Privacy Policy

“Personal information” is any information about you which, either on its own or in combination with other information, could be used to identify, contact or locate you, or could be linked to your personal identity.

We collect and use personal information to establish and manage our relationship with you. Depending on the products and services you use, the personal information we collect can include:

• Contact information such as your name, residential addresses, title, phone number, email address – we use this to communicate with you.
• Identity information such as your date of birth, gender, social insurance number, copies of government identification documents (such as driver’s licence or passport), copies of proof of address (e.g. utility bills), and information about other financial accounts – we use this to establish and verify your identity.
• Location Information, specifically your Internet Protocol (IP) address – we use this to confirm you are located in a location in which we are permitted to provide services (i.e. Canada.)  
• Biometric information such as measurements or characteristics about your physical or behavioral traits, including but not limited to, your facial features, voice patterns, fingerprints and pattern movements – we use this to verify your identity or to protect your account via external service providers. 
• Information about your creditworthiness such as current and past employment, income, assets and liabilities – we use this to assess eligibility for credit-related products and services. Your employment history would also be used to assess your suitability as a candidate for employment.
• Financial information – such as your banking information, accounts and tax status – we use this to assess your needs and suitability as a customer.
• Information about how you use our products and services – such as information about your purchases including transaction amounts and the source, amount, and destination of payments, withdrawals, or fund transfers – we use this to provide these products and services to you, to protect us and your account (by spotting unusual activity), and to notify you about changes that will impact your products and services. We also use this to provide you with personalized products and services, to better understand your needs and preferences (including through data analytics), to personalize your experience on our websites and mobile applications, and to provide you with tailored communications and offers.
• Information about another individual – if you have a joint account or a legal guardian or personal representative, we will also collect personal information about those individuals. Candidates for employment may be requested to provide details of their references, including names and contact details.
• Information recorded as you progress through the employment application process – if you are applying for a role with us, we may collect  information on your qualifications (e.g. your curriculum vitae (CV), cover letter and academic history) and personal circumstances (e.g. notice period, reason for applying, employment preferences, desired salary/location, availability for interviews, adjustments required, immigration status and results of background checks) – we use this information to effectively manage and administer all aspects of our recruitment process including to maintain our compliance with all relevant legal, regulatory and contractual requirements.

We collect information from a variety of resources – and may be limited in our ability to provide you with certain products and services if you decline to provide us with information essential to fulfill your request. Candidates for employment that choose not to provide all requested information or do not consent to its collection and use may not be able to continue with their application process.

Sources of personal information include:

• Directly from you: We receive some of the personal information we collect about you directly from you. For example, if you apply for one of our services or communicate with us, you are providing us with your personal information.
• From third parties: In some cases, we may collect information from third parties outside Peoples Group, including:
  • other lenders and financial institutions where you have accounts;
  • credit bureaus, credit reporting agencies, and credit insurers;
  • persons authorized to act on your behalf under a power of attorney or other legal authority;
  • service providers, including technology service providers, agents, and other organizations with whom you or we conduct business;
  • for products or services offered as ‘Banking as a Service’ (BaaS), we receive information such as your name, contact information, date of birth, social insurance number, information to verify your identity, other information you supply with your application, and information about your transactions and use of the financial products, from the third party we work with to offer these products and services.
  • government agencies, public registries, and information available from open sources (for example, an Internet search).
  • for candidates for employment – from the references you provide to us and via background checks we do in order to determine your suitability for a role.

