Purpose and Scope
This Policy sets out the principles on which the Company’s privacy practices are based. It acknowledges that privacy laws will vary from province to province and that those laws may also govern the Company’s privacy practices in such province. This Policy is part of the Company’s commitment to ensure that all personal information of individuals in its possession is protected and used in accordance with the law. The Company is responsible and accountable for the personal information we collect and hold. To meet our obligations, we have developed this Policy, and informed our employees about its contents. The Company is responsible for personal information under its control, including any personal information disclosed to third parties for handling or administrative purposes.
The Company’s Privacy Officer is accountable for the Company’s compliance with this Policy and with privacy legislation. While ultimate accountability for the Company’s compliance with the Policy rests with the Privacy Officer and Senior Management of the Company, day‐to‐day compliance with the Policy is delegated to individuals throughout the Company’s lines of business.
Our partners, clients, tenants and employees will be kept informed regarding why and how we collect, use and disclose their personal information. The Company will obtain their consent where required in accordance with this Policy and will only handle their personal information in a manner that is reasonable and appropriate.
What Personal Information Do We Collect?
Personal information is any information about an identifiable person. It includes such things as a person’s home address, date of birth, social insurance number and medical and financial information. Employees may be asked to provide such information to the Company in connection with matters relating to their employment. In all cases, the Company is committed to protecting the privacy of individuals and the integrity of their personal information.
Why and How Do We Collect Personal Information?
The Company will ensure that the purposes for which personal information is collected and the way in which the information may be used are clear to the individual. In some cases, the purpose will be clear from the context of the interaction; in other circumstances, a written or verbal explanation may be required.
Common purposes for collecting personal information include:
- provision of our business services
- management of our premises
- to establish and manage commercial relationships
- processing of payments to/from tenants and suppliers
- to investigate and settle legal claims
- employment‐related administration including all payroll‐related functions
- internal or external audit of employment‐related processes and policies
This is not a comprehensive list of the purposes for which we collect personal information. It is an overview of various activities that the Company may engage in while conducting business affairs.
We collect personal information only by lawful and fair means and not in an unreasonably intrusive way. Whenever possible, we collect the individual’s personal information directly from them. Sometimes we may obtain information about the individual from other sources, such as government agencies or credit bureau services.
In most cases, we will ask the individual to specifically consent if we collect, use, or disclose their personal information. Normally we ask for their consent in writing, but in some circumstances, we may accept their oral consent. Sometimes, the individual’s consent may be implied through their conduct with us. The Company will obtain consent, either express or implied, for the use or disclosure of personal information at the time of the collection of the information. In certain circumstances, consent with respect to use or disclosure will be sought after the information has been collected but before use, particularly if the Company wants to use the information for a purpose not previously identified to the individual. The way in which the Company seeks consent may vary, depending on the circumstances and the type of information collected. In determining the type of consent that may be required, the Company will consider the nature of the information, the use to which the information will be put, applicable laws and the type of interaction in which the information is provided. Consent may be express or implied, given orally, electronically or in writing and provided by an action or inaction.
We accept any of the following as consent for the Company’s existing use and future collection, use and
disclosure of the individual’s personal information to fulfill business purposes:
- consent given through a legally appointed representative
- disclosure of personal information to the Company or its service providers, agents and representatives
- express written or oral consent as obtained through our business process or business relationships
The Company will not collect, use or disclose the personal information of a person without the individual’s knowledge and consent, except in certain limited circumstances permitted by law, such as the following:
- when the collection, use or disclosure is permitted or required by law
- in an emergency that threatens an individual’s life, health or personal security
- the use of such information is necessary to comply with an audit or inspection of or by the organization if it is authorized or required by applicable law
- to investigate an anticipated breach of an agreement or a contravention of law
An individual may withdraw his or her consent to any of our uses of such individual’s personal information by giving our Chief Privacy Officer reasonable prior written notice of same at the addresses provided at the conclusion of this Policy.
Limits on the Collection of Personal Information by the Company
The collection of personal information by the Company will be limited to that which is necessary for the purposes identified by the Company. At all times, the Company will collect personal information by fair and lawful means. It is possible that the Company may, with the consent of an individual, collect and use information about that individual from a third party. For instance, credit references may be checked.
Use of Personal Information
We use personal information to provide real estate, leasing and property management services to our clients. For applicants and employees, personal information is used to administer the employment relationship. The Company does not disclose personal information to any third party to enable them to market their products or services. Personal information will not be used or disclosed by the Company for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law. Personal information will be retained only as long as reasonably necessary for the fulfillment of those purposes or as required by law.
Disclosure of Personal Information
Under certain circumstances, the Company will disclose personal information, including:
- when we are required or authorized by law to do so
- when the individual has consented to the disclosure
- when the services we are providing to our clients requires us to give personal information to third parties, in which case the individual’s consent will be implied, unless they tell us otherwise
- if we engage a third party to provide administrative services to us (e.g. computer back‐up services or archival file storage) and the third party is bound by our Policy
- if the personal information is already publicly known
Safeguarding Personal Information
The Company takes all reasonable precautions to ensure that personal information is kept safe from loss, unauthorized access, modification or disclosure. The Company will employ security safeguards that will protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held. Among the steps taken to protect personal information are:
- premises security
- restriction of file access to authorized employees and other agents of the Company who require the personal information to perform their job duties, and to those otherwise authorized by law
- deploying technological safeguards like security software and firewalls to prevent hacking, virus attacks or unauthorized computer access. Only authorized individuals may access secure systems and databases
- active files are kept in locked filing cabinets
- internal password and security policies
- with respect to personal information that has been transferred to a third party for processing, the Company will use contractual or other means, which may include the examination of such third party’s practices with respect to personal information, to protect personal information while it is being handled by the third party
When the Company no longer need an individual’s personal information, we destroy or erase it according to our Records Retention Policy.
