Personal Information Protection Policy

1. Introduction

CREECO is committed to protecting the personal information of its customers, employees, suppliers, and other stakeholders in accordance with the requirements of Bill 25, “Act respecting the protection of personal information in the private sector,” and other applicable privacy laws and regulations. This Personal Information Protection Policy outlines the principles and practices that CREECO follows in the collection, use, disclosure, and protection of personal information.

2. Definitions

Personal Information: Any information about an identifiable individual, including but not limited to name, address, email address, phone number, date of birth, financial information, and any other information that can be used to identify or distinguish an individual.

Consent: Voluntary agreement with the collection, use, or disclosure of personal information for specified purposes, which may be express or implied.

Privacy Officer: The individual designated by CREECO to oversee compliance with this policy and applicable privacy laws.

3. Collection of Personal Information

CREECO will only collect personal information that is necessary for the purposes identified by the company. Personal information will be collected by fair and lawful means.

CREECO will inform individuals of the purposes for which their personal information is being collected, either at the time of collection or as soon as practicable thereafter.

CREECO will obtain consent from individuals before collecting their personal information, except where permitted or required by law.

4. Use of Personal Information

Personal information collected by CREECO will only be used for the purposes identified at the time of collection or for purposes that are reasonably related to those purposes.

CREECO will not use personal information for any other purpose without obtaining consent from the individual, except where permitted or required by law.

5. Disclosure of Personal Information

CREECO will not disclose personal information to third parties without obtaining consent from the individual, except where permitted or required by law.

When disclosing personal information to third parties, CREECO will ensure that appropriate safeguards are in place to protect the privacy and security of the information.

6. Security of Personal Information

CREECO will take reasonable steps to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification.

CREECOwill implement and maintain appropriate administrative, technical, and physical safeguards to protect personal information in its possession or control.

7. Access to Personal Information

Upon request, individuals will be provided with access to their personal information held by CREECO.

Individuals may request corrections to their personal information if they believe it is inaccurate or incomplete. CREECO will make reasonable efforts to correct such information in a timely manner.

8. Accountability and Compliance

CREECO is responsible for ensuring compliance with this policy and applicable privacy laws.

The Privacy Officer is responsible for overseeing the implementation and enforcement of this policy and for responding to inquiries, complaints, and requests related to personal information protection.

9. Training and Awareness

CREECO will provide training to employees who handle personal information to ensure they understand their responsibilities under this policy and applicable privacy laws.

CREECO will raise awareness among employees, customers, and other stakeholders about the importance of protecting personal information and their rights related to privacy.

10. Review and Revision

This policy will be reviewed and revised as necessary to ensure it remains current and effective in protecting personal information and complying with applicable privacy laws.

11. Contact Information

For inquiries, complaints, or requests related to personal information protection, individuals may contact the Privacy Officer at privacyinguiry@boc-creeco.ca.

12. Effective Date

This Personal Information Protection Policy is effective as of March 27, 2025.

Certification:

This Personal Information Protection Policy has been approved and adopted by the Board of Directors of CREECO on March 27, 2025.