Accounts

Preface
Canadian Manufacturers & Exporters (referred to as "CME") is committed to keeping the personal information of its members, contacts, employees, and associates accurate, confidential, secure and private. Our Privacy Policy has been designed to inform employees, members, and third parties of CME of our commitment and recognition to our obligation to meet the spirit and terms of the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Compliance with this policy is mandatory; breaches are considered serious and will be dealt with accordingly.

Contents
Our Privacy Policy describes the principles by which CME protects the privacy of personal information in its possession. It addresses the reasons why such information is collected, how it is used, how its confidentiality is protected and outlines the rights in respect of this information. Our Privacy Policy incorporates and expands on the 10 principles for the protection of personal information, as devised by the Canadian Standards Association (CSA). The Privacy Policy applies to personal information about members, employees and other individuals that is collected, used or disclosed by CME.

Personal Information Protection Principles

1. Accountability
CME is accountable for the protection of all personal information within the organization's possession or control, including any personal information that has been transferred to a third party for regulatory, legal or processing purposes. CME will require a comparable level of protection of this information from its third party relations. CME management has overall responsibility for our protection of personal information and for compliance with this Privacy Policy.

2. Identifying Purposes
Personal information that CME collects includes:

• Names and addresses and other contact information, such as telephone numbers, email address and home address;
• Credit card information;
• Facts about members and their contacts;
• Employee birthdates, C.V., payroll and SIN information
• information about transactions with us, such as account numbers, account balances, payment history;
• credit and reference information, such as date of birth, employment information,
• drivers license, previous addresses, and general financial information;
• emergency contact information; and
• Bank information for pre-authorized payments.

When an individual provides information, CME will make the individual aware of the purposes for which CME is requesting the personal information. CME does not collect information in its database for the purpose of selling that information. If CME identifies other purposes for which the personal information may be used, CME will seek the individual's consent prior to such use. CME will advise that it is the individual's right to refuse permission for CME to use personal information for any new purposes.

Additional purposes for collecting personal information may be identified to an individual before or at the time of collection. However, at a minimum CME will collect personal information for the following purposes:

• To verify identity;
• For inclusion in CME's contact database;
• For employment or contractual purposes;
• For pre-authorized payments;
• To credit the correct account;
• To prevent fraud;
• To meet legal, regulatory and settlement requirements.

3. Consent
The knowledge and consent of an individual are generally required for the collection, use or disclosure of personal information and CME will seek to obtain consent before or when it collects, uses or discloses personal information about an individual. An individual can provide consent to the collection, use and disclosure of personal information about them expressly or implicitly. However, CME will collect, use or disclose personal information without an individual's knowledge and consent only in limited circumstances and as permitted by law, such as in the case of an emergency where the life, health or security of an individual is threatened. Subject to certain legal and contractual restrictions and reasonable notice, an individual can refuse or withdraw their consent to the collection, use or disclosure of personal information about them at any time.

4. Limiting Collection
CME limits the amount and type of personal information it collects to that which is necessary for the business of the association and as permitted by law. Each affiliate of CME will be responsible for its own collection, use and disclosure of information. Personal Information will be collected using procedures that are fair, transparent and lawful.

5. Limiting Use, Disclosure and Retention
CME will only use the personal information for the purpose for which it was collected as identified in principle #2, unless consent is given by the individual to use or disclose it for another purpose or as is required by law. CME will develop explicit retention periods for historical information, after which the personal information will be destroyed or made anonymous.

Under certain exceptional circumstances, CME may have a legal duty or right to disclose personal information without the individual's knowledge or consent.

6. Accuracy
CME shall take all reasonable steps to ensure that all personal information will be kept accurate, complete and up to date. Individuals may challenge the accuracy and completeness of personal information about them and have it amended, as appropriate.

7. Safeguards
In executing its responsibilities with respect to the confidentiality of personal information, CME will employ a number of safeguards, appropriate to the sensitivity of the information, to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Such safeguards will include physical measures, organizational measures and technological measures, for example locked filing cabinets, restricted access to offices, security clearances, limiting access on a "need to know" basis and the use of passwords and encryption. Procedures for implementing these measures will be communicated to all employees and third parties to ensure compliance with this principle.

8. Openness
CME will make its policies and practices relating to the protection of personal information available as required. The information will be available in a format that is easy to understand.

9. Individual Access
Any individual contact of CME can have access to the personal information about them that CME has in its possession or control. Any individual may request that their personal information be amended for purposes of accuracy and completeness.

These requests can be made through e-mail at cme.privacy@cme-mec.ca or through CME's HR department for items related to staff and employees. Response to an individual's request will be made in a timely and efficient manner.

10. Challenging Compliance
Any contact of CME may challenge CME's compliance with this Privacy Policy by contacting CME directly.

CME has policies and procedures to receive, investigate and respond to individuals' complaints and questions.