It is important to remember that whatever information an individual transmits or discloses online can be collected and used by others or unlawfully intercepted by third parties. No data transmission over the Internet can be guaranteed to be 100% secure. While the Company strives to protect personal information, we cannot warrant the security of any information electronically transmitted to us.
On Company websites, like most other commercial websites, traffic patterns, site usage and related site information is monitored to optimize the web service. The Company may provide aggregated information gathered in connection with such monitoring to third parties, but this data does not include any identifiable personal information.
Personal information about users will not be sold or otherwise transferred to unaffiliated third parties without the user’s approval; provided, however, we reserve the right to disclose personal information: (a) to its affiliates, subsidiaries and related entities for purposes related to marketing services or opportunities related to a property; and (b) if such disclosure is made pursuant to a legal proceeding or as required by law.
If you do not wish to be included in future marketing efforts, please notify the Company by regular mail at 2851 John Street, Suite One, Markham, Ontario, L3R 5R7 or by email at email@example.com. Notwithstanding the foregoing, the Company reserves the right to contact you regarding matters relevant to your continued use of any Company website, or any information about you that is held by the Company. The Company further reserves the right to conduct statistical analyses through the use of data collected through the website on an anonymous and aggregated basis in order to measure interest in and use of the website, and to provide the results of such analyses to third parties.
If you complete and submit an online employment application found on a Company website, you hereby consent to the disclosure of your completed online employment application to: (a) the Company’s personnel; and/or to (b) the retailer who is a property tenant and to whom such application is being made.
By attending at our premises, our partners, clients, tenants, employees and guests consent to the collection of personal information through video surveillance to monitor the public areas of our premises (for example, parking lots, public areas in malls, and lobby areas) for safety and security reasons. Video images of our guests and, if accessing our premises by vehicle, their licence plate numbers may be collected, used and disclosed by the Company in accordance with this Policy and as permitted by law. If you do not consent to video surveillance of you or your licence plate number, you are not permitted to enter our premises.
Accuracy of Personal Information and Updating Information
If the Company holds personal information about an individual and such individual can establish that such information it is not accurate, complete and up‐to‐date, the Company will take reasonable steps to correct it. The Company will make reasonable efforts to ensure that personal information of individuals is as accurate, complete and up‐to‐date as is necessary for the purposes for which it is to be used.
Should employment applicants or Company employees find that the personal information the Company has is out of date or inaccurate, they should contact the Company’s Human Resources Department directly with the updated information, and the Company will update the relevant database(s) accordingly as soon as possible. If the Company concludes that a correction is not warranted, the employment applicant or employee will be permitted to attach a notation to the file.
Requests for Access
Subject to applicable laws and the exceptions noted below, following receipt of a written request from an individual, the Company will: (i) inform him or her regarding whether or not it holds personal information about such individual, and in circumstances where it does, use reasonable efforts to identify and disclose the source of the information to such individual; (ii) provide a summary of the use that has been made or is being made of such personal information to the individual; and (iii) provide to such individual the identities of third parties to which it may have disclosed personal information about the individual, and the purpose(s) for which the information may have been so disclosed. The Company may charge a reasonable fee to cover its cost of providing such information, provided that the Company will inform the individual of the approximate cost of providing the information prior to doing so and will afford the individual the opportunity to withdraw his or her request.
An individual’s rights to access his or her personal information are not absolute. The Company may deny access for reasons which include but are not limited to:
- such denial is required or authorized by law
- granting the individual access would have an unreasonable impact on another individuals’ privacy
- to protect the Company’s rights and property
If the Company denies an individual’s request for access to, or refuses a request to correct, personal
information, the Company will provide such individual with an explanation.
Since the Company regularly reviews all of its policies and procedures, this Policy is subject to change from time to time.
The Company will regularly make its employees aware of this Policy, currently scheduled on an annual basis and/or at the time of substantial updates or amendments. Candidates and non‐current employees may access this Policy by contacting the Company’s Human Resources Department.
If an individual has any questions, wishes to access or change their personal information, or if they no longer wish to receive any information about the Company’s services, notice should be sent to the following address:
Centrecorp Management Services Limited
2851 John Street, Suite One
Markham, Ontario L3R 5R7
Attention: Gilbert J. Weiss, Vice President and General Counsel
Tel: (905) 477‐9200 Fax: (905) 477‐7390
or by email to: firstname.lastname@example.org
If we are not able to resolve an individual’s concerns, or if they have any other concerns about this Policy, they may contact the Office of the Privacy Commissioner of Canada or, if applicable, the appropriate provincial Privacy Commissioner. The Company’s Chief Privacy Officer will provide the individual with this contact information upon request.