 

By phone: 
1-800- 883 –8767 

11. Policy Review 

11.1 This Policy will be reviewed as required, and no less than annually, by the Data Privacy Officer and Redion Canada Management. The date of last update is noted above.