All MCAN employees and directors of MCAN must comply with this Policy with respect to any Personal Information in the possession or control of MCAN and/or its subsidiaries. References throughout this Policy to “we”, “our”, and “us” refers to MCAN.
MCAN is committed to fairly and lawfully collecting and maintaining accurate personal information and to protecting the confidentiality of all personal information that we collect, retain, use or disclose to others in the course of our business activities.
Protecting Individuals privacy and the confidentiality of personal information has always been fundamental to the way we do business at MCAN. We collect, use, and disclose personal information only in compliance with applicable privacy legislation, and strive to exceed all the privacy standards established by the federal, provincial, and industry authorities in all our dealings with Individuals.
Personal Information means information about an identifiable individual. It includes an individual’s name, residential address and telephone number, e-mail address, age and gender, personal financial records, identification numbers including their social insurance number, personal health information, and personal references.
Some personal information may be considered more sensitive than other information. Sensitivity is often determined based on the expectation of the individual and/or the context of the information. Examples of sensitive information includes Social Insurance Numbers, credit files, identification documents, financial account numbers, and employee financial and non-financial records.
Publicly available Information, such as business contact information or a public directory listing of individuals’ names, addresses, and telephone numbers, or information that is aggregated and not associated with a specific individual, including demographic information and statistics, is not considered to be personal information.
The Personal Information Protection and Electronic Documents Act (PIPEDA), and similar provincial legislation (currently in British Columbia, Alberta and Quebec) is based on the 10 principles of PIPEDA, to which MCAN must adhere. These practices will provide the necessary assurances that personal information obtained and utilized by MCAN will be accurate, held in confidence and be retained in a secure environment.
The main compliance obligations under PIPEDA include the following privacy principles:
A Privacy Officer has been designated by MCAN to be responsible for compliance with PIPEDA and provincial privacy legislation. Accountability for the organization’s compliance with the principles rests with the designated Privacy Officer, even though other individuals within the organization may be responsible for the day-to-day collection and processing of personal information. In addition, other individuals within the organization may be delegated to act on behalf of the Privacy Officer.
We will obtain consent to collect, use or disclose personal information unless we are permitted or required by law to collect, use or disclose personal information without consent. Consent may be given orally, in writing, or electronically, and may be express or implied. We will ensure that the form of consent that we use is appropriate in the circumstances, and will take into account, how sensitive the personal information is, the circumstances in which the information is being collected, and the reasonable expectations of the person from whom is being collected in determining which form of consent to use. We will always obtain express consent when we are collecting, using, or disclosing sensitive personal information.
We collect, use and disclose different types of personal information in respect of Individuals. We only collect, use, and disclose personal information in accordance with applicable privacy legislation.
An Individual may choose not to provide us with some or all of their personal information. This may, however, severely restrict the products that MCAN can then provide, or may impact employment conditions for employees and directors of MCAN. An Individual may withdraw their consent to our use of their personal information at any time upon providing reasonable notice, as long as all of the following conditions are met:
1) the Individual provides MCAN notice in writing by either of the following methods:
MCAN Mortgage Corporation
200 King Street West, Suite 600
Toronto, ON M5H 3T4
2) withdrawing consent does not result in our or the Individual’s ability to fulfill the contractual obligations already in place with us; or ii) the Individual’s consent does not relate to a credit product we have granted to the Individual, where we are required pursuant to a legal obligation to collect and exchange some or all personal information on an ongoing basis, with credit insurers, other investors/lenders, or a credit bureau, or to maintain the integrity of the credit- granting system and the completeness of information held by credit bureau.
When an Individual indicates that they wish to withdraw their consent to our use of their personal information, we will explain the implications of this withdrawal to them.
We may collect personal information for the following purposes:
We will only collect, use, and disclose as much personal information as we require to fulfill the purposes for which the personal information is being collected, unless we are required or permitted by law to collect additional information.
In circumstances where MCAN is required by law to collect SINs, for example in respect of term deposit accounts or for MCAN employees, we will require Individuals to provide their SINs. In certain circumstances, for example to assist us to verify Individual’s credit related information, provision of SINs is optional, though in some circumstances alternative information may be required to verify identity or may otherwise be required in order to provide a particular product or service.
In addition, we may collect personal information in connection with our mortgage financing or other financial services through the use of a mortgage commitment letter or a credit application during the credit application and review process.
We will notify the individual from whom we are collecting information of the purpose or purposes for which we are collecting the information at or before the time that we collect the personal information so that they may choose whether to provide us with their personal information for those purposes. We may provide this notice either orally or in writing.
If an Individual refuses to provide us with certain personal information, we will not refuse to provide them with a product or service unless we are unable to provide it without this information.
If we intend to use the personal information that we have collected for a new purpose that we have not previously disclosed, we will communicate the new purpose prior to using the information for the new purpose, unless we are required or permitted by law to use the information for this new purpose without consent.
Other than as required or permitted by law, Individual’s personal information will not be used for any other purpose without consent.