Peoples Group collects your personal information to manage our relationship with you and to consistently deliver high-quality products and services. Here are some examples of why we collect personal information and how we use it:

• to verify your identity, including to meet our ‘know your client’, anti-money laundering, and sanctions obligations.
• to evaluate and process your application for an account or credit limit, including determining your eligibility;
• to obtain your credit report.
• to communicate with you about your financial products and services.
• to open and maintain your account in accordance with your agreement(s) with us, including to accept deposits, and to process transactions such as payments, withdrawals and transfers of funds, to log your debit and credit transactions accurately, and that a history of each transaction is available to verify your account.
• to make changes you request to your account.
• to process and keep track of transactions and report back to you.
• to detect, prevent and protect you, us, and others from theft, fraud and error.
• to analyze information to determine what relevant products and services are offered to you – if an automatic decision system is used to determine your eligibility for a product or service, you will be notified separately of this at the time of the decision together with your rights relating to the decision.
• to provide you with products and services, or information about products and services, that have been requested by you and/or that Peoples Group believes may be of interest to you and provide value to you.
• to inform you about new business initiatives including contacting you to obtain your views and to encourage you to express your views about them.
• to offer you the opportunity to participate in contests, giveaways or other promotions.
• to conduct research and generate statistics related to our business, products and services.
• for business purposes, such as data analysis, audits, developing new products, enhancing, improving or modifying our services, identifying usage trends, determining the effectiveness of our promotional campaigns, and operating and expanding our business activities.
• to help manage and assess our risks, operations, and relationship with you.
• to obtain and maintain insurance coverage.
• to comply with legal and governmental requirements.
• to fulfill any other purpose for which you provide it or with your consent.
• if you hold a product that generates income, and we have your social insurance number (SIN), we may use it for tax reporting purposes and share income information with the relevant revenue service agencies. With consent, we may also use your SIN to match your personal information and your credit bureau information, or as an internal identification number to accurately identify customers having the same or similar names.
• to determine your suitability for employment with us in relation to either a role you have directly applied for, or alternatively a role you have not applied for but based on a previous application we have determined you may be interested in.

We may share your personal information in the following ways:

• With other Peoples Group companies: To assist us with offering the best services to you, we may share your personal information with our other companies and respective affiliates.  
• With our employees: While performing their duties, our authorized employees may have access to personal information and other confidential information.  Employees may only access personal information strictly necessary to perform their duties.  All employees that are likely to have access to personal information must sign a Code of Ethics under which they commit to maintaining its confidentiality.  
• With third-party product and service providers: We may disclose personal information to certain third-party product and service providers, to assist in providing you with products and services, or to perform certain specialized services to assist us in our business. These providers can include: deposit-taking agents, credit reporting agencies, background check agencies, marketing partners, debt collection agents, account statement providers, your mortgage broker or originator, financial institutions, and others involved in the clearing and settlement of transactions, fraud prevention, regulatory compliance assistance, identification and verification services and secured data management and storage.
  • We only disclose to these providers the specific information they require to perform their services. Before we release any personal information to them, each of our providers must undertake to use the information solely to carry out the services they have been retained to provide and must agree to safeguard and respect the confidentiality of the information.
  • When we use these providers, we may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country.
• If you are receiving products and services through our BaaS offering, with your BaaS provider: We receive information about you from that provider and use it in connection with those products or services. In addition, you should be aware that:
  • This information is received by the BaaS Provider to allow them to carry out servicing of your account, such as identification and client verification, to communicate with you regarding your account, debit or credit your accounts appropriately, to present accurate account information to you, and to conduct such other activities as may be described in your account agreement with your BaaS provider.
  • These parties are independent from us, and we do not control all manners in which they may process your personal information. In addition to servicing your account, they may also process your personal information under their own privacy policies, any consent you have provided to them, and for other products or services they provide to you. We do not control and are not responsible for their actions.
  • You have an independent relationship with the BaaS Provider, and you should read their privacy policy, as well as ours, to understand how they may process your personal information. If you have any questions or concerns regarding how the BaaS provider processes your personal information, you should contact them directly.
    

