This privacy policy (the “Policy”) is evolving and subject to change. Blue Bridge Trust Company Inc. ("Blue Bridge") reserves the right to make changes to this Policy to best meet its evolving needs.
Please note that the masculine gender is used solely for the sake of brevity; it includes both men and women. In addition, the singular includes the plural, and vice versa, unless the context indicates otherwise.
PURPOSE OF THE POLICY
Blue Bridge attaches the utmost importance to protecting the personal information of its current, former or future customers and employees, as the case may be (“you”). Accordingly, Blue Bridge wishes to ensure the accuracy, security and confidentiality of such personal information, in compliance with the laws, regulations and principal guides and guidelines applicable in this regard in Quebec and Canada (the “Applicable Law“), where the head office of the Blue Bridge is located. In the event that the European Regulation on the Protection of Personal Data (the “GDPR”) applies to the processing of certain personal information carried out by the Blue Bridge, such processing is carried out in compliance with the GDPR.
This Policy describes how Blue Bridge collects, processes, uses, stores and discloses personal information. It applies to all Blue Bridge divisions and affiliates in Canada and abroad, to the extent permitted by Applicable Law. Accordingly, any reference to Blue Bridge is also a reference to each and every entity within the Blue Bridge group, unless the context otherwise requires.
1. INTERPRETATION
Personal information is any information about a natural person that, either alone or in combination with other available information, makes it possible to identify that person.
2. RESPONSIBILITY FOR PERSONAL INFORMATION
Blue Bridge is responsible for personal information under its control, including personal information disclosed to third parties for processing and administrative purposes.
Under the GDPR, Blue Bridge is the controller of personal information subject to the GDPR for all processing carried out by Blue Bridge or its affiliates.
Under the Loi sur le Protection des renseignements personnels dans le secteur privé (the “LPRPSP”), Blue Bridge has delegated its role as Privacy Officer (“Responsable PRP”) to the Legal Affairs and Human Resources Department of an affiliate company. The PRP Officer is responsible for the application of this Policy within Blue Bridge and shall, in particular, ensure that the following tasks are carried out:
(i) Approve personal information policies and practices to be established and implemented by Blue Bridge;
(ii) Where applicable, participate in Privacy Impact Assessments (“PIAs”) relating to certain information or electronic service delivery systems and suggest measures to ensure the protection of personal information processed under such systems;
(iii) To record any communication (made without consent) to a company or public body that may reduce the harm caused by a privacy incident and to take part in the assessment of the harm caused by a privacy incident;
(iv) Receive and respond to requests for access and correction as well as requests relating to data portability and the right to be forgotten;
(v) Process any other request for the exercise of individual rights provided for by applicable legislation.
Contact details for the PRP Manager are given in section 11 of this Policy.
3. CONSENT TO COLLECTION, USE AND DISCLOSURE OF PERSONAL INFORMATION
Blue Bridge will not collect, use or disclose an individual's personal information without the individual's knowledge and consent, except as permitted or required by Applicable Law. By providing Blue Bridge with personal information, you authorize Blue Bridge to collect, use and disclose your personal information in accordance with this Policy and specifically for the purposes identified or implied in this Policy or at the time of collection, as applicable. Blue Bridge will seek your further consent before using your personal information for purposes other than those for which you originally consented.
In particular, you consent to the use and disclosure of your personal information by or to any divisions, subsidiaries or other affiliates of Blue Bridge, which are also subject to this Policy. Finally, you may change or withdraw your consent at any time, subject to applicable legal restrictions and contractual terms, and reasonable notice. However, without consent, Blue Bridge may not be able to provide or continue to provide some of the Services, if any.
4. COLLECTION AND USE OF PERSONAL INFORMATION
a. GENERAL PRINCIPLES AND EXAMPLES OF INFORMATION COLLECTED
Blue Bridge always collects personal information by lawful means. Where possible and appropriate, Blue Bridge collects Personal Information directly from the individual and with his or her consent, but Blue Bridge may collect and use Personal Information about an individual from a third party when authorized by the individual or by Applicable Law. In particular, Blue Bridge may obtain information about you from sources such as financial institutions, insurance companies, government agencies or registries, accountants or other professional advisors and credit bureaus, with your consent. In all cases, Blue Bridge's collection of personal information is limited to that which is necessary for the purposes identified or implied in this Policy or at the time of collection.
