Committed to safeguarding your privacy

PRINCIPLE 1 – ACCOUNTABILITY
We are responsible for maintaining and protecting all member personal information under our control and have designated a Privacy Officer who is accountable for our compliance with the 10 principles that comprise this Privacy Agreement and applicable law.

PRINCIPLE 2 – IDENTIFYING PURPOSES
When we ask for your personal information, we identify what it will be used for.

PRINCIPLE 3 – CONSENT
We require your knowledge and consent for the collection, use or disclosure of your personal information, except where it is required or permitted by law. Consent can be express, implied or deemed. Express consent occurs when you take action to agree to something, such as by signing a form, clicking a box or indicating your agreement verbally. Implied consent occurs when it is reasonable to conclude that, based on the circumstances, you've agreed to something either by action you've taken or declined to take. Deemed consent occurs when you voluntarily provide personal information and your agreement to our use of that information for a particular purpose is obvious.

PRINCIPLE 4 – LIMITING COLLECTION
We collect personal information by fair and lawful means and limit our collection to those details necessary for identified purposes.

PRINCIPLE 5 – LIMITING USE, DISCLOSURE AND RETENTION
We use or disclose your personal information only for the purpose(s) for which it was collected, unless you consent otherwise, or when it is required or permitted by law. We retain personal information only for the time required to fulfill the purpose(s) for which it was collected.

PRINCIPLE 6 – ACCURACY
We maintain and update your personal information as accurately and completely as necessary to fulfill the purposes for which it is used.

PRINCIPLE 7 – SAFEGUARDING MEMBER INFORMATION
We protect your personal information with security safeguards appropriate to the sensitivity level of the personal information.

PRINCIPLE 8 – OPENNESS

We make information available to you concerning the policies and practices that apply to the management of your personal information.

PRINCIPLE 9 – MEMBER ACCESS
At your request, and subject to applicable law, you will be informed of the existence, use and disclosure of your personal information, and be given access to it. You may verify the accuracy and completeness of your personal information provided, and may request that it be amended.

PRINCIPLE 10 – HANDLING MEMBER COMPLAINTS AND SUGGESTIONS
Our Privacy Officer will answer any questions or enquiries you have about this Privacy Agreement or our privacy practices.

• All ACU employees are familiar with procedures that safeguard member personal information. The protection of your personal information is specified in our employment agreements and regularly confirmed in writing.

• Every employee is required to pass an annual privacy training course.

• We audit our procedures and security measures regularly to ensure that they are properly administered and remain effective and appropriate.

• We retain your personal information only as long as it is required for the reasons it was collected, or as is required by law. Depending on the product or service and the nature of the personal information, this period may extend beyond your relationship with us but only as long as it is necessary to accomplish the purposes for which it was collected, or as required by law.

• When your personal information is no longer needed, we have procedures in place to securely destroy, delete, erase or convert it to an anonymous form.

• Our systems ensure your Personal Identification Number (PIN), password and other access codes are kept private and confidential. For example, when you use your PIN at an ATM, the code is scrambled after you enter it. In addition, only you know your access codes. Our employees can’t find out what they are and will not ask you to reveal them.

• To help protect your personal information, we offer you the use of biometric services, using facial recognition technology. When you enroll in this program, the technology measures your facial features from an image, and encodes the result in a template of numerical values that are specific to your facial features. Each time you use the program to verify your identity to conduct business with us, the technology maps facial features from the image you provide and then compares the result to your previously registered facial image.

• When you enroll in online services such as CU@HOME Internet banking, the passwords you use are encrypted to ensure data security.

• As part of their contracts with us, our suppliers and agents have confidentiality agreements in place and may not use your personal information for unauthorized purposes.

• We ensure all legal enquiries or orders are valid and disclose only the personal information required or permitted by law to be disclosed.

• We use reCAPTCHA to help us protect you and our site, by verifying that you are not a robot. In order to do this, reCAPTCHA collects browser and user information from you. This information is then sent to Google, so that it can determine if the user is a robot. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

• Any email we use to send you information about important financial matters, such as the status of your account or any security breaches, will only be sent through the Secure Email Service. We will not request sensitive financial or personal information by any other email method. Please contact us if you receive an email about these matters that is not sent through the Secure Email Service.