• With the Canada Deposit Insurance Corporation: We may share information about eligible accounts and customers as required with the Canada Deposit Insurance Corporation to obtain insurance for eligible deposits.
• With references that you have provided to us: We may share information about you, with employment references (e.g. current or past employers) you have provided to us to support an application for an employment position with us.
• As Required by Law: In certain instances, we may be required or permitted to disclose information about you in response to a legally valid demand, inquiry, proceeding, or other order, or for the purposes of investigating a breach of an agreement or contravention of law or to detect, suppress, or prevent fraud. We reserve the right to comply with any valid third-party demand (such as Requirements to Pay and Requests for Information) issued under federal or provincial legislation, or any court or regulatory order we receive, in respect of your accounts or any information we hold about you.  You agree that we will not be liable to you in any way for complying with any such third-party demands or court orders issued on or against your accounts or products. In these cases, we take steps to assess if the request is valid and we only disclose the specific information necessary to satisfy the inquiry or order.
• Transfers of Business: As we continue to grow, we may expand or sell our businesses or part of it. In such a case, the personal information we hold may be among the assets transferred. 
• Additional Disclosures: We may also disclose personal information:
  • with your consent.
  • to a person sharing a joint account with you, in so far as it relates to the account.
  • to help us collect a debt or enforce an obligation owed to us by you.
  • if required or permitted by law.
  • to credit reporting agencies (and similar service providers) to maintain your credit history and/or to facilitate the improvement of predictions on the basis of which credit may be provided (note- if you fail to meet your obligations to us, we may a file a negative report, and your credit score may suffer).
  • to other lenders or financial institutions to provide you with the services.

The personal information you provide to us is primarily stored on servers in Canada where Canadian privacy laws apply. However, we maintain secondary disaster data back-ups on computer systems that may be located outside of Canada.

Peoples will confirm that in such cases where other (i.e. non-Canadian) privacy laws apply, safeguards comparable to those required in Canada will be applied to your personal information. 

Information we collect in Quebec, will be communicated outside of Quebec. We assess privacy risks and take measures to ensure that your personal information is protected and kept confidential when it is transferred outside of Quebec and Canada or when we introduce or materially change our systems that process personal information.

Personal information collected by us under our Privacy Policy may be stored, by us or our service providers, and whether as part of our secondary disaster data back-up or otherwise, on out-of-country systems, including in the United States of America, the European Union, India, Pakistan, Colombia or the Philippines and therefore may be subject to disclosure under the laws of the jurisdictions where such personal information data is stored.

In these circumstances, the governments, courts, law enforcement, or regulatory agencies of other countries may be able to obtain access to your personal information through the laws of the foreign country. Peoples Group will disclose personal information as required by law.

We protect your personal information with a variety of security measures, which may vary based on the information being processed. These include:

• physical security measures such as restricted access facilities and locked filing cabinets.
• shredding of documents containing personal information.
• electronic security measures for computerized personal information such as password protection, database encryption, and personal identification numbers.
• organizational processes such as limiting access to your personal information to a selected group of individuals.
• requiring third parties given access to your personal information to protect, secure and appropriately dispose your personal information.

The safeguards employed by us to protect your personal information depend on the sensitivity, amount, distribution, format, and storage of the personal information.

Although technologies can make it easier for fraud to occur, we employ around-the-clock monitoring systems and controls to help detect and prevent fraudulent activity. We also build fraud prevention measures into our due diligence processes and regularly update our fraud detection/prevention methods.

While we take precautions to help protect your personal information from loss, theft, alteration, or misuse, no system or security measure is completely secure. Any transmission of your personal information is at your own risk and we expect that you will use appropriate measures to protect your own personal information.

In addition to the steps we take to safeguard your personal information, we believe there are measures you should take to protect yourself, such as:

• Not sharing any personal or financial information with others unless you clearly understand the purpose of them requesting the information and you have confirmed you are dealing with a legitimate contact.
• Not sharing any significant personal or financial information via email or voicemail.

Using Email to communicate with us

If you choose to communicate with us electronically, we strongly recommend that you use our Contact Us feature, or for candidates for employment our Careers portal. These features provides channels for sending us comments, questions or instructions that are more secure than email.