The personal information collected by Blue Bridge includes, but is not limited to, name, home or business address, home or business telephone number, home or business e-mail address, financial information, billing and account information, and any other information necessary to provide the best advice and services based on customer requests, to establish, maintain and manage an employment relationship, or to fulfill any other purpose identified or implied in this Policy or at the time of collection, as the case may be.
b. PRIVACY IMPACT ASSESSMENT
Blue Bridge conducts a Privacy Impact Assessment (“PIA”) for any acquisition, development or redesign of an information system or electronic service delivery project involving the collection, use, disclosure, retention or destruction of personal information. The PIA is proportionate to the sensitivity of the information concerned, the purpose of its use, its quantity, distribution and medium.
c. PURPOSES OF COLLECTING PERSONAL INFORMATION
Subject to Applicable Law, Blue Bridge will identify and inform you of the purposes for which it collects personal information at or before the time the information is collected.
In the course of its business, Blue Bridge collects personal information, among other things, to administer and operate its business and manage its operations, including the fulfillment of contractual obligations and the audit of its operations; to serve its clients and provide wealth management advisory services, including the administration of client accounts, or other services that clients have agreed to receive from Blue Bridge; to establish, maintain and manage business relationships; to make offers of services; to recruit subcontractors and employees; to maintain the security of its facilities and those of its customers, employees and third parties; to detect and prevent negligence, fraud and theft; to process and respond to requests for information; and to comply with Applicable Law, including customer identification and verification.
Blue Bridge also collects and uses personal information to send a monthly newsletter about the services it offers, to announce special events, to communicate general information of interest, and to send invitations to social events in connection with its activities, all in accordance with applicable law.
With respect to hiring and employment, personal information may be collected by Blue Bridge prior to any hiring for the purpose of conducting a general background check, and upon hiring to comply with legal requirements as an employer. All of this information is kept in the employee's file, along with the documents completed by the employee upon joining Blue Bridge, as described in the Employee Handbook. Blue Bridge may use your information in connection with your employment relationship and for any related legal requirements.
d. BLUE BRIDGE WEBSITE - COOKIES, CONTACT LIST AND MONTHLY NEWSLETTER
Blue Bridge may also collect information from users of its website (https://bluebridge.ca/) by means of cookies or similar technologies, particularly during visits to the website.
Cookies are files that store information on your hard drive or Web browser. This allows a Web site to identify the computer and collect certain information relevant to the connection and navigation of the site (such as the type of browser, IP address and operating system used by a visitor) and, subsequently, to recognize and track that computer on the site, compile usage statistics and establish browsing histories, including domain names and pages visited, e-mails read and other information.
Blue Bridge collects and uses certain data, such as IP addresses, the number of times its Web site is viewed and the viewing habits of site users, to conduct its business, promote its services and track site performance, administer the site more efficiently and improve it as needed.
Unless the browser is configured to block cookies, Blue Bridge's system will store cookies on a user's computer when the user visits Blue Bridge's website. By visiting the Blue Bridge website, you consent to Blue Bridge's use of cookies for the purposes described above.
By completing the subscription form for Blue Bridge communications on the Blue Bridge website, you consent to the processing of the personal data entered during registration by Blue Bridge. The e-mail address or any other personal data you enter on the subscription form will be stored on Blue Bridge's computer servers in Canada and transmitted to the CyberImpact online platform for the following purposes:
- To be added to the Blue Bridge contact list, in order to receive communications relating to events, activities or training courses;
- To join the Blue Bridge monthly newsletter mailing list.
You may remove yourself from the contact list or unsubscribe from the monthly newsletter at any time.