We collect personal information when it is provided to us. MCAN may collect personal information directly from the person to whom the personal information relates. MCAN also collects personal information from third parties, such as brokers, or individuals that are opening an account to be operated on behalf of a third party, in accordance with anti-money laundering legislation, and provided that such third parties have obtained consent from the individual to whom the information relates to provide this personal information to us. In most circumstances where the personal information that we collect is collected from a third party, we will obtain permission before we seek out this information unless we are authorized by law to collect this information without an Individual’s consent. If we do not obtain permission, we take reasonable steps to ensure that such third parties have the right to share such personal information with us.
From time to time, we may utilize the services of third parties in our business. For example, we may use third party suppliers to print statements, conduct telemarketing, collect accounts, or process transactions on our behalf. We select third party suppliers carefully and ensure through contractual means that they have privacy and security standards that meet MCAN’s requirements and comply with applicable privacy laws. Similarly, payment transactions may be processed through payment systems operated by others and we may share personal information with these operators on a confidential basis to process transactions, provide client service, and for other reasonable purposes. These third parties will only be provided with as much personal information as they need to provide services to us. In some cases, these third parties may be located outside of Canada, and therefore personal information that has been collected by us may be processed and stored outside of Canada. Under the laws of foreign jurisdictions, in certain circumstances foreign courts, government authorities, regulators, or law enforcement agencies may be entitled to access this personal information without notice. Individuals will always be notified of this fact and will be made aware that by submitting their personal information to us, they agree to this transfer, storing, or processing.
MCAN has a strict policy of not disclosing personal information about Individuals, subject to the important exceptions discussed below, and in the section “Sharing Personal Information”.
The most common reason for release of an Individual’s personal information is that the Individual has given consent. We will not release an Individual’s personal information without consent unless we are permitted or required to do so pursuant to applicable laws.
We also may be authorized or required by law to release personal information, such as pursuant to a court order, or we may need to protect our assets, or the public’s interest. For example, we may release personal information about an Individual to legal authorities in cases of criminal activity, or for the detection and prevention of fraud. If we release information for any of the reasons described in this paragraph, we shall keep a record of what, when, why, and to whom such information was released.
We do not keep a record of why an Individual’s personal information is disclosed to third parties for routine purposes, such as reporting to Canada Customs and Revenue Agency (T5, T4 and other reports) and reporting to third parties when cheques are returned NSF for insufficient funds.
MCAN does not sell or rent lists of Individuals or any other personal information to others for their use.
If we wish to disclose an Individual’s personal information for a purpose that has not previously been consented to, we will ask for the Individual’s consent before disclosing their personal information for that purpose, unless we are permitted or required by law to disclose this information without consent.
We may also share Individual’s personal information with certain of our business partners who provide us with products and services in the course of our business with the Individual.
Personal information is only shared with business partners to the extent permitted by law, and to the extent necessary to provide the Individual with the best service pertaining to account due diligence and general account administration. We only share as much personal information with our business partners as they require to fulfill the purposes for which the personal information is being shared. In some cases, these business partners may be located outside of Canada, and therefore personal information that has been collected by us may be transferred outside of Canada. Under the laws of foreign jurisdictions, in certain circumstances foreign courts, government authorities, regulators, or law enforcement agencies may be entitled to access this personal information without notice.
We require our business partners to protect the personal information that we share with them in a manner that is consistent with this Policy, and any other MCAN policy and/or procedure that relates to the collection, use, and disclosure of personal information that is in effect from time to time.
We will not collect, use or disclose personal information without consent unless we are authorized or permitted by law to do so. The limited exceptions to the requirement to obtain consent for the collection, use, or disclosures of personal information are set out in applicable privacy legislation.
We are committed to maintaining the accuracy of Individual’s personal information for as long as it is being used for the purposes set out in this Policy and we will take reasonable steps to ensure that your personal information is accurate. An Individual can play an active role in keeping us up-to- date, and we will ask Individuals to update us if any of their personal information changes. Prompt notification by the Individual of any changes, for example, to the Individual’s address or direct contact information, will help us provide the Individual with the best possible service. We will update Individuals’ personal information only if it is necessary for us to do so to fulfill the purposes for which the information was collected.
Individuals are always free, upon review of their personal information, to request amendments be made under the terms set out in this Policy. If the request is reasonable, we will make the amendment as soon as we reasonably can and will notify any third party to which we have disclosed this information of the amendment.
If we do not agree to make the amendments that an Individual requests, we will notify the Individual of this in writing, and will keep a record of the requested amendments. The Individual may challenge our decision. We will make a record of this challenge, which will be kept on file.
We use appropriate safeguards to secure and protect personal information that is in our custody and/or control. We use physical, technical, and procedural safeguards that are appropriate to the sensitivity of the personal information in question. We ensure that we have comprehensive security controls and other safeguards to protect against unauthorized use, alteration, duplication, destruction, disclosure, loss or theft of, or unauthorized access to Individuals’ personal information.