Generally, email is not secure since it passes through many points on its route from you to us. If you are using email to communicate with us, we strongly recommend that you do not include personal financial information (such as account numbers or passwords) within the email as we cannot guarantee its confidentiality en route to us.

Canada’s Anti-Spam Legislation (“CASL”)

Peoples Group complies with CASL and we are committed to making sure you only receive the email communications that you want from us. Peoples Group will not send you unsolicited emails in connection with the marketing of Peoples Group, its services or products. We may occasionally contact you to notify you about updates to the Website or new products or services offered by us or to deliver targeted information that may be of interest to you,  when we have your consent to do so. No matter how you join our list or provide us with your consent to receive communications, at the bottom of all our commercial emails, you will find a clear, easy way to amend consent or unsubscribe.

Monitoring of telephone calls

Peoples Group may monitor and/or record in-bound and out-bound telephone calls for training and quality assurance purposes, to detect and prevent fraud or other losses, and to enforce our contracts.

Keeping your information up to date

Keeping your personal information up to date and accurate helps us to serve you better. You can assist us by updating your personal information (e.g. change of address or telephone number) when it changes by contacting us – see section below “11. How to Contact Us”. 

For candidates for employment, updates to your information can be made directly through the Careers portal. Alternatively, you may request details of or amendments to your personal information by contacting [email protected].

If you are receiving products and services through our Banking as a Service offering, your can update your personal information directly with your service provider.

Access and rectification

You can request access to your personal information kept by Peoples Group at any time – see “How to Contact Us” section below.  You may request any of the following:

• What types of personal information we have on record or in our control, how it is used and to whom it may have been disclosed.
• Reasonable access to your personal information so you can review and verify its accuracy and completeness.
• Updates or corrections to your personal information. Peoples Group reserves the right to decline to make a requested correction where the accuracy of the change is in question but will append a notation to the record of your requested alternative information.

Your request is subject to applicable exceptions under Privacy Laws, such as where the information requested includes the personal information of another person. For your protection, we may require you to confirm your identity before providing access to your personal information.

Your request must be made in writing and provide us with sufficient detail to enable us, with reasonable effort, to identify you and your personal information.  We will inform you within thirty days what personal information we have, how we collected it, how we used it, and to whom it has been disclosed.  If we need to extend the time, or we must refuse your request, we will tell you why, subject to any legal restrictions, and will notify you of the new deadline, the reason for the extension, and of your right to contact the federal or provincial privacy commissioner applicable in your jurisdiction.

You will not be charged a service fee for these requests, however, we may seek to recover costs incurred (for example, photocopying costs). You will be notified and asked to agree to such charges in advance of us incurring necessary costs.

For deceased individuals, their close family members and other interested parties may have the right to make a written request for access which Peoples will also consider in line with Privacy Laws. 

Limiting or withdrawing consent

You may choose to restrict the collection or use of your personal information in the following ways:

• You may write to or email us using the contact information below to withdraw your consent to us using your personal information for purposes other than those that are required to provide our services (for example, direct marketing purposes).
• If you receive commercial email from us, you can also unsubscribe using the unsubscribe tool we provide in such messages.

Please note that if you seek to withdraw consent to our collecting and processing information that we must process to provide our services, we may not be able to provide those services to you. For example, you cannot withdraw consent to ongoing collection, use and disclosure of personal information needed in connection with administering a loan product you have purchased. Similarly, you may not be able to withdraw consent for us to collect, use or disclose information we need for regulatory purposes.

If you cancel your services or products with us, we will consider this to be a withdrawal of your consent for us to collect, use and disclose your personal information and we will anonymize or delete it on completion of the relevant retention period.