5. DISCLOSURE OF PERSONAL INFORMATION
Blue Bridge uses and discloses personal information only for the purposes for which it was collected, except with the required consent or in accordance with Applicable Law. Blue Bridge further undertakes to limit disclosure of and access to personal information to only those persons who require such information for the purposes for which it was collected. Blue Bridge will only disclose your personal information to third parties for the purposes identified or implied in this Policy or at the time of collection, with your express consent or as otherwise required or permitted by Applicable Law. In particular, Blue Bridge may share personal information with trusted third parties to:
- Provide one or more of the services offered by Blue Bridge;
- Establish, maintain and manage the relationship between you and Blue Bridge (including managing any employment relationship between you and Blue Bridge and related legal obligations, as applicable);
- Confirm or update information previously provided;
- Sending postal mail and e-mail to communicate with you as an employee or customer of Blue Bridge, as applicable. This may also include communications containing information about Blue Bridge products and services, events or other important matters, upon your request or consent to receive communications for this purpose;
- To provide customer service and marketing services;
- For any purpose identified in this Policy and any other purpose identified by Blue Bridge, at or before the time the information is collected;
In accordance with its Policy, Blue Bridge will ensure that third parties with whom it does business and to whom it provides personal or confidential information also guarantee, in at least an equivalent manner to Blue Bridge, that all technical and organizational measures ensuring the confidentiality, security and integrity of the information they hold on behalf of Blue Bridge have been taken.
a. SUB-CONTRACTORS
Where Blue Bridge outsources or delegates the processing of personal information to third-party providers (“Subcontractors”), on its behalf, it will ensure that it does so in accordance with Applicable Law and, where applicable, the GDPR.
In addition, where an outsourcing project involves the acquisition, development or redesign of an information system or electronic service delivery involving the collection, use, disclosure, retention or destruction of personal information by a Subcontractor on behalf of Blue Bridge, Blue Bridge will conduct a PIA.
The processing of personal information by a Subcontractor is subject to a written agreement that includes the measures the Subcontractor must take to ensure:
- the protection of the confidentiality of the personal information provided by Blue Bridge;
- this information is used only for the purpose of performing the contract;
- that the Subcontractor does not retain personal information after the contract has expired, unless otherwise required by law or regulation.
The categories of Subcontractors are as follows:
- Entities of the Blue Bridge group.
- Suppliers and service providers: infrastructure and IT service providers, finance, accounting and tax service providers, auditors, consultants who provide Blue Bridge with marketing support, and external providers or sites where Blue Bridge hosts conferences, events or other meetings. Your personal information will only be transferred for the purpose of carrying out specific tasks or functions entrusted by Blue Bridge to these recipients and in accordance with Blue Bridge's instructions, in particular in order to fulfil the purposes described in Article 5.2. Blue Bridge requires such Subcontractors to provide reasonable security to ensure the confidentiality of the personal information communicated to it, including against any unauthorized access or use of such personal information, as well as against the accidental loss or deletion of such information. In addition, access to customer data is strictly limited, and the strictest confidentiality is applied to such data in compliance with the professional rules applicable to Blue Bridge and its group entities.
- Financial institutions: banks, custodian banks, investment funds, fund managers. Personal information is only transmitted for banking, accounting and payment purposes and/or to the extent necessary to provide our services to our customers.
b. INTERNATIONAL COMMUNICATIONS AND HOSTING
Personal information collected by Blue Bridge may pass through servers outside Quebec and Canada, be transmitted to a destination outside Quebec and Canada and be stored there. This information may also be processed by personnel working outside Quebec and Canada for Blue Bridge, its partners or suppliers. Please note that where the processing of personal information is outsourced to a company in another country, such information may be made available to the government of that country or its agencies pursuant to a legal order issued in that country. By submitting personal information, you consent to the transfer, storage and processing activities described herein.
In all cases, we will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Policy and Applicable Law.
To this end, any transfer of personal information outside Quebec will first be subject to a PIA by Blue Bridge, which takes into account the following factors:
- the sensitivity of the information
- the purpose for which the information will be used
- the safeguards, including contractual safeguards, that will apply, and
- the legal regime applicable in the receiving country, in particular the privacy principles applicable there.
6. STORAGE OF PERSONAL INFORMATION
Personal information is kept in secure locations and on servers controlled by Blue Bridge at its offices in Montreal, or at the offices of Blue Bridge's service providers, which are also committed to the security, integrity and confidentiality of the information entrusted to them, as set out in this Policy.