ACU and our affiliates and partners in the Canadian Credit Union system collect, use or disclose your personal information to:

• verify your identity.
• provide you the products and services you request.
• develop, offer, manage and provide products and services that meet your needs.
• determine your eligibility for products and services you request or which we believe may benefit you.
• detect and prevent fraud and other criminal activity, and to help safeguard your and our financial interests, including through internal audits.
• help us collect debts or enforce obligations which are owed or guaranteed by you to us.
• meet other purposes we indicate on our website or otherwise communicate to you.
• meet our regulatory requirements.
• carry out any other purpose that you authorize or that is required or permitted by law.

The information we request depends on the product or service you want. Much of the personal information we ask for is either mandatory by law or vital for us to be able to do business with you. Here is a summary of the types of personal information we collect, and how that information is used.

Social Insurance Number (SIN)
In order to comply with the Canada Revenue Agency’s income reporting requirements, we must collect your SIN when you open a savings account or apply for an RRSP, RRIF or TFSA or other product that earns investment income.

Financial information
Your financial information is also necessary to assess your eligibility for credit products you request, such as a line of credit, loan or mortgage. At the same time, it helps us give you the most appropriate financial planning advice about investments and other products and services.

Product-specific information
Some products and services require you to provide a specific type of information. For example, information about your health may be required to determine your eligibility for insurance products.

Identification information
Knowing your birth date and other identification information, such as your name, address and occupation, helps identify you and reduces the risk that someone will impersonate you. We are required by anti-money laundering laws to cite and record details of certain documents, such as photographic ID and other personal documents. With your consent, we use biometric data to verify your identity when required for transactions. If you have enrolled in our facial recognition initiative, your facial image will be converted to a series of numbers which is encrypted and checked against a facial image is taken each time your identity is verified.

Intended uses of our products and services
Collecting information about how you intend to use, and use, our products and services allows us to better tailor those products and services to your needs.

Your feedback and opinions
As part of our commitment to continuous improvement, we sometimes employ the services of professional research companies to conduct independent member satisfaction surveys. These surveys will be conducted during your relationship with us or within a reasonable period of time thereafter. If you do not want to participate in these surveys, please contact our Privacy Officer. We also receive feedback from you, when you interact with us in person, on the phone or by email.

Transfer of personal information to service providers outside Canada
We may engage service providers to assist us in fulfilling the purposes that are set out in this agreement, and, in some instances, these service providers may be located outside Canada. We only select service providers that protect personal information in a manner that is comparable to the protection we provide under our own privacy policies. Please be advised that personal information may be subject to, and accessed under, the laws of the countries in which our service providers operate. If you have any questions about our transfer of personal information to our service providers outside Canada, or if you would like to learn more about our privacy policies in that regard, please contact our Privacy Officer.

We give the minimum amount of personal information necessary for our suppliers and agents to produce goods and services provided to you through us. For example:

• we must provide a cheque production company with the personal information you want printed on your ACU cheques.
• at times, we exchange member personal information with our Credit Union System affiliates regarding products and services offered countrywide. Examples include Credit Union Member Insurance Services (CUMIS) regarding insurance products and Aviso Wealth regarding mutual funds.
• where we engage a professional research company to help us understand how you view the quality of our products and services, we need to provide that company the names and contact information of our members.
• if we require service providers to assist with information technology services, for example, our biometrics identity verification measures.
• we regularly refer ACU members to Assiniboine Financial Group, our affiliated wealth management division.

Also, as part of our commitment to continuous improvement, we sometimes employ the services of professional research companies to conduct independent member satisfaction surveys. If you do not want to participate in these surveys, please contact our Privacy Officer.

Just as we may request personal information from a third party when you apply to ACU for credit, or if we believe a product or service offered by ACU may be of interest to you, we may disclose your ACU credit history to other lenders or credit bureaus if you apply for credit at another financial institution, with your consent. In these cases, we release only the information required to identify you and credit records about your repayment history.

We may disclose your personal information in order to complete a business transaction, such as a merger with another credit union or the sale to, or purchase of, another credit union. In such circumstances, we will only disclose your personal information to the other party to the transaction if the disclosure is necessary to complete the transaction and there is a written agreement that restricts the collection, use and disclosure of such personal information to purposes that relate to the business transaction.

If the business transaction is not completed, all personal information disclosed and collected by us will be destroyed or returned.

We are obligated to provide personal information in response to a valid demand, search warrant or other legal enquiry or order. We may also disclose personal information to help us collect a debt owed to us and in the case of a breach of agreement or contravention of law.

If you have a product or service with us, where ownership or liability is shared with others (such as a joint account or a guarantor on a loan), we may share any or all of the information relating to or about that product or service with these other people, including any of your personal information which relates to the account.