General Data Protection Regulation (GDPR) – Applicable to European Economic Area (EEA) residents only

Under the GDPR, EEA residents, have certain data protection rights. As an EEA resident, you have: 

• the right to access your personal information that we hold.
• the right to request the rectification of your personal information that we hold.
• the right to request the erasure of your personal information that we hold.
• the right to request to restrict the processing of your personal information.
• the right to object to the processing of your personal information by us.
• the right to request to transfer your personal information that we hold (i.e., data portability).
• the right to file a complaint to a supervisory authority in your jurisdiction; and
• the right to withdraw consent.

Peoples Group takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information. We have appointed a privacy officer to handle any data questions or concerns.

If you wish to be informed about what personal information we hold about you or if you want it to be removed from our systems, please contact us at [email protected] or refer to the “How to contact us” section below.

Non-personal information is any information that does not reveal your identity or directly relate to you as a person. Non-personal information may also include personal information we have de-identified or aggregated, to the point where it no longer identifies a particular individual.

We may anonymize any personal information (i.e. render it so that it irreversibly no longer allows the person to be identified directly or indirectly) and may use or share that anonymized data with third parties for any purposes we deem appropriate. We may also make certain aggregated non-personal information available to strategic partners and third-party service providers that work with Peoples Group, to provide or support products and services, to conduct data analysis, to develop and improve products and services, and to determine the effectiveness of promotional campaigns. We reserve the right to use and share any non-personal information with third parties for any lawful purpose.

If we ever combine non-personal information with any personal information, we will obtain your consent and treat it as personal information is treated under this Policy. 

Our Online Privacy Policy describes how your personal information is collected, used and disclosed when using or visiting any Peoples Group Website, including the Peoples Group’s Online Banking site, or using any of the online services offered by Peoples Group. If you are using a Banking as a Service provider for your online banking, they will have their own online privacy policy and you should review and understand how they will handle your personal information when you use their services.

To access your Peoples Group online account, including through the Online Banking site, you need to use your personal customer number and password.

a. Controlled Access to your Information

You should be the only person accessing your personal information through the Online Banking site, and so we restrict access to your online account by requiring that you enter your customer number and password to log in. Only you should know your password- do not provide it to anyone else. Our employees will not ask you to reveal it. If someone does ask you to provide your password to them, we ask that you refuse to do so and contact us immediately.

b. Online Banking Transactional Services

Our Online Banking site has many transactional functions, such as transfers between accounts. These transactions are all logged so that your accounts are debited or credited appropriately, and a history of each transaction is available. We store and use your transactional information in the same fashion as if you performed the transaction at a branch or any other service channel.

c. Online Banking Security

To learn more about our security policies, please review our security information.

To provide you with a convenient method for purchasing financial services products, we provide secure online application forms. These forms capture personally identifiable information that we use to provide you with the products and services that you have requested. This information is processed in a similar way to that of application forms received through our other channels, and is used and shared for the purposes described in our Privacy Policy.

Despite these measures, our systems could be compromised by parties seeking unauthorized access to our data or users’ data, by a technological malfunction, or in error by an employee, vendor, or contractor. Also, the transmission of information via the Internet or mobile data networks could be intercepted by third parties. As a result, our efforts to protect our data and users’ data from unauthorized access may be unsuccessful and we cannot assure you that the security measures we have adopted will provide absolute certainty. Any transmission by you is at your own risk. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem by contacting us – see “How to Contact Us” section below.  If we learn of a security systems breach, we will inform you and the appropriate authorities of the occurrence of the breach as required by applicable law.

We also use security processes wherever we transfer or exchange data with third parties.

d. Website, Mobile App and Online Banking Usage Statistics

To continually improve our Website, Mobile App and Online Banking site, we often collect information about how our customers are using it. These usage statistics are only viewed in the aggregate – and are never tied to an individual.

We use this information for purposes such as improving the pages where our customers are having difficulties, having the appropriate infrastructure in place to service future needs, managing, assessing risk, and protecting against theft, fraud, and error.

The information collected may include your general region location as determined by your IP address, your browser type, and your operating system, as well as data that is passively generated as you browse, such as the number and types of pages visited, and the length of time spent per page and on the Website or Online Banking site overall.