Blue Bridge retains personal information as long as it is reasonably required for the purposes for which it was collected or in accordance with Applicable Law and Blue Bridge's Document Management Policy.
7. PROTECTION OF PERSONAL INFORMATION
Blue Bridge uses administrative, technological, physical and organizational security measures appropriate to the sensitivity of the personal information and, in all cases, required under the circumstances, in order to protect access to it and to guarantee its security, integrity and confidentiality at all times.
In particular, Blue Bridge has implemented policies and procedures to protect personal information against loss, unauthorized access, modification or disclosure. In addition, its premises are secure, and Blue Bridge has implemented technological safeguards such as security software, passwords and firewalls to prevent unauthorized access to computers. Blue Bridge uses industry-standard network technologies and password protection systems, and collaborates with specialized IT security partners to ensure compliance and anticipate the evolution of these technologies.
However, while Blue Bridge takes all measures reasonably necessary to ensure that Personal Information is treated securely and in accordance with this Policy, there is no method of transmitting or storing information that is foolproof. Accordingly, Blue Bridge cannot guarantee the security, confidentiality and integrity of the information in its possession. Similarly, Blue Bridge cannot fully guarantee the security and confidentiality of electronic communications. In addition, to the extent that you consent to receive electronic communications from Blue Bridge, you also consent that such communications may be unencrypted.
In the event of confidentiality incidents (as this term is defined by the LPRPSP), the Confidentiality Incident Response Procedure will be applied.
8. ACCESS TO PERSONAL INFORMATION
Subject to Applicable Law, upon an individual's request submitted in writing in accordance with Section 11, the PRP Manager will inform the individual whether Blue Bridge holds personal information about him or her and will provide, as applicable, a summary of the use that has been or is being made of the information, inform the individual of the identity of third parties to whom it may have disclosed personal information about him or her and the purposes for which such information is transmitted to the third party, if applicable. Specific requirements under the GDPR remain reserved.
The PRP Manager will acknowledge receipt of the request in writing and may request confirmation of identity before providing any information. In principle, access to information will be provided free of charge, but, if the request requires a copy or transmission of documents, the PRP Manager may charge a reasonable fee by informing of the amount in advance and giving the opportunity to withdraw the request. The PRP Manager will provide access to information within 30 days of receipt of the request or will provide written notice that additional time is required to respond to the request.
Blue Bridge may refuse access to its information in accordance with Applicable Law, in which case Blue Bridge will notify you in writing, provide you with an explanation of the reason for its refusal and advise you of other available remedies.
Notwithstanding the foregoing, for Blue Bridge employees, access to the file will be in accordance with the procedure described in the Employee Manual provided to you upon hiring.
9. ACCURACY, UPDATES AND REQUESTS FOR CORRECTIONS TO PERSONAL INFORMATION
Blue Bridge uses reasonable efforts to ensure that the personal information collected is as accurate and complete as is necessary for the purposes for which it is used. If the information you have provided to us changes, or if you become aware of an inaccuracy in the context of the access process set out in Section 9, please contact the PRP Manager in accordance with Section 11 (or in accordance with the procedure described in the Employee Handbook if you are an employee). When the GDPR applies to Blue Bridge’s processing of your personal information, you have the following specific rights: right of access, right of rectification, right to erasure, right to restriction of processing, right to object, right to data portability, right to lodge a complaint with the competent authority.
10. MODIFICATIONS AND UPDATES TO THE POLICY
In the event that Blue Bridge modifies this Policy, it will post the changes on its website and notify its employees and customers in writing. By continuing to provide your personal information, or by using Blue Bridge’s services or the website, you consent to the Policy in its then current version. The Policy will be reviewed periodically to ensure that it remains compliant with Applicable Law and that it is always exercised in the best interest of Blue Bridge, its employees and its customers.
11. CONTACT INFORMATION
For any questions regarding this Policy or Blue Bridge’s personal information management practices, to access or rectify personal information, to modify or withdraw any consent regarding the use or disclosure of personal information, to no longer receive electronic communications from us, to file a complaint, or to otherwise exercise your rights regarding the protection of personal information and privacy, please contact our PRP Manager in writing at the following address: dataprotection@bluebridge.ca.