MCAN may use other companies to provide services to Individuals on our behalf, such as the printing of correspondence, storage of information files in a secured environment, to conduct client satisfaction surveys, or to provide employee services and benefits. In such cases, we have contracts in place, holding these companies to the same high standards of confidentiality by which we are governed and requiring that any information provided by us must be kept strictly confidential and used only for the purposes of the contract.
MCAN ensures the physical, organizational and electronic security of Individual’s personal information through the use of secure locks on filing cabinets and doors, and restricted access to our information processing and storage areas. MCAN limits access to relevant information to authorized employees and business partners only, and through the use of pass keys and computer passwords and provides ongoing security management, including through, hard drive encryption, firewall management and continuous monitoring of systems.
MCAN has procedures in place when destroying, deleting, or disposing of personal information when it is no longer required for the purposes as set out in this Policy, or by law, to ensure that personal information is securely disposed of and to prevent unauthorized access to such personal information.
MCAN only keeps a Individual’s personal information for as long as it is needed to meet the purposes for which it was collected, unless we are required pursuant to applicable laws to retain this information for a different period of time. The length of time we retain personal information is affected by: (1) the type of product the Individual has from us, and (2) any legal requirements we may have to meet such as regulatory file retention periods or for being able to respond to any concerns the Individual may have even if the Individual is no longer a client or employee of ours.
Individuals will have access, as permitted by law, to their personal information that is in our custody or control, and information provided will be clear and in a format that is easy to understand. Individuals will also be able to request that corrections and/or updates be made to their personal information.
MCAN ensures that Individuals have reasonable means of accessing their personal information. MCAN does so by:
MCAN is accountable for all personal information that is in our custody or control, and we have designated a Privacy Officer that is ultimately responsible for the handling of this information, and for ensuring that we are complying with this Policy. The contact information for the Privacy Officer is set out below.
If an Individual has privacy questions, concerns or complaints, we want them to be answered satisfactorily or resolved as quickly as possible and ask that the Individual follow, in order, the following steps.
The Individual should direct his or her complaints and/or questions in writing to MCAN’s Privacy Officer.
MCAN Financial Group
200 King Street West, Suite 600
Toronto, ON M5H 3T4
For product and service related questions, concerns or complaints, the Individual may also call our Customer Service Centre and speak to a representative. If the Customer Service Representative is unable to resolve the matter to their satisfaction, the Individual should advise them that they wish the matter to be reviewed by the department manager who will contact them to resolve the issue. The Individual can reach MCAN Customer Service by calling:
telephone (toll free):
If, upon completion of a review by MCAN’s Privacy Officer, the Individual’s concerns are not resolved to his/her satisfaction, those concerns may be reviewed by the Privacy Commissioner of Canada, or one of the provincial Privacy Commissioners, if applicable. The Individual may contact the Privacy Commissioner of Canada by either of the following methods:
Office of the Privacy Commissioner of Canada
30 Victoria Street
telephone (toll free):
We will also notify the Individual that they may also contact the Commissioner at any time during the resolution process.
Any MCAN employee, who believes personal information is not being handled in accordance with this Policy, should immediately advise their manager and the Privacy Officer.
Any manager required to resolve privacy issues (as per the second step in our privacy question and complaint handling process) shall maintain appropriate records of any issue brought forward, and the steps taken in their resolution, and shall report them to the Privacy Officer.
A Cookie is a small text file that is placed on the browser or device you are using. Cookies allow us to tailor the Site to better match your interests and preferences. With most Internet browsers, you can erase Cookies from your computer hard drive, block the creation of Cookies, or receive a warning before a Cookie is stored, although doing so may affect your use of the Site and your ability to access certain features of the Site.
Our Site may use Web beacon, gif, or other technologies. When you access certain of our web pages, a non-identifiable notice of that visit is generated. These technologies usually work in conjunction with Cookies. If you don’t want your Cookie information to be associated with your visits to these pages, you can set your browser to turn off Cookies. If you turn off Cookies, Web beacon and other technologies will still detect visits to these pages, but the notices they generate cannot be associated with other non-identifiable Cookie information and are disregarded.
We may use third-party advertising companies to serve ads when you visit our website. These companies may use non-personally identifiable information about your visits to this and other websites to provide advertisements about good and services of interest to you on this or other websites. You can learn more about targeted advertising, its benefits and how you can opt-out of targeted advertising through the Digital Advertising Alliance of Canada’s website at http://youradchoices.ca/choices/. The website allows you to:
We collect certain non-personal information which is recorded by the standard operation of our internet servers on an anonymous basis, such as your IP address, the operating system you are using, the sections of the Site you visit, and the Site pages read and images viewed. This non-identifiable information is used on an aggregate basis and in a non-personally identifiable form, including: (i) for Site and system administration purposes, (ii) to improve the Site, (iii) to conduct internal reviews of the number of visitors to the Site (iv) to help us better understand visitors’ use of our Site; (v) to respond to specific requests from our visitors; and (vi) to protect the security or integrity of our Site when necessary. We do not use your IP address to identify you.