When you use our Mobile App for Online Banking, we may also collect certain personal information about the device you use and your location, if you have enabled location-based and other services on your device.

e. Our use of Cookies

We also use a key web technology called cookies. A cookie is a small information token that sits on your computer or mobile device. As you use any financial services offered through Peoples Group Website, including the Online Banking site, cookies are passed back and forth between our server and your browser. While cookies can be used for a variety of reasons, we only use cookies where they are of benefit to our customers.

Specifically, we use two kinds of cookies – session cookies and persistent cookies. A session cookie exists only for the length of your browsing session and is deleted when you close your browser. A persistent cookie is a cookie that stays on your computer or mobile device after you close your browser. A persistent cookie may or may not expire on a given date. We use a session cookie to maintain the integrity of your internet session. With each page that you visit, the cookie is passed back and forth between our server and your browser. We use the cookie to distinguish your session from the many others that may be happening at the same time.

Most recent browser versions allow the user to set some level of control over which cookies are accepted and how your browser uses them. Many browsers will allow you to accept cookies only from known, reliable sites that you select such as the Peoples Group Website or the Online Banking site. If you are concerned about cookies, we encourage you to upgrade your browser to a recent version and review the Help section of your browser to learn more about its specific control features.

f. Memorized Accounts Feature

We may use a persistent cookie to store information to help you personalize your online accounts and to make them easier to use. For example, we allow you to make the Online Banking login easier by remembering your Customer Number and Branch within our Memorized Accounts feature. Since the Memorized Accounts feature is optional, this cookie only contains information that you have entered into it. You should only use the Memorized Accounts feature on devices to which you control access- you should not use it on public or shared devices.

g. Logout Button

To help prevent unauthorized people from accessing your personal information, always exit your online account using the logout button located at the top of every page. When you exit using the logout button, we delete your session cookie so that your session cannot be resumed unless your customer number and password are re-entered.

h. Online Banking Automatic Session Time-outs

If you leave your computer without logging out, the Online Banking site has been designed to end your session automatically if our system detects that you haven’t provided any instructions or used the browser buttons to navigate for several minutes. To restart the session, you will need to provide your password again.

i. Links to Other Sites

Peoples Group websites, including the Online Banking site, may also contain links to other websites or internet resources. As an example, from time to time we may provide links to certain web browsers [https://www.peoplestrust.com/en/legal/browser-requirements/] to assist you in upgrading your internet browser. However, Peoples Group has no responsibility or liability for or control over these other websites or internet resources or their collection, use and disclosure of your personal information. Always review the privacy statements of the sites that you are viewing.

You should be aware that off-site pages or other sites might be available only in English or in other languages. Sachez que les pages qui ne figurent pas sur le site Web du Groupe Peoples ou certains autres sites pourraient n’être disponibles qu’en anglais ou dans d’autres langues.

In this Policy:

“Banking as a Service (BaaS)” means those financial products and services which we offer in association with a third-party provider, such as a financial technology company. Such products and services are branded and offered by the third party; however, Peoples Group enters the financial agreement with you and processes your personal information to carry out that agreement and meet our legal requirements. You have a separate relationship with the third party, which we do not control.

“Online Banking” means the portions of the Website relating to online banking transactions or account access and/or the mobile application software.

“Peoples Group”, “We”, “we”, “Our”, “our” and “us” means Peoples Trust Company and all of its subsidiaries and business operations, including Peoples Bank of Canada (Peoples Bank).

“personal information” means any information, recorded or unrecorded, which, either on its own or in combination with other information, could be used to identify, contact or locate a specific individual.

“PIPEDA” means the Personal Information Protection and Electronic Documents Act.

“Privacy Law(s)” means PIPEDA and any privacy law applicable to the private sector in Canada.

“Website” means the Peoples Group website, including the content, information and services provided on or through the Website and by e-mail, including all online tools, applications, calculators and e-mail alerts.