PIPEDA Compliance Policy & Privacy Principles

Back

Intent

The Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use, and disclosure of personal information in a manner that recognizes the right to privacy of individuals with respect to their personal information and the need of organizations to collect, use, or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. We (EDPRO Energy Group Inc., SLEEGERS Engineered Products Inc., P38 Inc.) are committed to protecting and respecting the personal information of its customers, employees, business partners, and all other entities it interacts with in accordance with PIPEDA. This policy will provide guidelines to ensure that our companies remain compliant with PIPEDA requirements. This policy will be reviewed and approved annually by Human Resources.

 

Privacy Principles

1. Accountability

We are responsible for the personal information we collect and store. Upon request, customers will be referred to a representative who will be able to answer or respond to any questions or enquiries about personal information retained. We are responsible for information transferred to a third party for processing; however, we do not distribute this information unless required for legitimate business purposes. Our business procedures are designed to protect personal information and to receive and respond to complaints. These principles will help respond to privacy enquiries, as well as help ensure confidentiality compliance.

 

2. Identifying Information

Personal information may include but is not limited to:

  • Name, address and telephone number
  • Banking information, credit information, payment records
  • Preferences for products and services
  • Personal information is collected in the course of business to identify product and service requirements; establish credit arrangements, payment terms and for billing purposes and for facilitating equipment leases and sales. There will be no unauthorized information collected electronically through our websites.
  • Prior to collection, we will identify the purpose for the collection of information. When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use.

 

3. Consent

We will ensure consent of the individual for the collection, use, or disclosure of personal information.

 

4. Limiting Collection

We will limit collection of personal information to that which is necessary for the purposes identified. Information shall be collected by fair and lawful means.

 

5. Limiting Use, Disclosure and Retention

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.

 

6. Accuracy

Personal information shall be as accurate, complete and up-to-date as is necessary for the purpose for which it is used. We will not routinely update personal information unless this is necessary for the purposes for which the information was collected.

 

7. Safeguards

Personal information shall be protected by security safeguards appropriate to the sensitivity of the information. The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Care shall be used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.

 

8. Openness

Upon individual request, we will make readily available specific information about our policies and practices relating to the management of personal information. This information will include: (a) the name or title, and the address, of the person who is accountable for the organization’s policies and practices and to whom complaints or inquiries can be forwarded; (b) the means of gaining access to personal information collected and retained; (c) a description of the type of personal information held including a general account of its use; (d) personal information that is made available to related organizations.

 

9. Individual Access

Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information, and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

 

10. Challenging Compliance

An individual may challenge compliance with the above principles to the designated individuals responsible for our organization’s compliance. We will investigate all complaints and if a complaint is justified, we will take appropriate measures, including, if necessary, amending our policies and practices.

 

Definitions

Breach of security safeguards

The loss of, unauthorized access to, or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards, or from a failure to establish those safeguards.

 

Personal information

Information about an identifiable individual.

 

Security safeguards

Security safeguards include the following:

  • Physical measures, for example, locking filing cabinets and restricted access to offices;
  • Organizational measures, for example, security clearances and limiting access on a “need-to-know” basis; and
  • Technological measures, for example, the use of passwords and encryption.

 

Significant harm

Includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property.

 

All definitions sourced from PIPEDA.

 

Guidelines

Compliance

The following guidelines have been implemented to ensure (EDPRO Energy Group Inc., SLEEGERS Engineered Products Inc., P38 Inc.) remain compliant with PIPEDA requirements. The personal information of our employees, customers, clients, business partners, etc., must be managed so as to meet the following PIPEDA requirements:

  • All personal information in our possession or custody must be protected in an appropriate manner.
  • Individuals must be informed as to why personal information is being collected.
  • Consent must be obtained for the collection of information.
  • The consent of an individual is only valid if it is reasonable to expect that the individual understands the nature, purpose, and consequences of the collection, use, or disclosure of the personal information.
  • Personal information may only be collected without consent if:
    • The collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;
    • It was produced by the individual in the course of their employment, business, or profession, and the collection is consistent with the purposes for which the information was provided;
    • The collection is made for the purpose of making a disclosure; or
    • Any other reason as defined in PIPEDA’s section 7. (1).
  • Individuals have the right to withdraw their consent.
  • Personal information collected is only collected, used, or disclosed for purposes that a reasonable person would consider appropriate in the circumstances.
  • Personal information is used only for the purposes for which it was collected, except with the consent of the individual or as required by law.
  • Personal information is retained only for the period of time that it is reasonably required.
  • Personal information is destroyed that is no longer required using a safe, secure, and effective manner (e.g., shredding).
  • All personal information collected is accurate.
  • Individuals are allowed to gain access to their personal information, and make corrections as appropriate.
  • Appropriate security and safeguards are employed for the protection of personal information.
  • Access to personal information is limited to authorized personnel who have a legitimate need to access the information.
  • Consent must generally be obtained prior to the release of personal information to any third party.
  • Consent to disclose personal information to a third party is not required if:
    • We have reasonable grounds to believe that the information could be useful in the investigation of a contravention of the laws of Canada, a province/territory, or a foreign jurisdiction, and the information is used for the purpose of investigating that contravention;
    • It is used for the purpose of acting in respect to an emergency that threatens the life, health, or security of an individual;
    • The information was produced by the individual in the course of their employment, business, or profession, and the use is consistent with the purposes for which the information was produced; or
    • Any other circumstances as defined in PIPEDA’s section 7. (2) are met.
  • The forms of information being collected must be identified and communicated to the individual as well as the rationale for the collection of these forms of information.
  • Individuals must be notified and consent must be obtained prior to using personal information for any reason other than those provided at the time of collection.

 

In addition to the above requirements, we will designate a representative to hold accountability for the organization’s compliance with PIPEDA. The representative will hold responsibility for the management of the personal information policies and procedures of EDPRO Energy Group Inc., SLEEGERS Engineered Products Inc., P38 Inc..

 

The primary representative shall be Fay Rody, Chief Financial Officer (CFO), and in her absence Dan Granger, Director.

 

The PIPEDA representative shall be responsible for:

  • Developing and implementing policies and practices under PIPEDA including:
  • Procedures that address the collection, use, retention, destruction, and management of personal information;
  • Procedures for protecting personal information;
  • Procedures for complaints and inquiries; and
  • Staff training on PIPEDA obligations.
  • Employing privacy agreements/contracts to ensure the protection of personal information where the information must be provided to a third party.
  • Reviewing policies, practices and procedures on an annual basis, or as needed, making appropriate revisions.

 

Breaches of Security Safeguards

Reporting Breaches

If the company becomes aware of a breach of our security safeguards that compromises the privacy of the personal information retained by the company, the following action shall be taken:

  • Fay Rody, CFO, is responsible for coordinating the response to the breach and ensuring that all reasonable action is taken to address the breach.
  • Fay Rody, CFO, will notify the Privacy Commissioner of the breach in the prescribed form and manner as soon as feasible once the company has determined that a breach has occurred.
  • The company will comply to the greatest extent possible and in a timely manner with any requests, orders, or other instructions from the Office of the Privacy Commissioner in order to respond to and address the security breach.
  • The company shall maintain records of every breach of security safeguards, and will provide the Privacy Commissioner with access to, or a copy of, a record of a breach, at the request of the Commissioner.

 

Notifying Affected Individuals

 

Determining Whether a Real Risk of Significant Harm Exists

The company will assess the following factors when determining whether a security breach constitutes a real risk of significant harm to an individual or individuals:

  • The sensitivity of the personal information involved in the breach;
  • The probability that the personal information has been, is being, or will be misused; and
  • Any other prescribed factor.

 

Notifications

Fay Rody, CFO, is responsible for ensuring that all individuals affected by the breach for whom the breach creates a real risk of significant harm are notified at the earliest available opportunity, subject to any legal restrictions. Notifications shall:

  • Contain sufficient information to allow the individual to understand the significance to them of the breach and to take steps, if any are possible, to reduce the risk of harm from it or to mitigate that harm.
  • Contain any other prescribed information.
  • Be conspicuous and given directly or indirectly to the individual in the prescribed form and manner as legislatively required as the situation dictates.
  • Be given as soon as feasible after the organization determines that the breach has occurred.

 

In addition to the individual(s) affected by the breach, we may notify other parties of the breach or disclose personal information relating to the breach, subject to the following guidelines:

  • The company shall notify other organizations, government institutions, or part(s) of government institutions if it is believed that doing so can reduce or mitigate the harm from the breach.
  • The company may disclose personal information without the knowledge or consent of the individual if:
    • The disclosure is made to the other organization, the government institution, or the part of a government institution, that was notified under the breach; and
    • The disclosure is made solely for the purpose of reducing the risk of harm to the individual that could result from the breach or mitigating that harm.